This Data Processing Addendum (“DPA”) between Badger Maps, Inc. (“Badger“) and Customer forms part of the Agreement and is effective as of the Effective Date.
Executing a DPA does not change any of our practices concerning the protection of your privacy and your data. Everyone using our service continues to receive the same protections of their data and privacy.
a. All capitalized terms not defined in this DPA will have the meanings set forth in the Agreement.
b. The following terms have the meanings assigned to them in the GDPR: “Controller” and “Processor.”
c. “Affiliate” means an entity that directly or indirectly controls, is controlled by or is under common control with an entity.
d. “Agreement” means Badger’s Terms of Service, which govern the provision of the Services to Customer.
e. “Customer Data” means any Personal Information that Badger processes on behalf of Customer as a Processor in the course of providing Services.
f. “Data Protection Law” means all data protection and privacy laws applicable to the Processing of Personal Information under the Agreement, including, where applicable, EU Data Protection Law.
g. “EU Data Protection Law” means (i) prior to 25 May 2018, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive”) and on and after 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and applicable national implementations of it (as may be amended, superseded or replaced).
h. “EEA” means the European Economic Area.
i. “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including Customer employees.
j. “Process” and its cognates means any operation or set of operations that is performed on Personal Information, including storage, disclosure, erasure, and destruction.
k. “Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data.
l. “Services” means any product or service provided by Badger to Customer pursuant to the Agreement.
m. “Standard Contractual Clauses” (“SCCs”) means the European Union standard contractual clauses for the transfer of personal data from the European Economic Area to third countries. Unless otherwise specified, a reference to “SCCs” means the controller-to-Processor version (Commission Decision 2010/87/EU) or the controller-to-controller version (Commission Decision 2004/915/EC), as context requires.
n. “Subprocessor” means any entity that Processes Personal Information on behalf of Badger to assist Badger in its performance of the Agreement.
a. The parties agree that the DPA shall replace any existing data processing addendum the parties may have previously entered into in connection with the Services.
b. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.
c. Any claims brought under or in connection with this DPA shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement.
d. Customer further agrees that any regulatory penalties incurred by Badger in relation to the Customer Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce Badger’s liability under the Agreement as if it were liability to the Customer under the Agreement.
e. No one other than a party to this DPA, its successors and permitted assignees shall have any right to enforce any of its terms (except to the extent that individuals are able to enforce their rights through SCCs).
f. This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by SCCs or applicable Data Protection Laws.
a. Role of the Parties.
As between Badger and Customer, Customer is a Business and Controller of Customer Data, and Badger shall Process Customer Data only as a Service Provider and Processor acting on behalf of Customer.
b. Customer’s Processing of Personal Information.
Customer agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its Processing of Personal Information and any Processing instructions it issues to Badger; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for Badger to Process Personal Information and provide the Services pursuant to the Agreement and this DPA.
c. Badger’s Processing of Customer Data.
Badger shall Process Customer Data only for the purposes described in this DPA and only in accordance with Customer’s documented, lawful instructions. The parties agree that this DPA and the Agreement set out the Customer’s complete and final instructions to Badger in relation to the Processing of Customer Data under the Agreement and Processing outside the scope of these instructions (if any) shall require prior written agreement between Customer and Badger. Badger is prohibited from: (i) Selling Customer Data; (ii) retaining, using, or disclosing Customer Data for any purpose other than for the specific purpose of performing the Services specified in the Agreement, including retaining, using, or disclosing the Customer Data for a commercial purpose other than providing the Services specified in the Agreement; or (iii) retaining, using, or disclosing the Customer Data outside of the direct business relationship between Customer and Badger. Badger will promptly inform Customer if following Customer’s instructions would result in a violation of Data Protection Law or where Badger must disclose Customer Data in response to a legal obligation, unless the legal obligation prohibits Badger from making such disclosure. Notwithstanding anything to the contrary in this Section 3.3, Badger may Process Customer Data as necessary to detect data security incidents or protect against fraudulent or illegal activity and to build or improve the quality of its products and services, provided that in the course of these activities Badger will not (i) permit any third party (other than Badger’s service providers or except as instructed by Customer) to access Customer Data or (ii) use the Customer Data to modify or add to Personal Information it collected from a source that is not Customer. By signing this Addendum, Badger certifies that it understands and will comply with the obligations herein.
