Updated 19th March 2018
This Data Protection Agreement “DPA” becomes effective upon the later of i) the acceptance of the Terms of Service or ii) May 25, 2018.
Customer shall make available to Nevis Systems and Customer authorizes Nevis Systems to process information including personal data for the provision of the Services under the Agreement. The parties have agreed to enter into this DPA to confirm the data protection provisions relating to their relationship and so as to meet the requirements of applicable Privacy Laws.
“Nevis Systems Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with Nevis Systems. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity;
“Privacy Laws” mean any applicable law relating to data protection and security, including without limitation EU Data Protection Directive (EU Directive 95/46/EC of the European parliament and of the council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), Directive on privacy in electronic communications (Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector) and General Data Protection Regulation (Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 94/46/RC) (“GDPR”)and any amendments, replacements or renewals thereof (collectively the “EU Legislation”), all binding national laws implementing the EU Legislation and other binding data protection or data security directives, laws, regulations and rulings valid at the given time including any guidance and codes of practices issued by the applicable supervisory authority;
“Security Directives” means all agreed applicable security requirements and security instructions and their updates applicable at each time and described in Appendix 1.
the terms “data controller“, “data processor“, “data subject“, “personal data” “processing” and “appropriate technical and organisational measures” shall have the meanings given to them under applicable Privacy Laws.
2.1 The Parties understand that for the provision of the Services a distinction is made between two types of processing of personal data: (i) the provision of platform services (i.e. the database of call data records and the logs created and managed by Nevis Systems on behalf and under the supervision of Customer) for which Nevis Systems will act as a data processor and agrees to comply with the respective obligations set out in Articles 3 – 11, and (ii) the transmission of messages (i.e. A2P SMS) by Nevis Systems and other Service Providers for which Nevis Systems will act as a data controller and agrees to comply with the respective obligations set out in Article 13.
3.1 The subject matter, nature and purpose of the processing of personal data under this DPA is Nevis Systems performance of the Services pursuant to the Agreement and as further instructed in writing by the Customer in its use of the Services, unless required to do so otherwise by Privacy Laws, in which case to the extent permitted by Privacy Laws, Nevis Systems shall inform the Customer of this legal requirement prior to carrying out the processing. Nevis Systems shall only collect or process personal data for the duration of the Agreement to the extent, and in such a manner, as is necessary for provision of the Services and in accordance with the Agreement and Privacy Laws applicable to Nevis Systems in its role as data processor.
Nevis Systems shall process personal data originating from and sent to a country located in the EU/EEA or Switzerland solely in countries situated in the EU/EEA or Switzerland and not cause any cross border transfer of personal data from a country situated in the EU/EEA or Switzerland to any country situated outside the EU/EEA or Switzerland unless personal data is transferred to a country approved by the European Commission as providing an adequate level of protection for personal data, the transfer is made pursuant to European Commission approved
3.2 standard contractual clauses for the transfer of Personal Data for which the Customer provides a power of attorney for Nevis Systems to enter into any such European Commission approved standard contractual clauses with a Sub-processor approved as set out in clause 9 in the name and on behalf of the Customer.
4.1 The processing of personal data will be carried out by Nevis Systems for the duration of the Agreement unless otherwise agreed upon in writing.
5.1 The Customer may submit Customer personal data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, but is not limited to the following categories of personal data:
The Customer may submit personal data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, but is not limited to personal data relating to the following categories of data subject:
7.1 Nevis Systems has implemented and maintains appropriate technical and organisational measures in accordance with Article 28, 3 (c) and Article 32 in particular in relation with Article 5, 1 and 2 GDPR. Such measures include but not limited to physical and IT measures, and organisational measures to protect personal data processed against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure. Such measures, as described in the Security Directives, and provide a level of security that is appropriate to the risks of the processing having regard to:
7.2 The Technical and Organisational Measures are subject to technical progress and further development. In this respect Nevis Systems may implement alternative adequate measure, however, the security level of the defined measures must never be reduced. Major changes must be documented.
