This Data Processing Agreement ("DPA") forms part of the Terms of Service and Privacy Policy between Elysium Labs, LLC ("Controller", "we", "us", "our") and the third-party service providers ("Processor") that process personal data on our behalf in connection with the Too Social mobile application ("App").
This DPA is designed to ensure compliance with applicable data protection laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act ("CCPA"), collectively referred to as "Data Protection Laws".
The terms "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", and "Supervisory Authority" shall have the meanings given to them in the applicable Data Protection Laws.
For the purpose of this DPA:
The Processor shall Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before Processing, unless the law prohibits such information.
The purpose of the Processing is to provide the services as described in our Terms of Service and Privacy Policy, specifically related to our Too Social mobile application which functions as a friend-finding service. The Processing activities may include, but are not limited to:
The categories of Personal Data that may be Processed under this DPA include:
The categories of Data Subjects whose Personal Data may be Processed under this DPA include:
The Processor shall Process Personal Data for the duration of the agreement between the Controller and the Processor, or until the Controller instructs the Processor to return or delete the Personal Data in accordance with Section 9 of this DPA.
The Processor shall ensure that persons authorized to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
The Controller confirms that the Services are designed for and directed only to individuals who are at least 16 years of age. The Processor acknowledges this age restriction and agrees not to knowingly process data from any individual under 16 years of age. If the Processor becomes aware that it has collected Personal Data from anyone under 16 years of age, it shall promptly notify the Controller and take steps to delete such information.
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, as appropriate:
The Processor shall Process Personal Data only on documented instructions from the Controller, unless required to do so by law. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.
The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights under the applicable Data Protection Laws.
The Controller hereby provides general authorization for the Processor to engage Sub-processors, provided that the Processor:
As of the date of this DPA, the Controller authorizes the use of Sub-processors in the following categories:
The Controller acknowledges that these categories of Sub-processors are necessary for the provision of the Services. The Controller may request additional information about specific Sub-processors within these categories by contacting the email address listed in Section 12.6.
The Processor shall promptly notify the Controller if it receives any request from a Data Subject under any Data Protection Law in respect of the Data Subject's Personal Data, and shall provide full cooperation and assistance to the Controller in relation to any such request.
The Processor shall not respond to any Data Subject request without the Controller's prior written approval, except to confirm that the request relates to the Controller, to which the Data Subject should address the request.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including but not limited to:
The Processor shall maintain documentation of its security measures and shall make such documentation available to the Controller upon request.
The Processor shall support the Controller's age verification mechanisms to ensure that the Services are not used by individuals under 16 years of age. This may include:
The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Such notification shall:
The Processor shall assist the Controller in fulfilling the Controller's obligations to notify the relevant Supervisory Authority and affected Data Subjects of a Personal Data Breach, as required under applicable Data Protection Laws.
The Processor shall provide reasonable assistance to the Controller with any data protection impact assessments and prior consultations with Supervisory Authorities that the Controller is required to carry out under applicable Data Protection Laws, in each case solely in relation to Processing of Personal Data by the Processor on behalf of the Controller and taking into account the nature of the Processing and information available to the Processor.
Upon termination of the services or upon the Controller's request, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires storage of the Personal Data.
The Processor shall adhere to the following data retention periods unless otherwise instructed by the Controller:
Upon request, the Processor shall provide written certification to the Controller that it has fully complied with this Section.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
Audits shall be conducted during regular business hours, with reasonable advance notice to the Processor, and subject to reasonable confidentiality procedures. The Controller shall bear any costs incurred in connection with an audit unless the audit reveals material non-compliance with this DPA, in which case the Processor shall bear the costs.
The Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA), UK, or the jurisdiction where the Controller is established unless the recipient is established in a country that the European Commission or relevant authority has decided provides an adequate level of protection for Personal Data, or one of the following safeguards is implemented:
Where the parties rely on Standard Contractual Clauses for transfers of Personal Data, the parties hereby incorporate the Standard Contractual Clauses by reference into this DPA.
This DPA shall be governed by the laws of the State of Texas, United States, without regard to its conflict of law principles.
In the event of a conflict between this DPA and the Terms of Service or Privacy Policy, this DPA shall prevail with regard to the parties' data protection obligations.
Any modifications to this DPA must be in writing and signed by authorized representatives of both parties.
Should any provision of this DPA be found invalid or unenforceable, the remainder of the DPA will remain valid and enforceable. The parties shall replace the invalid or unenforceable provision with a valid and enforceable provision that comes closest to the intention of the parties.
The parties acknowledge that this DPA is intended to comply with the requirements of the Apple App Store and Google Play Store, and both parties agree to promptly update this DPA as necessary to maintain compliance with evolving app store policies and guidelines regarding data privacy and protection.
For any questions or concerns regarding this DPA, please contact us at:
privacy@elysiumlabs.com