Policies

Processing personal data in a secure, fair, and transparent way is extremely important to us at TaxDome. As part of the Services, we may process personal data subject to the EU’s General Data Protection Regulation («GDPR»), the United Kingdom (UK) Data Protection Act of 2018, the California Consumer Privacy Act of 2018, as amended («CCPA»), U.S. state Data Protection Laws, and the laws set forth in Annex A hereto (each, to the extent applicable to the Services TaxDome provides you under the Agreement, an “Applicable Data Protection Law”). 

This Data Processing Addendum (“DPA”) applies only if TaxDome, as service provider or Processor, processes personal data from or on behalf of Customer as a business or Controller, under the Agreement, and the personal data Processed is subject to an Applicable Data Protection Law(s). If this DPA applies, it forms part of, and amends the Terms of Service («Terms») and requires no further action on your part. 

If you do not agree to this DPA, you may discontinue the use of the TaxDome service and cancel your account.

Definitions

Capitalized terms used herein but not defined will have the meanings given them in the Terms. Additional definitions as used herein:

The terms, «Data Subject», «Member State», «Controller», «Processor», and «Processing» shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

«Incident» means: (a) a complaint or a request with respect to the exercise of an individual’s rights under the GDPR; (b) an investigation into or seizure of the personal data by government officials, or a specific indication that such an investigation or seizure is imminent. 

«Party» refers to TaxDome and/or the Customer depending on the context.

«personal data» shall mean information relating to an identified or identifiable individual, protected by Applicable Data Protection Law and Processed by TaxDome as Processor on behalf of Customer as Controller pursuant to the Agreement.

«Personnel» refers to those individuals who are employed by or are under contract to perform a service on behalf of one of the parties. Personnel may have rights in their personal data (including business contact information) if they reside in the EU. It is important to be clear about how personnel’s rights are protected.

«SCCs» refers to the standard contractual clauses for processors as approved by the European Commission or Swiss Federal Data Protection Authority (as applicable).

«Security Incident» means any breach of the security and/or confidentiality as set out in this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the personal data.

«Sub-processor» is a Third-party, independent contractors, vendors and suppliers who provide specific services and products related to the Website and our Services, such as hosting, credit card processing and fraud screening, and mailing list hosting («third-party» or «outside contractor» shall have similar meanings).

1. Undertakings regarding personal data

1.1     Each party agrees that personal data shall be treated as Confidential Information under this DPA. In addition, each party shall at all times comply with Applicable Data Protection Laws relating to data protection in the relevant jurisdiction with respect to each other’s personal data.

1.2     Personal data shall remain the property of the disclosing party. TaxDome acknowledges that the Customer is the Controller and maintains control over its clients’ personal data. 

1.3     TaxDome will process personal data only to the extent necessary to provide the Services in accordance with the Agreement and any further written instructions from the Customer that are mutually agreed upon in writing. The details of the processing of personal data as required by Article 28(3) GDPR are set out in Annex B. TaxDome agrees that:

1. TaxDome is receiving personal data from Customer (or from the Customer) for the limited and specified purpose of providing Services as set forth in the Agreement or the applicable Order Form thereunder, and that TaxDome is prohibited from using the personal data it receives from Customer for any other purpose;
2. Without limiting TaxDome’s obligation to comply with all applicable laws as hereinabove set forth, TaxDome agrees to comply with all applicable sections of the Applicable Data Protection Law with respect to the personal data it processes pursuant to this DPA;

1. TaxDome will notify Customer promptly and, in any event, not more than 48 hours from the date of such determination, if it determines that it can no longer meet its obligations under this DPA;
2. TaxDome will implement and maintain a reasonable and appropriate security program comprising adequate security, technical and organizational measures to protect against unauthorized, unlawful or accidental processing, use, erasure, loss or destruction of, or damage to, personal data;