8.1 Nevis Systems shall comply with the mandatory requirements referred to in Articles 28 to 33 GDPR, and ensures in particular compliance with the following requirements:
a) Appoint a data protection officer, who performs his/her duties in compliance with Articles 38 and 39 GDPR. The data protection officers contact details are available at Nevis Systems web page.
b) Confidentiality in accordance with Article 28, 3 (b), Articles 29 and 32 (4) GDPR. Nevis Systems entrusts only such employees with the data processing outlined in this contract who have been bound to confidentiality and have previously been familiarised with the data protection provisions relevant to their work. Nevis Systems and any person acting under its authority who has access to personal data, shall not process that data unless on instructions from the Customer, which includes the powers granted in this Amendment, unless required to do so by Privacy Laws.
c) At the Customer’s cost and expense and taking into account the nature of the processing and the information available to Nevis Systems, provide such information and assistance as the Customer may reasonably require and within the timescales reasonably specified by the Customer to assist the Customer to comply with its obligations under applicable Privacy Laws which may include assisting the Customer to:
(i) notify the Customer of any request Nevis Systems receives for a data subject relating to personal data processed;
(ii) comply with its security obligations;
(iii) discharge its obligations to respond to requests relating to the exercise of Data Subject rights including right of access, right to rectification, right to erasure (“right to be forgotten”) right to restriction of processing (to the extent that personal data is not accessible to the Customer through the Services);
(iv) carry out Data Protection Impact Assessment and audit Data Protection Impact Assessment compliance and consult with the supervisory authority
(v) following Data Protection Impact Assessment.
d) Unless prohibited by applicable law or a legally binding request of law enforcement, Nevis Systems shall promptly notify the Customer of any request by, any government official, data protection supervisory authority or law enforcement authority in respect of any personal data;
e) Nevis Systems shall periodically monitor the internal processes and the Security Directives to ensure that processing within Nevis Systems area of responsibility is in accordance with the requirements of Privacy Laws and the protection of the rights of the data subject.
9.1 The Customer agrees that Nevis Systems may engage Nevis Systems Affiliate or third parties to process personal data in order to assist Nevis Systems to deliver the Services on behalf of the Customer (“Sub-processors”). Nevis Systems has or will enter into written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA to the extent applicable to the nature of the Services provided by such Sub-processor. If the Sub-processor processes the Services outside the EU/EEA, Nevis Systems shall ensure that the transfer is made pursuant to European Commission approved standard contractual clauses for the transfer of Personal Data which the Customer authorises Nevis Systems to enter into on its behalf, or that other appropriate legal data transfer mechanisms are used.
9.2 The current Sub-processors for the Services are set out at https://www.world-text.com/docs/sub-processors.php (“Sub-processor List”) and the Customer agrees and approves that Nevis Systems has engaged such Sub-processors to process personal data as set out in the list. The Customer may find at https://www.world-text.com/docs/sub-processors.php a mechanism to subscribe to notifications of new Sub-processors for each applicable Service, to which Customer shall subscribe, and if the Customer subscribes, Nevis Systems shall provide notification of a new Sub-processor(s) before authorising any new Sub-processor(s) to process personal data in connection with the provision of the applicable Service.
9.3 Nevis Systems shall notify the Customer, in accordance with the mechanism set out in clause 2, thirty (30) days’ in advance of any intended changes concerning the addition or replacement of any Sub-processor during which period the Customer may raise objections to the Sub-processor’s appointment. Any objections must be raised promptly (and in any event no later than fourteen (14) days following Nevis Systems’s notification of the intended changes). Should Nevis Systems choose to retain the objected to Sub-processor, Nevis Systems will notify the customer at least fourteen (14) days before authorising the Sub-processor to process personal data and then the Customer may immediately discontinue using the relevant portion of the Services and may terminate the relevant portion of the Services. Nevis Systems will refund the Customer any prepaid fees covering the remainder of the term of such relevant portion of the Service following the effective date of termination and there will be no penalty on either party.
