Coresignal Data Processing Agreement
Last updated: December 17, 2024
(1) The individual or entity entering into this Data Processing Agreement (hereinafter referred to as “DPA”) as the Data Controller (“Data Controller”); and
(2) Deeptrace Inc. as the Data Processor (“Data Processor”)
The Data Controller and Data Processor may be collectively referred to as the “Parties” and individually as a “Party,”
Whereas:
The Parties have entered into a Master Services Agreement (the “Agreement”), under which the Data Processor will provide services to the Data Controller, as further described in the Agreement;
To perform the services under the Agreement, the Data Processor will process personal data on behalf of and for the benefit of the Data Controller;
In compliance with applicable data protection laws, processing activities carried out by a data processor must be governed by binding contractual terms or similar instruments. Notably, Article 28(3) of the European Union General Data Protection Regulation (GDPR) mandates that such processing must be specified in a written agreement detailing the subject matter, duration, nature, and purpose of processing, as well as the types of personal data, categories of data subjects, and the responsibilities and rights of the data controller. Similarly, under the California Consumer Privacy Act (CCPA), as modified by the California Privacy Rights Act (CPRA) (Cal. Civ. Code § 1798.100(d)), contracts with service providers must limit processing activities to defined purposes, mandate reasonable security measures, and restrict any secondary use of personal data. Comparable requirements are imposed by other U.S. state privacy laws, such as the Virginia Consumer Data Protection Act (VCDPA) and the Colorado Privacy Act, which emphasize accountability, data security, and limitations on data use.
With a commitment to upholding the highest standards in privacy law compliance, Parties have concluded this DPA and agreed on the provisions outlined in this DPA. This DPA forms part of the Agreement, and it shall govern any Services provided to the Data Controller by the Data Processor.
SPECIAL TERMS
| Agreement | Agreement, under which the Data Processor will provide Services and any other related services to the Data Controller. |
|---|---|
| Parties’ relationship: | Controller to Processor |
| Parties’ roles: | The Controller is the individual or entity (hereinafter – Client) entering into this DPA. Deeptrace Inc. is the Processor. |
| Purpose(s) and nature of the processing: | To provide the Services to the Client as outlined in the Agreement and as instructed by the Client. |
| Frequency of the transfer: | The Client’s Personal Data is transferred continuously for the duration of the Agreement and provision of Services. |
| Types of the Personal Data: | Data pertaining to individuals that the Client processes when using Services. For instance, limited business-related professional data such as name, surname, public profile information, public profile URL, job title, industry, work experience, title of online profile, and other information shared with the Data Processor upon the Client‘s decision. |
| Types of the special categories of Personal Data: | N/A |
| Categories of data subjects: | Individuals whose Personal Data is processed by the Data Processor when using Services:
|
| Duration of the processing: | Duration of the Agreement. |
| Term of this DPA: | This DPA will commence on the final date of the signature on the Agreement and will continue as long as the Agreement remains in force unless the Parties terminate this DPA earlier. |
| Governing law and dispute resolution: | As per the Agreement, unless required otherwise by the Data Protection Laws. |
GENERAL TERMS
1. DEFINITIONS
1.1. Unless the context indicates otherwise, capitalized terms in this DPA, including its preamble, shall have the meanings defined herein:
| Party or Parties | means Deeptrace Inc. and/ or the Client, or both |
|---|---|
| Services | means the Data API (Real-Time) Services, under the Agreement accessible at coresignal.com/coresignal-services-msa |
| Personal data | refers to any information relating to an identified or identifiable natural person. An identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person |
| Sub-data processor | refers to a third-party subcontractor engaged by the Data Processor that, in the course of providing services, processes Personal Data on behalf of the Data Controller. |
| U.S. data protection laws | means all laws and regulations of the United States of America, including the California Consumer Privacy Act of 2018, Cal. Civ. Code §1798.100 et. seq., and its implementing regulations (hereinafter, the “CCPA”), applicable to the processing of the Personal Data (or an analogous variation of such term). |
| European Data Protection Laws | refers to data protection laws applicable in Europe, including: (i) the GDPR; (ii) Directive 2002/58/EC (ePrivacy Directive) and related national implementations; (iii) the UK GDPR; and (iv) the Swiss Federal Data Protection Act and its Ordinance, each as amended, superseded, or replaced. |
| Applicable Data Protection Laws | means all applicable worldwide legislation relating to data protection and privacy which applies to the respective Party in the role of processing Personal Data in question under this DPA, including, without limitation, (i) the European Data Protection Laws; (ii) the U.S. Data Protection Laws; and (iii) other applicable data protection and privacy laws; in each case, as amended, repealed, consolidated or replaced from time to time. |
| SCCs | refers to the standard contractual clauses for transferring Personal Data to third countries under Regulation (EU) 2016/679 (Commission Decision 2021/914 of 4 June 2021), as updated or replaced. The current version is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. |
| UK SCCs | refers to the International Data Transfer Addendum to the SCCs approved by the UK, as updated. The current version is available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/. |
1.2. The following non-capitalized terms used but not defined in this DP - such as “controller,” “processor,” “sub-processor,” “processing,” “special categories of personal data,” “personal data breach,” and “supervisory authority - shall have the meanings assigned to them under the GDPR, regardless of whether the GDPR is applicable.
