2. Scope and Roles

2.1. This DPA applies only to the extent that Levelpath Processes Personal Data that is subject to applicable Data Protection Law in the course of providing the Services pursuant to the Agreement.

2.2. If Data Protection Law applies to the Processing of Personal Data, the parties agree that Levelpath
shall process Personal Data only as a Processor acting on behalf of Customer and, with respect to CCPA and other applicable U.S. state privacy laws, as a Service Provider, in each case, regardless of whether Customer acts as a Controller or as a Processor on behalf of a third-party Controller with respect to Personal Data.

2.3. The subject matter, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are set out in Annex I, which is an integral part of this DPA.

3. Instructions

3.1. Levelpath will only Process Personal Data to provide the Services to Customer.

3.2. It is the parties’ intent that Levelpath is a Service Provider, and Levelpath certifies that it will not (a) Sell or Share Personal Data; (b) Process Personal Data outside the direct business relationship between the parties or for any purpose other than to provide the Services in accordance with the Agreement, unless required by applicable laws; or (c) combine the Personal Data that Levelpath receives from or on behalf of Customer with personal data that Levelpath collects or receives from another person.

3.3. Customer’s instructions are documented in Annex I, the Agreement, and any applicable statement of work.

3.4. Customer may issue additional instructions to Levelpath as it deems necessary to comply with Data Protection Law. Such instructions must be provided to Levelpath in writing and acknowledged in writing by Levelpath as constituting instructions for purposes of this DPA, and Levelpath may
charge a reasonable fee to comply with any such additional instructions.

3.5. The parties acknowledge and agree that the disclosure of Personal Data by the Customer to Levelpath does not form part of any monetary or other valuable consideration exchanged between the parties.

​

4. Customer Responsibilities
 

5.1 Customer is responsible for the lawfulness of Personal Data processing under or in connection with the Services. Customer shall (i) have provided, and will continue to provide all notices and have obtained, and will continue to obtain, all consents, permissions and rights necessary under
applicable Data Protection Law for Levelpath to lawfully process Personal Data for the purposes contemplated by the Agreement (including this DPA); (ii) make appropriate use of the Services to ensure a level of security appropriate to the particular content of the Personal Data; (iii) have complied with all Data Protection Law applicable to the collection of Personal Data and the transfer of such Personal Data to Levelpath and its Subprocessors; and (iv) ensure its processing instructions comply with applicable laws (including applicable Data Protection Law).

​

5. Personnel and Subprocessing

5.1. Levelpath will take steps to ensure that all Personnel authorized to process Personal Data agree to appropriate confidentiality arrangements.
 

5.2. Customer authorizes Levelpath to engage (including the disclosure of Personal Data under the Agreement to such Subprocessors): the Subprocessors included in the list of Subprocessors provided to Customer and set out in Annex III (“Subprocessor List”); and Subprocessors engaged
in accordance with Section 5.3.

5.3. Where Levelpath intends to engage any additional Subprocessor not already approved on the Subprocessor List, Levelpath will notify Customer of the proposed engagement of the Subprocessor giving Customer the opportunity to object. If Customer does not make a reasonable objection to the proposed engagement within 30 days of Levelpath providing notice to Customer under this Section 5.3, Customer is deemed to have authorized the engagement of such Subprocessor. If Customer objects prior to the appointment of such Subprocessor on reasonable grounds relating to the Subprocessor’s ability to protect Personal Data in accordance with this DPA, Levelpath will work with Customer in good faith to resolve the issue. If an alternative solution cannot be found, Customer and Levelpath may agree to terminate the impacted Services, and the Customer shall pay Levelpath any fees due for the Services performed prior to termination.

5.4. Levelpath will enter into a written agreement with all Subprocessors which imposes substantially similar obligations on the Subprocessors as this DPA imposes on Levelpath. Levelpath will remain fully liable to the Customer for the performance of each Subprocessor’s data protection obligations relating to this DPA in the event the Subprocessor fails to fulfil those obligations.

5.5. To the extent required by law, Levelpath will provide a copy of Levelpath’s agreements with Subprocessors to Customer upon request. Levelpath may redact commercially sensitive information before providing such agreements to Customer.

​

6. Restricted Data Transfers

6.1. In the event that the Personal Data Processed under the DPA is subject to Data Protection Law and the transfer of Personal Data to Levelpath would be restricted in the absence of the Standard Contractual Clauses, the parties agree that the Standard Contractual Clauses shall be incorporated into this DPA with Customer as the “data exporter” and Levelpath as the “data
importer.”

6.2. The EU SCCs are completed as follows: the optional docking clause in Clause 7 is implemented; Clause 9(a) option 2 is implemented and the time period therein is specified as thirty (30) days; the optional redress clause in Clause 11(a) is struck; the governing law in Clause 17 is the law of Ireland; the court in Clause 18(b) are the courts of Ireland; and Annex 1, 2 and 3 to the EU SCCs are the appendices of this DPA. To the extent required by Data Protection Law in the UK, Part 1, tables 1, 2 and 3 of the UK SCCs will be deemed to be completed like its equivalent provisions in the EU SCCs. For the purpose of Part 1, Table 4, the party that may end the UK SCCs in accordance with Section 19 of the UK SCCs is the importer.