1. If TaxDome hires a subprocessor in in the context of its provision of services to Customer pursuant to the Agreement, to the extent TaxDome Processes personal data provided by Customer to TaxDome, TaxDome shall have a written contract in place with the subprocessor that complies with the standards for subprocessing agreements set forth in Applicable Data Protection Law;
2. TaxDome shall not Sell (as defined in the CCPA) or Share (as defined in the CCPA) personal data it receives from or processes on behalf of Customer;
3. TaxDome shall not retain, use, or disclose personal data it receives from or processes on behalf of Customer for any commercial purpose other than for the specific Customer purpose specified in the Agreement or in the applicable Order Form, provided that (x) TaxDome may use personal data for internal use and improvement of its products and services as permitted by Applicable Data Protection Law, and (y) TaxDome may generate anonymized data from any Customer Data, including personal data, and use the resulting data for any lawful purpose so long as such data may not be used to reidentify any individual or Customer;

1. TaxDome shall not retain, use, or disclose personal data it receives from or processes on behalf of Customer outside of the direct Customer relationship with TaxDome;

1. TaxDome shall not combine an individual consumer’s personal data it receives from or processes on behalf of Customer with personal data it receives from or on behalf of another person or which it collects from its own interaction with a consumer; and

1. TaxDome shall notify Customer as soon as reasonably possible, but in no later than five calendar days, if it receives a consumer data rights request in relation to personal data it processes pursuant to Applicable Data Protection Law and shall adhere to Customer’s instructions in relation to responding to such consumer requests.

1.4    Upon termination of your account, TaxDome will delete all personal data in accordance with our standard backup and retention policy per the Terms, normally, no later than 90 days, unless we are required to retain personal data due to applicable laws, including without limitation Applicable Data Protection Law; in which case TaxDome reserves the right to retain personal data.

1.5    The parties acknowledge that Customers may from time to time be in possession of personal data relating to TaxDome’s personnel in connection with the use of the TaxDome Service. TaxDome warrants that it has provided to such personnel all necessary notifications and obtained all necessary consents, authorizations, approvals and/or agreements as required under any applicable law in order to enable: (i) the disclosure of TaxDome’s personnel personal data to Customer in connection with the Customer’s use of the TaxDome Service; and (ii) further processing of such TaxDome personal data by Customer for the purpose of using the TaxDome Service.

2. Undertakings regarding sub-processors

2.1    Customer agrees that TaxDome may engage third-party sub-processors in connection with Processing personal data under the obligations of the Terms. 

2.2    TaxDome shall make available to Customers the current list of sub-processors by posting that list online at: https://www.taxdome.com/policies/sub-processors/. 

2.3    For the avoidance of doubt, the above authorization to the engagement of sub-processors constitutes Customer’s prior written consent to the sub-processing by TaxDome’s subprocessors for purposes of Clause 9 of the Standard Contractual Clauses.

3. Customer undertakings and TaxDome’s assistance

3.1     Customer represents and warrants that it has secured all consents and/or provided all notices required by law in order to provide all Customer Data and personal data provided to TaxDome hereunder, including without limitation securing consent or providing required notices pursuant to Applicable Data Protection Law. Customer will defend, indemnify, and hold TaxDome harmless from and against any breach of the foregoing warranty.

3.2    Should such consent be revoked by a data subject, Customer is responsible for communicating the fact of such revocation to TaxDome immediately. 

3.3     Customer understands, as a Controller, that he/she is responsible (as between Customer and TaxDome) for:

3.3.1  determining the lawfulness of any processing, performing any required data protection impact assessments, and accounting to regulators and individuals, as may be needed;

3.3.2  making reasonable efforts to verify parental consent when data is collected on a data subject under 16 years of age;

3.3.3  providing relevant privacy notices to data subjects as may be required in the jurisdiction of the Applicable Data Protection Law, including notice of their rights and provide the mechanisms for individuals to exercise those rights;

3.3.4  responding to requests from individuals about their data and the processing of the same, including requests to have personal data altered, corrected, or erased, and providing copies of the actual data processed;

3.3.5  implementing your own appropriate technical and organizational measures to ensure and demonstrate processing in accordance with this DPA; and

3.3.6  notifying individuals and any relevant regulators or authorities of any incident as may be required by law in your jurisdiction.

3.4     TaxDome shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is reasonably and commercially possible, in fulfilling Customer’s obligations to respond to individuals’ requests to exercise rights under Applicable Data Protection Law.

3.5     TaxDome shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is reasonably and commercially possible, to ensure compliance with Articles 32 to 36 (inclusive) of the GDPR.