2. GENERAL OBLIGATIONS
2.1. The Data Controller shall comply with all Applicable Data Protection Laws as a data controller, ensuring that its processing of Personal Data and any instructions provided to the Data Processor are in accordance with these laws.
2.2. The Data Processor warrants and agrees to process the Client’s Personal Data solely for the limited and specific purposes outlined in the Agreement and/or as otherwise lawfully instructed in writing (including email) and mutually agreed upon by the Parties, unless otherwise mandated by Data Protection Laws.
2.3. When processing Personal Data under this DPA, the Data Processor shall make its best efforts to comply with Applicable Data Protection Laws. The Data Processor shall implement appropriate technical and organizational measures to ensure that its processing activities meet the requirements of Applicable Data Protection Laws and safeguard the rights of Data Subjects
2.4. The Client represents that it has obtained all necessary privacy notices, consents, and rights under Applicable Data Protection Laws to authorize the Data Processor to process Personal Data and provide services as outlined in the Agreement and this DPA.
2.5. The Data Processor shall refrain from taking any action that could result in the Client breaching Data Protection Laws.
3. DATA CONTROLLER’S DATA PROCESSING INSTRUCTIONS
3.1. The Data Processor shall handle Personal Data solely following the documented instructions from the Client (Data Controller), including those concerning transfers of Personal Data to third countries or international organizations. The Data Processor shall not process Personal Data in any other way unless mandated by Applicable Data Protection Laws. If such laws require processing, including transfers to third countries or international bodies, the Data Processor shall inform the Data Controller of the legal requirement before proceeding, unless this disclosure is restricted by law due to substantial public interest.
3.2. The Data Processor shall not evaluate the legality of any instructions provided by the Client, who assumes full responsibility and liability for ensuring that these instructions comply with applicable Data Protection Laws. If the Data Processor reasonably believes that an instruction clearly contravenes Data Protection Laws, it will promptly notify the Client. The Data Processor is not accountable for compliance with any Data Protection Laws specific to the Client or its industry that do not generally apply to the Data Processor. The Data Processor shall immediately inform the Data Controller if it lacks instructions for a particular data processing situation.
3.3. The Client’s instructions to the Data Processor specify the subject matter, duration, nature, and purpose of processing, as well as the types of Data and categories of Data subjects, as detailed in the Special Terms section of this DPA.
4. SUB-PROCESSORS
4.1. The Client authorizes the Data Processor to engage Sub-processors on its behalf as necessary to fulfill the obligations under this DPA. The Data Processor shall maintain an updated list of engaged Sub-processors, and upon written request, the Client may receive a copy of this list for review.
4.2. The Client grants general authorization for the Data Processor’s use of Sub-processors. To the fullest extent allowed under Data Protection Laws, this DPA will serve as the Client’s general written authorization for the Data Processor to subcontract the processing of the Client’s Personal Data.
4.3. The Data Processor shall: (i) ensure that each Sub-processor is bound by a written agreement to provide at least the same level of data protection required by this DPA and to comply with applicable Data Protection Laws; (ii) be fully responsible and liable to the Client for any acts or omissions of a Sub-processor as if they were the Data Processor’s own; and (iii) upon request, provide the Client with details of any engaged Sub-processors.
5. DATA SECURITY PRINCIPLES
5.1. The Data Processor shall implement appropriate technical and organizational measures to safeguard Personal Data against destruction, modification, unauthorized disclosure, unlawful access, and any other forms of unlawful processing. These measures must ensure an adequate level of security, considering the state of the art, implementation costs, and the nature, scope, context, and purposes of the processing, as well as specific risks to data subjects' rights and freedoms.
5.2. The Data Processor’s security measures shall include:
5.2.1. Access Control: Access to Personal Data is limited solely to employees who require access to perform their functions under this DPA. These employees are bound by confidentiality obligations equivalent to those imposed on the Data Processor.