7. Security and Personal Data Breaches

​

7.1. Levelpath will implement and maintain appropriate technical and organizational measures in relation to the Processing of Personal Data to ensure a level of security appropriate to the risks which may occur as a result of Processing Personal Data, and in particular the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer
Personal Data, including the measures listed in Annex II (as appropriate).

7.2. Levelpath will inform Customer without undue delay after becoming aware of a Personal Data Breach and provide Customer with details of the Personal Data Breach as required under Data Protection Laws.

7.3. Levelpath’s notification of or response to a Personal Data Breach under Section 7.2 will not be construed as an acknowledgement by Levelpath of any fault or liability with respect to the Personal Data Breach.

7.4. In the event of a Personal Data Breach, Customer is solely responsible for complying with all laws relating to investigation of such Personal Data Breaches and notification of affected individuals, regulators and other parties.

​​

8. Assistance

8.1. Levelpath will reasonably assist Customer, including by implementing appropriate technical and organizational measures, with the fulfillment of Customer’s own obligations under Data Protection Law, including:

a) complying with Data Subjects’ requests to exercise Data Subject Rights;
b) replying to inquiries or complaints from Data Subjects;
c) replying to investigations and inquiries from Supervisory Authorities;
d) conducting data protection impact assessments, and prior consultations with Supervisory Authorities; and
e) notifying Personal Data Breaches.

8.2. Unless prohibited by Data Protection Law, Levelpath will inform Customer as soon as reasonably practicable if Levelpath:

a) receives a request, complaint or other inquiry regarding the Processing of Personal Data from a Data Subject or Supervisory Authority;
b) receives a binding or non-binding request to disclose Personal Data from law enforcement,
courts or any government body;
c) is subject to a legal obligation that requires Levelpath to Process Personal Data in contravention of Customer’s instructions; or
d) is otherwise unable to comply with Data Protection Law or this DPA.

8.3. Unless prohibited by Data Protection Law, Levelpath will obtain Customer’s written authorization before responding to, or complying with any requests, orders, or legal obligations referred to in Section 8.2.

9. Accountability

9.1. Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate Levelpath’s unauthorized use of Personal Data.

9.2. Levelpath will inform Customer without undue delay if Levelpath believes that a written instruction by Customer pursuant to this DPA, violates Data Protection Law, in which case Levelpath may suspend the Processing until Customer has modified or confirmed the lawfulness of the instructions in writing.

10. Audit
 

10.1. Upon Customer’s prior written request, and no more than once in a calendar year, Levelpath will make available to Customer the required information reasonably necessary to demonstrate compliance with the obligations of Data Protection Law and this DPA. Levelpath shall provide
additional information as reasonably necessary to allow for and contribute to audits, including inspections, conducted by a Supervisory Authority, Customer or another auditor mandated by law.

10.2. If a third party is to conduct the audit, Levelpath may object to the auditor if the auditor is, in Levelpath’s reasonable opinion, not suitably qualified or independent, a competitor of Levelpath or otherwise manifestly unsuitable. Such objection by Levelpath will require Customer to appoint
another auditor or conduct the audit itself.

​

10.3. The audit must be conducted during regular business hours at the applicable facility, subject to an audit plan agreed to between the parties at least two weeks in advance and may not unreasonably interfere with Levelpath’s business activities.

10.4. If Customer’s requested audit scope is addressed in an SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer’s audit request and Levelpath confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the
controls covered by the report.

10.5. Any Customer-requested audits are at Customer’s expense. Customer shall reimburse Levelpath for any time expended by Levelpath or its Subprocessors in connection with any Customer-requested audits or inspections at Levelpath’s then-current professional services rates, which shall
be made available to Customer upon request.

10.6. Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA. The audit reports are confidential information of the parties under the terms of the Agreement.

​​

11. Liability

11.1. The total combined liability of either party and its Affiliates towards the other party and its Affiliates, whether in contract, tort or any other theory of liability, under or in connection with Agreement and this DPA combined, will be limited to limitations on liability or other liability caps agreed to by the parties in the Agreement.

​

12. Confidentiality

12.1. Levelpath will keep all Personal Data and all information relating to the Processing thereof, in strict confidence.

​

13. Analytics

13.1 Customer acknowledges and agrees that Levelpath may create and derive from Processing related to the Services anonymized and/or aggregated data that does not identify Customer or any natural person, and use, publicize or share with third parties such data to improve Levelpath’s products and services and for its other legitimate business purposes.

​

14. Notifications

14.1. Levelpath will make all notifications required under this DPA as agreed to in the Agreement or the then established daily point of contact with the Customer.

​

15. Terms and Duration of Processing

15.1. On expiration or termination of the Agreement, or upon written request from Customer at any time, Levelpath will, as soon as reasonably practicable, return or securely delete and destroy all Personal Data in Levelpath’s possession or control, except as otherwise required by law or set out in the Agreement. Upon request from Customer, Levelpath will certify such secure deletion in writing within ninety (90) days of Customer’s request.

​

16. Modification of this DPA

16.1. This DPA may only be modified by a written amendment signed by both Customer and Levelpath.

​

17. Invalidity and Severability

17.1. If any provision of this DPA is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.