Data Processing Addendum
Where applicable, this Data Processing Addendum is hereby incorporated in the HeartCount Terms of Service (the “General Terms”), found at https://heartcount.com/terms-of-use, unless Customer has entered into a superseding written agreement with HeartCount, in which case, it forms a part of such written agreement. All capitalized terms not defined herein shall have the meaning set forth in the General Terms. Unless Customer has a superseding written agreement with HeartCount, HeartCount may amend this Data Processing Addendum from time to time on its Website, as its business evolves. Any revisions will become effective on the date HeartCount publishes the changes. Customer can review the most current version of the Data Processing Addendum at any time by visiting this page. If Customer uses the Services after the effective date of any changes, that use will constitute the acceptance of the revised Data Processing Addendum.
1. DEFINITIONS AND INTERPRETATION
1.1. “Customer Personal Information” means any Personal Information contained within the information submitted or transferred by Customer or the Users to Heartcount in conjunction with the usage of the Heartcount Platform (as defined in the General Terms);
1.2. “Data Controller” has the meaning set out in the Privacy Laws, as applicable to this Data Processing Addendum;
1.3. “Data Processor” has the meaning set out in the Privacy Laws, as applicable to this Data Processing Addendum;
1.4. “Data Protection Regulator” means the applicable supervisory authority with jurisdiction over either party, and in each case any successor body from time to time;
1.5. “Data Subject” has the meaning set out in the Privacy Laws, as applicable to this Data Processing Addendum;
1.6. “Personal Information” has the meaning set out in Privacy Laws;
1.7. “Privacy Laws” means all applicable data protection and privacy legislation, regulations and guidance governing the protection of Personal Information including but not limited to Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the “UK GDPR”);
1.8. “Process”, “Processing” or “Processed” have the meaning set out in the Privacy Laws, as applicable to this Data Processing Addendum; and
1.9. “2021 Standard Contractual Clauses” means Standard Contractual Clauses for the transfer of Personal Information to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 or any European Commission’s decision amending or replacing this decision.
1.10. “Standard Contractual Clauses” meansmeans collectively the 2021 Standard Contractual Clauses or the UK International Data Transfer Addendum whichever is applicable.
1.11. “UK International Data Transfer Addendum” means the International Transfer Data Addendum to the 2021 Standard Contractual Clauses issued by the UK’s Information Commissioner’s Office.
2. PROTECTION OF PERSONAL INFORMATION
2.1. Supersedence. This Data Processing Addendum shall supersede any and all provisions of the General Terms inconsistent herewith.
2.2. Data Controller and Data Processor. The Parties acknowledge that the Customer is the Data Controller and Heartcount is the Data Processor of the Customer Personal Information. Heartcount will Process Personal Information in accordance with Section 3 of this Data Processing Addendum.
2.3. Customer’s Obligations as Data Controller. The Customer warrants that the Customer Personal Information has been obtained fairly and lawfully and, in all respects in compliance with the Privacy Laws.
2.4. Heartcount’s Obligations as Data Processor. Heartcount shall:
2.4.1. Process the Customer Personal Information only in accordance with Section 3 of this Data Processing Addendum and any other reasonable documented instructions as provided by the Customer to Heartcount from time to time (“Instructions”), including with regard to transfers of Customer Personal Information to a third country, save where:
2.4.1.1. such Instructions are unlawful;
2.4.1.2. such Instructions would cause Heartcount to breach its own obligations under Privacy Laws or the General Terms or any other agreement with a third party;
2.4.1.3. such Instructions would negate the Survey Respondents’ right under the General Terms to remain anonymous;
2.4.1.4. Heartcount is under a legal obligation to Process the Customer Personal Information, in which case Heartcount shall inform the Customer of the legal obligation, except to the extent the law prohibits it from doing so; and/or
2.4.1.5. such Instructions would impact the overall availability of the Services or the performance of the Heartcount Platform in an undue manner.
