Términos de procesamiento de datos
- Condiciones de uso
- Política de privacidad
- Compromiso RGPD
- Términos de procesamiento de datos
- Política de cookies
- CCPA - Declaración de conformidad
In order that you as a service user and data controller (referred to as “Controller” or “you” or “your”) may use or continue to use certain services (the “Services”) offered by us, BS DE CASTRO INFORMÁTICA registered with the CNPJ under nº 13.076.798/0001-05 and data processor (referred to as “Bybrand” or “Processor”), you have agreed that these data processing terms (“Terms”) shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) in order to address the compliance obligations imposed upon Bybrand and its Clients pursuant to applicable Data Protection Law and in particular, Regulation (EU) 2016/679 (GDPR) and Lei Geral de Proteção de Dados (LGPD).
These Terms shall constitute a separate agreement or they may be incorporated by reference in the relevant Services agreement, as the case may be.
BY ACCEPTING ANY MATERIALS FROM BYBRAND OR OTHERWISE COMMENCING THE SERVICES (“EFFECTIVE DATE”), YOU AGREE THAT THE PROCESSOR WILL PROCESS BUSINESS PERSONAL DATA IN ACCORDANCE WITH THESE TERMS, WHICH YOU HEREBY ACCEPT FOR AND ON BEHALF OF THE CONTROLLER.
1. DEFINITIONS
1. In this Agreement, capitalised words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with, a party from time to time during the Term;
“Data Protection Law”means the data privacy laws applicable to the processing in connection with the Services, including, where applicable, the General Data Protection Regulation or the LGPD or similar law, or the applicable data privacy laws of any other relevant jurisdiction;
“Client” means any client of Bybrand;
“Contractual Clauses” means the standard contractual clauses of the European Commission for the transfer of personal data across borders, as amended or replaced from time to time, or any equivalent set of contractual clauses approved for use under Data Protection Law; and
“Business Personal Data” means the personal data processed by Processor in connection with the Services on behalf of Client during the Term. The processing may include activities auxiliary to our services, such as administrative and other services. This will include names and other information about data subjects included in Client materials.
2. The words “data subject”, “personal data”, “processing” and variations, “controller” and “processor” shall have the meaning attributed to them in Data Protection Law.
2. APPOINTMENT
1. Bybrand is designated by its Clients, Client Affiliates and Business Affiliates (collectively “Instructing Parties”) to provide and manage various services, including the Services on their behalf. Accordingly, Business Personal Data may contain personal data in relation to which Client and its Instructing Parties are controllers. Bybrand confirms that it is authorised to communicate to Client any instructions or other requirements on behalf of Client in respect of processing of Business Personal Data connection with the Services.
2. Processor is appointed by Client to process Business Personal Data on behalf of Client and/or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.
3. DURATION
The Terms shall commence on the Effective Date and shall continue in full force and effect until such time as all Services have ceased and all Business Personal Data in the Processor’s possession or within its reasonable control has been returned or destroyed (the “Term”).
4. DATA PROTECTION COMPLIANCE
1. In relation to its processing of Business Personal Data, save as otherwise required by law, Bybrand agrees to:
a) process Business Personal Data only as required in connection with the Services and in accordance with Client and its Instructing Parties documented lawful instructions from time to time;
b) inform Client and its Instructing Parties if, in Bybrand`s opinion, an instruction infringes Data Protection Law;
c) ensure that all personnel authorised by Bybrand to process Business Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
d) implement appropriate technical and organisational measures to appropriately safeguard Business Personal Data having regard to the nature of the personal data which is to be protected and the risk of harm which might result from any Security Breach (as defined below), at a minimum the measures set out in the Schedule;
e) promptly inform Client and its Instructing Parties of any data subject requests under Data Protection Law or regulatory or law enforcement requests relating to Business Personal Data. Bybrand shall not acknowledge or otherwise respond to the subject access request except with Client and its Instructing Parties prior written approval, which shall not be unreasonably withheld;
f) provide such assistance as Client and its Instructing Parties may reasonably require in order to ensure Bybrand’s compliance with Data Protection Law in relation to data security, data breach notifications, data protection impact assessments and prior consultations with a competent authority;
g) at Client and its Instructing Parties choice, without delay delete or return all Business Personal Data to Client and its Instructing Parties, and delete existing copies of all Business Personal Data in the Processor’s possession or within its reasonable control (including those held by a Subprocessor); and
h) make available to Client and its Instructing Parties information reasonably necessary to demonstrate Bybrand compliance with these Terms and allow for, and contribute to, audits and inspections carried out by Client and its Instructing Parties.
5. SUBPROCESSORS
1. Processor will sub-contract, outsource, assign, novate or otherwise transfer obligations under these Terms or engage any subcontractors involved in the processing of Business Personal Data (each a “Subprocessor”) only with Client’s prior written consent and subject to clause 2.