d. Details of Data Processing
i. Subject Matter and Purpose: Badger processes Customer Data to provide the Services to Customer and to perform Badger’s obligations under the Agreement (including this DPA) or as otherwise agreed by the parties. Those Data Processing activities include data processing necessary for the provision of services.
ii. Duration: As between Badger and Customer, the duration of the Data Processing under this DPA is until the termination of the Agreement in accordance with its terms.
iii. Categories of Individuals: Individuals whose Personal Information Badger processes are Customer’s customers or prospective customers and any individuals whose Personal Information is shared with Badger by Customer.
iv. Types of Personal Information: Badger will process any Personal Information that Customer chooses to disclose to Badger, as Badger offers Customer the ability to upload any content into Badger’s systems. Typically, the categories of personal data processed are: personally identifiable information (e.g. name, surname, email, phone number, Customer name), Customer’s client data, statistical or other usage data observed on the internet (e.g. analytics services, etc.), Customer history, application integration data, and billing, invoicing and payment data. Badger discourages Customer from uploading sensitive Personal Information into Badger’s systems.
v. Categories of Data Subjects: Badger will process the Personal Information relating to the following subjects: Customers, potential Customers, internet users, and employees, associates and staff members.
e. Badger as Controller.
Customer acknowledges that Badger may collect information about any individual employed by Customer who is assigned to interact with Badger and any individual accessing and/or using the Services through the Customer ’s account (“Users”). To the extent any such data is considered Personal Information under Data Protection Laws, Badger is the Controller of such Data and accordingly shall Process such Data in accordance with the Badger Privacy Policy and Data Protection Laws. Badger shall have a right to use and disclose this data internally and to third parties for its legitimate business purposes relating to the operation, support, and use of the Services, such as billing, account management, technical support, product development, sales and marketing.
a. Facilitation of Responses.
The Services provide Customer with a number of controls that Customer may use to retrieve, correct, delete, or restrict Customer Data, which Customer may use to assist it in connection with its obligations under Data Protection Law, including its obligations relating to responding to requests from individuals or applicable data protection authorities. To the extent that Customer is unable to independently access the relevant Customer Data within the Services, Badger shall (at Customer’s expense) provide reasonable cooperation to assist Customer to respond to any requests from individuals or applicable data protection authorities relating to the Processing of Customer Data under the Agreement.
b. Requests Received by Badger.
Should Badger receive any requests from individuals to exercise their rights to Customer data, Badger shall notify the individual of the need to submit the request directly to Customer, and shall promptly notify Customer of the request, unless Badger is legally prohibited from providing such notification.
a. Requests Received by Badger.
If a governmental authority (e.g. the Federal Trade Commission, the Attorney General of a U.S. state, or a European data protection authority) sends Badger a demand for Customer Data (for example, through a subpoena or court order), Badger shall attempt to redirect the law enforcement agency to request that data directly from Customer. As part of this effort, Badger may provide Customer’s basic contact information to the governmental authority. If compelled to disclose Customer Data to a governmental authority, then Badger shall give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Badger is legally prohibited from doing so.
b. Cooperation.
Where required in connection with requests from a government authority, Badger will immediately inform Customer and will reasonably cooperate to provide Customer with records related to its Processing activities in connection with the Agreement, including information on the categories of Customer Data Processed and the purposes of the Processing, the use of Subprocessors with respect to such Processing, any data disclosures or transfers to third parties, and a general description of technical and organizational measures used to protect the security of such data.
a. Authorized Subprocessors.
Customer agrees that Badger may engage Subprocessors to Process Customer Data on Customer’s behalf. The Subprocessors currently engaged by Badger and authorized by Customer are listed within Badger’s Privacy Policy. The sub-processors shall, as legally required, comply with art. 28 par. 4 GDPR.
b. Subprocessor Obligations.
