{"id":8783,"date":"2023-10-06T10:34:55","date_gmt":"2023-10-06T09:34:55","guid":{"rendered":"https:\/\/cms.scantrust.com\/?page_id=8783"},"modified":"2023-10-17T11:30:34","modified_gmt":"2023-10-17T10:30:34","slug":"data-protection-agreement","status":"publish","type":"page","link":"https:\/\/cms.scantrust.com\/data-protection-agreement\/","title":{"rendered":"Scantrust: data protection agreement"},"content":{"rendered":"\n\n\n\n\n\n
\n\t
<\/div>\n\t\t\t
\n\t\t\t\t\n \n Data Protection Agreement\n <\/h1>\n\n\n

This Data Protection Agreement (the \u201c<\/span>DPA<\/b>\u201d) forms part of the Agreement entered into between Customer and Scantrust SA.\u00a0\u00a0<\/span><\/p>\n

In furtherance of the Agreement, Customer as controller wishes to subcontract certain services, which imply the processing of personal data, to Scantrust as the processor.<\/span><\/p>\n

The parties seek to implement a data processing agreement to ensure compliance with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95\/46\/EC (\u201c<\/span>GDPR<\/b>\u201d).<\/span><\/p>\n

The parties wish to lay down their rights and obligations.<\/span><\/p>\n

 <\/p>\n

1. Definitions: Scope.<\/b><\/p>\n

1.1<\/span> Definitions<\/span><\/span>.\u00a0 Unless otherwise defined herein, capitalized terms in this DPA shall have the meanings ascribed to them in the Agreement.\u00a0 The terms \u201c<\/span>controller<\/b>\u201d, \u201c<\/span>data subject<\/b>\u201d, \u201c<\/span>personal data<\/b>\u201d, \u201c<\/span>personal data breach<\/b>\u201d, \u201c<\/span>processing<\/b>\u201d and \u201c<\/span>processor<\/b>\u201d shall have the meaning set forth in the GDPR.\u00a0<\/span><\/p>\n

1.2<\/span> Scope<\/span><\/span>.<\/span> The provisions of this DPA prevail over the provisions of the Agreement with respect to personal data processed by Scantrust pursuant to the Agreement.\u00a0\u00a0<\/span><\/p>\n

1.3<\/span> Notice and Consent Regarding Transfer of Data<\/span><\/span>.<\/span>\u00a0 Use of the Scantrust Platform and mobile applications may require that personal data and Customer Data be transferred to jurisdictions other than the European Union and\/or the European Economic Area (<\/span>EEA<\/b>) where Scantrust maintains computing systems, resources and infrastructure necessary reside (\u201c<\/span>Scantrust Geographies<\/b>\u201d) for the functioning and support of the Platform.\u00a0 Pursuant to Article 49 of the GDPR, Customer hereby expressly consents to the processing by, and transfer of, personal data to Scantrust entities in Scantrust Geographies for those purposes, which will ensure that the personal data are adequately protected.\u00a0 To achieve this, Scantrust will, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of such personal data.<\/span><\/p>\n

 <\/p>\n

<\/b>2. Roles and Responsibilities.\u00a0\u00a0<\/b><\/p>\n

2.1<\/span> Processing of Customer Personal Data<\/span>.\u00a0\u00a0<\/span><\/span><\/p>\n

A. Scantrust shall comply with all applicable Data Protection Laws in the processing of Customer personal data and not process Customer personal data other than on the relevant Customer\u2019s documented instructions. \u201c<\/span>Data Protection Laws<\/b>\u201d means GDPR and, to the extent applicable, the data protection or privacy laws of any other country.<\/span><\/p>\n

B. Customer instructs Scantrust to process Customer personal data in relation to the performance of the Agreement.<\/span><\/p>\n