9.4 for the avoidance of doubt, where any Sub-processor fails to fulfil its obligations under any sub-processing agreement or under applicable law Nevis Systems will remain fully liable to the Customer for the fulfilment of its obligations under this DPA.
10.1 The Customer agrees that except as otherwise set out in this provision, Nevis Systems’s ISO 27001/22301 certifications, or comparable industry standards, and then current International Standards on Auditing (ISAs) audit reports or comparable industry standard successor reports will be used to satisfy any audit or inspection requests by or on behalf of the Customer and Nevis Systems shall make such reports available to the Customer on request. In the event that the Customer, a regulator or data protection authority requires additional information or an audit related to the Services, then, Nevis Systems agrees to submit its data processing facilities, data files and documentation needed for processing personal data to audit by the Customer (or any third party such as inspection agents or auditors, selected by Customer) to ascertain compliance with this DPA, subject to being given reasonable notice and compliance with Nevis Systems’s Security Directives and the auditor entering into a non-disclosure agreement directly with Nevis Systems. Nevis Systems agrees to provide reasonable cooperation to Customer in the course of such operations including providing all relevant information and access to all equipment, software, data, files, information systems, etc. used for the performance of Services, including processing of personal data. Such audits shall be carried out at the Customer’s cost and expense.
11.1 In the event of Nevis Systems aware of any breach of security that results in the accidental, unauthorised or unlawful destruction or unauthorised disclosure of or access to personal data Nevis Systems shall, among other things:
a.) Notify the Customer in writing immediately but not later than 36 hours after becoming aware of the breach of security
b.) Assist the Customer with regard to the Customers obligation to provide information to the data subject and to provide the Customer with relevant information in this regard
c.) Support the Customer in consultations with data protection authority.
11.2 To the extent legally possible, Nevis Systems may claim compensation for support services under this clause 11 which are not attributable to failures on the part of Nevis Systems.
11.3 Customer shall retain all rights, copyright or other intellectual property rights, title and interest to any and all personal data, including all rights relating to
11.4 Nevis Systems understands and agrees that such personal data constitutes Customer proprietary and Confidential Information.
12.1 Upon expiration of the Agreement or in the event of early termination for any reason whatsoever, Nevis Systems and its subcontractors shall promptly provide to Customer all personal data held by them for the duration of the Agreement for the performance of the Services. Upon Customer’s request, Nevis Systems will destroy copies of personal data held in its systems and confirm this to Customer in writing unless required to keep certain personal data in order to comply with applicable laws.
14.1 The Customer shall comply at all times with applicable Privacy Laws in relation to the processing of personal data in connection with the Agreement and the Services.
15.1 Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA whether in contract, tort or under any other theory of liability, is subject to the Limitation of Liability section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and this DPA.
Description of the technical and organisational measures implemented by Nevis Systems:
Nevis Systems shall implement the measures described in this appendix, provided that the measures directly or indirectly contribute or can contribute to the protection of personal data under the agreement concluded between the Parties for the processing of data. If Nevis Systems believes that a measure is not necessary for the respective Service or part thereof, Nevis Systems will justify this and come to an agreement with the Customer.
The technical and organisational measures are subject to technical progress and development. In this respect Nevis Systems is permitted to implement alternative adequate measures. The level of security must align with industry security best practice and not less than, the measures set forth herein. All major changes are to be agreed with the Customer and documented.
16.2.1 Nevis Systems shall have a defined and documented information security management system (ISMS) including an information security policy and procedures in place, which shall be approved by Nevis Systems’s management. They shall be published within Nevis Systems´s organization and communicated to relevant Nevis Systems Personnel.
16.2.2 Nevis Systems shall periodically review Nevis Systems’ security policies and procedures and update them if required to ensure their compliance with the Security Directives.
Easy Use APIs
HTTP, SMPP & SMTP
20+ Years Experience
Free Cloud SMS Software
Auto SMS Processing