Badger shall: (i) enter into a written agreement with the Subprocessor imposing data protection terms that require the Subprocessor to protect the Customer Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Badger to breach any of its obligations under this DPA.
c. Changes to Subprocessors.
Badger shall (i) provide an up-to-date list of the Subprocessors it has appointed upon written request from Customer; and (ii) notify Customer (for which email shall suffice), if it adds or changes Subprocessors without undue delay. Customer may object in writing to Badger‘s appointment of a new or changed Subprocessor within five (5) calendar days of such notice, provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss such concerns in good faith with a view to achieving resolution. If this is not possible, Customer may suspend or terminate the Agreement (without prejudice to any fees incurred by Customer prior to suspension or termination).
a. Security Measures.
Badger shall implement and maintain appropriate technical and organizational security measures to protect Customer Data from Security Incidents and to preserve the security and confidentiality of the Customer Data, in accordance with Badger’s security standards described in this DPA and within Badger’s Privacy Policy.
b. Updates to Security Measures.
Customer is responsible for reviewing the information made available by Badger relating to Data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Laws. Customer acknowledges that the Security Measures are subject to technical progress and development and that Badger may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Customer.
c. Confidentiality of Processing.
Badger shall ensure that any person who is authorized by Badger to Process Customer Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
d. Security Incident Response.
Upon becoming aware of a Security Incident, Badger shall notify Customer without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Customer.
e. Customer Responsibilities.
Notwithstanding the above, Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Customer Data when in transit to and from the Services and taking any appropriate steps to securely encrypt or backup any Customer Data uploaded to the Services.
a. Upon reasonable written request, Badger will verify its compliance with this DPA, provided that Customer shall not exercise this right more than once per year.
b. Badger must be given at least 30 days’ notice by the Customer, and may charge a reasonable fee for enabling inspections.
a. Data center locations.
Badger may transfer and Process Customer Data anywhere in the world where Badger, its Affiliates or its Subprocessors maintain Data Processing operations. Badger shall at all times provide an adequate level of protection for the Customer Data collected, transferred, Processed, or retained in accordance with the requirements of Data Protection Laws. To the extent that Badger or the Customer are relying on a specific statutory mechanism to normalize international data transfers and that mechanism is subsequently revoked, or held in a court of competent jurisdiction to be invalid, Badger and the Customer agree to cooperate in good faith to pursue a suitable alternate mechanism that can lawfully support the transfer.
b. Transfer Mechanism.
The parties will comply with Data Protection Law insofar as it requires the parties to use a data transfer mechanism to transfer or access Personal Information internationally.
a. Upon termination or expiration of the Agreement, Badger shall (at Customer’s election) delete (after providing Customer the ability to download, pursuant to the Agreement) all Customer Data (including copies) in its possession or control, save that this requirement shall not apply to the extent Badger is required by applicable law to retain some or all of the Customer Data, which Badger shall securely isolate and store this Data in accordance with applicable retention periods. Badger will protect this Data from any further Processing, except to the extent required by applicable law.
a. Badger shall provide reasonably requested information regarding the Services to enable the Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.
b. Badger may charge the Customer a reasonable fee for support services which are not included in the description of the services and which are not attributable to Badger’s misconduct, mistakes or infringements.
a. Each party to this DPA commits to indemnify the other party for damages or expenses resulting from its own culpable infringement of this DPA, including any culpable infringement committed by its legal representative, subcontractors, employees or any other agents. Furthermore, each party commits to indemnify the other party against any claim exerted by third parties due to, or in connection with, any culpable infringement by the respective other party. Art. 82 GDPR stays unaffected.
a. Changes to DPA.
Badger may be required to update this DPA in order to comply with applicable law, and in such case Badger will provide reasonable notice of any such updates.
Learn how you can maximize your sales routes & sell more with Badger Maps
Looking for our logo?
Grab a Zip packed with our logo in PNG and EPS formats.
Get Started now with a free trial of Badger Maps, no credit card required!
free trial