C. Customer represents that it is the sole controller of Customer Data, including any Personal Data, and that it has obtained all rights to process Customer Data, including for Santrust to process of the same in relation to the Agreement. Scantrust will comply and maintain records for all such instructions to the extent necessary for Scantrust to: (i) comply with its processor obligations under the applicable Data Protection Laws; or (ii) assist Customer to comply with Customer\u2019s obligations as a controller under such laws.\u00a0<\/span><\/p>\n

D. Processor shall not appoint (or disclose any Customer personal data) to any subprocessor unless required or authorized by the Customer.<\/span><\/p>\n

E. Scantrust will take reasonable steps to ensure the reliability of any employee, agent or contractor of any subprocessor who may have access to the Customer personal data, ensuring in each case that access is strictly limited to those individuals who need to know \/ access the relevant Customer personal data, as strictly necessary for the purposes of the Agreement, and to comply with applicable Data Protection Laws in the context of that individual\u2019s duties to Scantrust, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.<\/span><\/p>\n

2.2<\/span> Limitations<\/span><\/span>.<\/span>\u00a0 Customer acknowledges and agrees that software and services provided by Scantrust give the Customer, not Scantrust, control over access, additions, deletions, modifications and monitoring of personal data included in Customer Data and that, accordingly, with respect to Customer\u2019s use of the Platform: (i) the core activities of Scantrust do not involve any monitoring of a data subject; and (ii) Scantrust does not have actual knowledge of the types of personal data that Customer may host using the Scantrust Solution.\u00a0\u00a0<\/span><\/p>\n

2.3<\/span> Subprocessor<\/span><\/span>.<\/span> Customer acknowledges and agrees that Amazon Web Services (\u201c<\/span>AWS<\/b>\u201d), may act as a sub-processor under this DPA and Customer hereby accepts the provisions of AWS\u2019s form of Data Processing Addendum (the \u201c<\/span>AWS DPA<\/b>\u201d).\u00a0 Customer acknowledges that the AWS DPA meets the requirements of the GDPR and this DPA, and that processing of personal data under the AWS DPA is authorized and approved by Customer.<\/span><\/p>\n

 <\/p>\n

3. Technical and Organizational Measures<\/b>.\u00a0 Scantrust will take appropriate technical and organizational measures for its own systems to comply with data privacy in order to ensure a level of data protection appropriate to the risk resulting from the processing of personal data under the Agreement, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the severity and likelihood of realization of risks for the rights and freedoms of data subjects.\u00a0\u00a0<\/span><\/p>\n

 <\/p>\n

4. Data Subject Rights. <\/b>Taking into account the nature of the processing, Scantrust shall assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer obligations, as reasonably understood by Customer, to respond to requests to exercise data subject rights under the applicable Data Protection Laws.<\/span><\/p>\n

Scantrust shall: (i) promptly notify Customer if it receives a request from a data subject under any Data Protection Law in respect of Customer personal data; and (ii) ensure that it does not respond to that request except on the documented instructions of Customer or as required by applicable Data Protection Laws to which Scantrust is subject, in which case Scantrust shall to the extent permitted by applicable Data Protection Laws inform Customer of that legal requirement before Scantrust responds to the request.<\/span><\/p>\n

 <\/p>\n

5. Personal Data Breach. <\/b>Scantrust shall notify Customer without undue delay upon Scantrust becoming aware of a personal data Breach affecting Customer personal data, providing Customer with sufficient information to allow the Customer to meet any obligations to report or inform data subjects of the personal data Breach under the Data Protection Laws.<\/p>\n

Scantrust shall co-operate with the Customer and take reasonable commercial steps as are directed by Customer to assist in the investigation, mitigation and remediation of each such personal data Breach.<\/span><\/p>\n

 <\/p>\n

6. Audit.<\/b><\/p>\n

6.1<\/span> Audit<\/span><\/span>.<\/span>\u00a0 Subject to this Section, Scantrust shall make available to the Customer on written request all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the processing of the Customer personal data by Scantrust.<\/span><\/p>\n

Information and audit rights of the Customer only arise under this Section to the extent that the DPA does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.<\/span><\/p>\n