3.6     No more than once every year, TaxDome will procure an independent audit of its code base and systems by independent third parties to demonstrate compliance with its obligations under this DPA. Upon Customer request, and subject to confidentiality obligations, TaxDome shall make available to Customer information reasonably necessary to demonstrate compliance with TaxDome’s obligations under this DPA. At a minimum, upon written request, TaxDome will produce to Customer an executive summary of any third-party audit reports concerning the adequacy of TaxDome’s technical security measures as described in the Security Policy.

4. Incident management

4.1     When either party becomes aware of an incident that impacts the processing of personal data, it shall promptly notify the other about the incident and shall reasonably cooperate in order to enable the other party to perform a thorough investigation into the incident, to formulate a correct response, and to take suitable further steps in respect of the incident.

4.2     Both parties shall at all times have in place written procedures which enable them to promptly respond to the other about an incident. Where the incident is reasonably likely to require a data breach notification under applicable laws, the party responsible for the incident shall notify the other without undue delay of having become aware of such an incident.

4.3     Any notifications made by Customer under this section shall be made to [email protected] (when made to TaxDome) and to our point of contact with you (when made to the Customer).

4.4 TaxDome shall notify Customer in writing promptly (and in any event within 72 hours) whenever TaxDome reasonably believes that there has been a Security Incident, providing detailed information regarding the nature and scope of the Security Incident, its actual or potential cause, and the measures being taken by TaxDome to investigate, correct or mitigate the breach and prevent future breaches. TaxDome will provide, at TaxDome sole cost, reasonable assistance and cooperation requested by Customer in the furtherance of any correction, remediation, or investigation of any such Security Incident and the mitigation of damages, including any notification that Customer may determine appropriate to send to individuals impacted or potentially impacted by the Security Incident, regulators or third parties, and/or the provision of any credit reporting service required by applicable laws to be provided to such individuals. Unless required by Applicable Data Protection Law, TaxDome will not notify any individual or any third party other than law enforcement of any potential Security Incident involving personal data without first consulting with Customer. TaxDome’s obligations under this Section 4.4 will not apply to Security Incidents caused directly or indirectly by, and TaxDome’s liability shall be proportionally reduced to the extent of, Customer’s or its representative’s acts or omissions or breach of the Agreement.

5. Liability and indemnity

5.1     Each party’s liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Terms.

5.2     The Customer acknowledges that TaxDome is reliant on the Customer for direction as to the extent to which TaxDome is entitled to process Customer’s personal data on behalf of Customer in performance of the Services. Consequently TaxDome will not be liable under the Terms for any claim brought by a data subject arising from any action or omission by TaxDome, to the extent that such action or omission resulted from the Customer’s instructions or from Customer’s failure to comply with its obligations under the Applicable Data Protection Law.

6. Duration and termination

6.1     This DPA shall come into effect on the “Last Updated” date set forth above and shall continue until it is changed or terminated in accordance with the Terms. We will notify you of any material changes by changing the Last Updated date above; please check back periodically for any updates to this DPA. We may also contact you using the personal data you provided to notify you of certain changes to this DPA.

6.2     Termination or expiration of this DPA shall not discharge the parties from the confidentiality obligations herein.

7. International data transfers

7.1          Data center locations. Customer acknowledges that TaxDome may transfer and process personal data to and in the United States and anywhere else in the world where TaxDome, its affiliates or its sub-processors maintain data processing operations. TaxDome shall at all times ensure that such transfers are made in compliance with the requirements of Applicable Data Protection Law.

7.2         European Data transfers. To the extent that TaxDome is a recipient of personal data protected by the GDPR («EU Data»), the parties agree that TaxDome makes available the mechanisms listed below:

7.2.1     SCCs: TaxDome agrees to abide by and process EU Data in compliance with the SCCs, which are incorporated in full by reference and form an integral part of this DPA. For the purposes of the SCCs:

7.2.1.1  TaxDome agrees that it is the «data importer» and Customer is the «data exporter» under the SCCs (notwithstanding that Customer may itself be an entity located outside the EU);

7.2.1.2  Annex B includes the SCCs and related appendices. The parties further agree that the SCCs will apply to personal data that is transferred via the Service from Europe to outside Europe, either directly or via onward transfer, to any country or recipient: (a) not recognized by the European Commission as providing an adequate level of protection for personal data (as described in the GDPR).

7.2.2     If and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses shall prevail to the extent of such conflict.