2. When engaging a Subprocessor, Processor will:
a) carry out reasonable due diligence;
b) enter into a contract on terms, as far as practicable, same as those in these Terms, and which may include Contractual Clauses to provide adequate safeguards with respect to the processing of Business Personal Data; and
c) inform Client of any intended changes concerning the addition or replacement of a Subprocessor from time to time. If Client object`s to any such change on reasonable grounds, then acting in good faith the parties will work together to resolve such objection.
6. SECURITY INCIDENTS
1. “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Business Personal Data transmitted, stored or otherwise processed.
2. Processor will notify Client without undue delay if Processor aware of any Security Breach.
3. Processor will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. Processor will take such further action as Client may reasonably request in order to comply with Data Protection Law.
4. Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach (“Notices“) without Client`s prior written approval; such approval shall not be unreasonably withheld.
7. INTERNATIONAL DATA TRANSFERS
1. Processor will ensure that no Business Personal Data are transferred out of either:
a) the European Economic Area; or
b) any other territory in which restrictions are imposed on the transfer of Business Personal Data across borders under Data Protection Laws,
c) without the prior written consent of Client.
2. Processor will ensure that Contractual Clauses or other applicable transfer mechanism, are in place to ensure adequate level of data protection.
8. INDEMNITY
Notwithstanding any provisions of the relevant Services agreement to the contrary, Processor shall and hereby agrees to indemnify Client and Instructing Parties and their officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or wilful breach by Processor of these Terms.
9. MISCELLANEOUS
1. Clause and other headings in these Terms are for convenience only and shall not affect the meaning or interpretation of these Terms.
2. To the extent of any conflict, these Terms shall prevail over any Services agreement or other agreement.
3. Nothing in these Terms will exclude or limit the liability of either party which cannot be limited or excluded by applicable law. Subject to the foregoing sentence, (i) these Terms, including any appendices, constitutes the entire agreement between the parties pertaining to the subject matter hereof and supersedes all prior agreements, understandings, negotiations and discussions of the parties relating to its subject matter; and (ii) in relation to the subject matter of these Terms neither party has relied on, and neither party will have any right or remedy based on, any statement, representation or warranty, whether made negligently or innocently, except those expressly set out in these Terms.
4. Client shall agree any amendment to these Terms that may be required from time to time for us and Instructing Parties to comply with any amended Data Protection Laws.
5. All notices of termination or breach must be in English, in writing and addressed to the other party’s primary contact person or legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the date of posting by recorded delivery or registered post.
6. The provisions of these Terms are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of these Terms shall remain in full force and effect.
7. These Terms are governed by Brazilian law and the parties submit to the exclusive jurisdiction of the Brazilian courts in relation to any dispute (contractual or non-contractual) concerning these Terms save that either party may apply to any court for an injunction or other relief to protect its property or confidential information. The foregoing shall not apply where Client`s Business is located within the European Union and in such circumstances the parties agree to submit to the exclusive jurisdiction of the Courts the where Client`s Business is located in.
SCHEDULE:
10. Security measures
a) Processor shall put in place the following measures, as applicable.
b) Minimum technical measures
c) Firewalls which are properly configured and using the latest software;
d) user access control management;
e) unique passwords of sufficient complexity and regular expiry on all devices;
f) secure configuration on all devices;
g) regular software updates, if appropriate, by using patch management software;
h) timely decommissioning and secure wiping (that renders data unrecoverable) of old software and hardware;
i) real-time protection anti-virus, anti-malware and anti-spyware software;
j) https;
k) encryption of all portable devices ensuring appropriate protection of the key;
l) encryption of personal data in transit by using suitable encryption solutions;
m) multi-factor authentication for remote access;
n) WPA-TKIP secured WiFi access;
o) delinquent web filtering and other appropriate internet access restrictions;
p) intrusion detection and prevention systems;
q) appropriate and proportionate monitoring of personnel; and
r) data backup and disaster recovery measures and procedures.
11. Minimal organisational measures
a) Vet all personnel including staff, contractors, vendors and suppliers (including Subprocessors) on continuous basis;
b) non-disclosure agreements used with all personnel;
c) regular training of all personnel on confidentiality, data processing obligations, identification of Security Breaches and risks;
d) apply principle of least authority, including a restricted or strictly controlled transit of data and material outside of office;
e) physical security on premises including reception or front desk, security passes, clean desk policy, storage of documents in secure cabinets, secure disposal of materials, etc.;
f) apply appropriate policies, as appropriate.
Contáctenos
Si tiene alguna duda sobre estas condiciones, póngase en contacto con nosotros. privacy@bybrand.io