6.2<\/span> Audit Rights to Subcontractors<\/span>.<\/span><\/span>\u00a0 <\/b>Scantrust hereby grants the Customer power of attorney to exercise any audit rights granted by AWS under the AWS DPA, provided that any results of audits will be shared with Scantrust. The execution of the Customer\u2019s audit rights regarding subcontractors is performed by Scantrust in the framework of the audit rights described in this Section 6. <\/span>\u00a0<\/b><\/p>\n

 <\/p>\n

7. Deletion or return of Customer Personal Data. <\/b>Subject to this Section, Scantrust shall promptly and in any event within 10 business days of the date of cessation of any services under the Agreement involving the processing of Customer personal data, delete and procure the deletion of all copies of those Customer personal data.<\/p>\n

 <\/p>\n

8. Miscellaneous.\u00a0<\/b><\/p>\n

8.1<\/span> <\/span>Notices<\/span>. All notices and communications given under this DPA must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this DPA at such other address as notified from time to time by the Parties changing address.<\/span><\/p>\n

8.2<\/span> <\/span>Governing Law and Jurisdiction.<\/span> This Agreement is governed by the laws of Switzerland. Any dispute arising in connection with this DPA, which the parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the Swiss courts.<\/span><\/p>\n

 <\/p>\n<\/div>\n\n\t\t\t\t<\/div>\n\t<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"editor_plus_copied_stylings":"{}"},"acf":[],"yoast_head":"\nScantrust: data protection agreement - Scantrust<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Scantrust: data protection agreement\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cms.scantrust.com\/data-protection-agreement\/\" \/>\n<meta property=\"og:site_name\" content=\"Scantrust\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-17T10:30:34+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Scantrust: data protection agreement - Scantrust","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_GB","og_type":"article","og_title":"Scantrust: data protection agreement","og_url":"https:\/\/cms.scantrust.com\/data-protection-agreement\/","og_site_name":"Scantrust","article_modified_time":"2023-10-17T10:30:34+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cms.scantrust.com\/data-protection-agreement\/","url":"https:\/\/cms.scantrust.com\/data-protection-agreement\/","name":"Scantrust: data protection agreement - Scantrust","isPartOf":{"@id":"https:\/\/cms.scantrust.com\/#website"},"datePublished":"2023-10-06T09:34:55+00:00","dateModified":"2023-10-17T10:30:34+00:00","breadcrumb":{"@id":"https:\/\/cms.scantrust.com\/data-protection-agreement\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cms.scantrust.com\/data-protection-agreement\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cms.scantrust.com\/data-protection-agreement\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cms.scantrust.com\/"},{"@type":"ListItem","position":2,"name":"Scantrust: data protection agreement"}]},{"@type":"WebSite","@id":"https:\/\/cms.scantrust.com\/#website","url":"https:\/\/cms.scantrust.com\/","name":"Scantrust","description":"QR code solutions for global brands","publisher":{"@id":"https:\/\/cms.scantrust.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cms.scantrust.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/cms.scantrust.com\/#organization","name":"Scantrust","url":"https:\/\/cms.scantrust.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/cms.scantrust.com\/#\/schema\/logo\/image\/","url":"https:\/\/cms.scantrust.com\/wp-content\/uploads\/2023\/04\/Logo-Full-color-on-blueblue.png","contentUrl":"https:\/\/cms.scantrust.com\/wp-content\/uploads\/2023\/04\/Logo-Full-color-on-blueblue.png","width":600,"height":60,"caption":"Scantrust"},"image":{"@id":"https:\/\/cms.scantrust.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/scantrust\/"]}]}},"_links":{"self":[{"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/pages\/8783"}],"collection":[{"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/comments?post=8783"}],"version-history":[{"count":11,"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/pages\/8783\/revisions"}],"predecessor-version":[{"id":8803,"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/pages\/8783\/revisions\/8803"}],"wp:attachment":[{"href":"https:\/\/cms.scantrust.com\/wp-json\/wp\/v2\/media?parent=8783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}