Data Protection Addendum (DPA)

ANNEX I 
A.  LIST OF PARTIES

MODULE TWO: Transfer controller to processor

Data exporter(s): 

Name: Customer, as specified in the MSA or Order Form. 

Address: \companyaddress_1_text\

Contact person’s name, position and contact details: \dpacontactinfo_1_text\

Activities relevant to the data transferred under these Clauses: 

Signature and date: The Parties are deemed to have signed this Annex I by signing the DPA.

Role (controller/processor): Controller

Data importer(s): 

Name: HG Insights, Inc

Address: 1 North Calle Cesar Chavez, Suite 100, Santa Barbara, CA 93103,

Contact person’s name, position and contact details: Bill Tole, CFO, legal@hginsights.com

Activities relevant to the data transferred under these Clauses: The importer will perform the Services as described in the main agreement and in the DPA when requested by the exporter.

Signature and date: The Parties are deemed to have signed this Annex I by signing the DPA.

Role (controller/processor): Processor

B. DESCRIPTION OF TRANSFER

MODULE TWO: Transfer controller to processor

Categories of data subjects whose personal data is transferred: Users/Customers/Prospective customers of Customer’s Products.

Categories of personal data transferred: 

• • Contact information
    
    1. Name;
    2. email address;
    3. Phone number.
  • Professional records:
    
    1. job title;
    2. job location (work address);
    3. Company
  • Identifiers:
    
    1. IP address
  • Other:
    
    1. information relevant to sales, such as details about past or scheduled meetings;
    2. behavior on the Customer’s website;
    3. lead score; and
    4. web application usage data.

   

• Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. None.

  The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). On a continuous basis for as long as Customer is engaging HG Insights to provide Services. 

  Nature of the processing: 

  Purpose(s) of the data transfer and further processing: To provide the Services as described in the MSA and/or the Order Form. 

  The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For so long as the exporter is engaging the importer for the provision of Services. 

  For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: The sub-processors provide support to importer to perform the Services. See Schedule C for additional detail.

  C.  COMPETENT SUPERVISORY AUTHORITY

  MODULE TWO: Transfer controller to processor

  Identify the competent supervisory authority/ies in accordance with Clause 13:

  The parties shall follow the rules for identifying such authority under Clause 13 and, to the extent legally permissible, select the Irish Data Protection Commission.

  ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

  Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

  See Schedule B immediately below.