5.2.2. Security Policies: The Data Processor must establish security policies addressing information security, risk management, access control, incident management, and third-party management.
5.2.3. Confidentiality, Integrity, and Resilience: The Data Processor must maintain the ongoing confidentiality, integrity, availability, and resilience of systems and services processing Personal Data.
5.2.4. Data Restoration: In case of an incident, the Data Processor must be capable of restoring access to Personal Data in a timely manner.
5.2.4. Regular Risk Assessments: The Data Processor must conduct risk assessments to evaluate the effectiveness of its security measures, ensuring the security, performance, and compliance of Personal Data processing.
5.2.5. The Data Processor shall not disclose or make Personal Data available to any third party, except for authorized Sub-processors engaged under this DPA, without the Client’s prior written consent.
5.3. The Data Processor will promptly notify the Client of any accidental or unauthorized access to Personal Data or other security incidents (Personal Data breaches) and will assist in addressing such situations.
6. BREACHES OF DATA SECURITY
6.1 Upon becoming aware of any personal data breach, including unauthorized or unlawful processing or access to the Client’s Personal Data, or any other security incident (a “Data Breach”), the Data Processor must take all necessary actions and promptly inform the Client without undue delay.
6.2. The notification must include: (1) a description of the Data Breach, including affected data subject categories and record estimates; (2) contact details of the Data Protection Officer or designated contact; (3) likely consequences for data subjects; and (4) actions taken or proposed by the Data Processor to address and mitigate the breach.
6.3 The Data Processor shall use reasonable efforts to assist the Client in fulfilling obligations under applicable Data Protection Laws to notify the appropriate supervisory authority and/or affected data subjects in relation to the Data Breach.
6.4 The Data Processor will not independently notify or disclose any information about the Data Breach to third parties, including data subjects or supervisory authorities, without the Client’s prior written consent. Should notification be legally required, the Data Processor will, unless restricted by law, provide reasonable advance notice to the Client regarding the obligation and intended disclosure.
7. DATA SUBJECTS RIGHTS
7.1. The Data Processor shall, considering the nature of the processing, support the Data Controller in fulfilling its obligation to respond to Data Subject requests under the Applicable Data Protection Laws by implementing appropriate technical and organizational measures, to the extent feasible.
7.2. If the Data Processor receives a Data Subject request to exercise rights provided under the Applicable Data Protection Laws concerning the Personal Data processed under this DPA, the Data Processor shall forward the request to the Data Controller within five (5) business days.
8. COOPERATION
8.1. The Data Processor shall provide reasonable assistance to the Data Controller in complying with the obligations relating to Data Protection Impact Assessments and prior consultations with a Supervisory Authority, insofar as such assistance relates to the Personal Data processed on behalf of the Data Controller. This assistance, which the Data Controller reasonably considers to be required by Applicable Data Protection Laws, shall take into account the nature of the Personal Data processing and the information available to the Data Processor. Such assistance shall include but is not limited to, providing the Data Controller with the necessary information to fulfill the Data Controller's obligations regarding Data Protection Impact Assessments and prior consultations under Applicable Data Protection Laws.
8.2. For any requests made by competent Supervisory Authorities or any other third parties to the Data Processor regarding the processing of Personal Data covered by this DPA, the Data Processor shall promptly refer such requests to the Data Controller.
8.3. The Data Controller shall have the right to take the measures necessary to verify whether the Data Processor can fulfill its obligations under this DPA and whether the Data Processor has taken steps to ensure such compliance.
8.4. When Data Controller requests the return and/or deletion of Personal Data under this DPA, the Data Processor shall return and/or delete all Personal Data processed under this DPA within seven (7) calendar days of receiving the Data Controller's request and shall ensure that any other Data Processor does the same, except where Applicable Data Protection Laws require the retention of the Personal Data.
9. FINAL PROVISIONS
9.1. Unless otherwise defined in this DPA, all terms used herein shall have the same meaning as described to them in the Agreement.
9.2. This DPA shall be an integral component of the Agreement. Any matters not expressly governed by this DPA shall be subject to the provisions of the Agreement.
9.3. The Data Processor reserves the right to amend this DPA to ensure compliance with changes in Applicable Data Protection Laws and regulations or to accommodate necessary operational changes. The Data Processor will provide written notice to the Data Controller at least thirty (30) days before the intended effective date of any such amendment that could materially impact the Data Controller. The Parties will work together in good faith to address any concerns raised by the Data Controller. If the Parties cannot resolve any such concerns within fifteen (15) days, the Data Controller may terminate this DPA.