2.4.2. inform the Customer if, in its opinion, an Instruction received from the Customer infringes the Privacy Laws;
2.4.3. ensure that all Heartcount employees and personnel who are involved in the Processing of Customer Personal Information have committed themselves to confidentiality or are under statutory obligations of confidentiality;
2.4.4. not provide any new third party with access to the Customer Personal Information or subcontract any of its obligations under the General Terms that involve Processing Customer Personal Information without providing at least thirty (30) days advance notice to the Customer via email. The Customer hereby approves those third parties listed in Schedule 1 hereto (the “Sub-processors”), which are compliant with requirements under Privacy Laws, as applicable to this Data Processing Addendum, regarding transfers of Customer Personal Information to a third country.
2.4.5. ensure that any sub-contract entered into by Heartcount (where Customer Personal Information is Processed by a Sub-processor) contains provisions which comply with Privacy Laws and in any event are no less onerous than those imposed under Section 2 of this Data Processing Addendum, and where a Sub-processor fails to fulfill its data protection obligations under the Privacy Laws, Heartcount shall remain liable to Customer for the performance of that Subprocessor’s obligations;
2.4.6. implement and maintain appropriate technical and organizational security measures to protect against unauthorized or unlawful Processing of the Customer Personal Information and against accidental loss, disclosure or destruction of, or damage to, the Customer Personal Information, taking into account the state of the art, costs of implementation and nature, scope, context and purposes of Processing, as described in the Privacy Policy, found at https://heartcount.com/privacy-notice, and including:
2.4.6.1. the anonymization, pseudonymization and/or encryption of Customer Personal Information;
2.4.6.2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;
2.4.6.3. the ability to restore the availability and access to Customer Personal Information in a timely manner in the event of a physical or technical incident; and
2.4.6.4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.
2.4.7. taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures, as further described in Schedule 2 hereto, to enable the Customer to comply with its obligations under Privacy Laws in responding to requests from Data Subjects or the Data Protection Regulator, insofar as this is possible, to the extent the anonymity of the Personal Information shall be kept confidential by Heartcount, and not shared with Customer;
2.4.8. assist the Customer (at the Customer’s reasonable cost), to comply with the following obligations under the Privacy Laws, taking into account the nature of Processing and information available to Heartcount, including:
2.4.8.1. notification and assistance to Customer without undue delay, in accordance with the provision set forth in Section 11 of the Privacy Policy, and notification to the Data Protection Regulator and Data Subjects of a Data Incident, as defined in the Privacy Policy, with regards to Customer Personal Information transmitted, stored or otherwise Processed; and
2.4.8.2. the Customer’s obligations to carry out data protection impact assessments and any subsequent consultation with the Data Protection Regulator;
2.4.9. make available to Customer or an independent third party auditor mandated by the Customer (but not being a competitor of Heartcount), to a maximum of once a year or when a breach of Customer Personal Information is reasonably suspected, all reasonable information that Heartcount deems necessary to demonstrate compliance with the obligations imposed on Heartcount under Section 2 of this Data Processing Addendum, and allow for and contribute to audits, including inspections for the sole purpose of demonstrating such compliance; and
2.4.10. unless required by law, at Customer’s request following termination or expiry of the General Terms for whatever reason, securely delete all of the Customer Personal Information.
2.4.11. comply with the relevant Controller to Processor provisions of the 2021 Standard Contractual Clauses which are incorporated by reference and are an integral part of this Data Processing Addendum, for the purpose of which the Parties agree that:
2.4.11.1. Customer is the data exporter and Heartcount is the data importer.
2.4.11.2. Module Two of the 2021 Standard Contractual Clauses will apply where Customer is a Controller and Heartcount is a Processor.
2.4.11.3. Clause 7 of the 2021 Standard Contractual Clauses will apply.
2.4.11.4. For the purpose of Clause 9, paragraph (a) of the 2021 Standard Contractual Clauses, option 2 shall apply, as per the time period specified under section 2.4.4 hereof.
2.4.11.5. The Parties agree that any direct claims brought under the Standard Contractual Clauses by a Party shall be subject to the limitation of liability set out in the General Terms, provided however that nothing in this Data Processing Addendum shall be construed as a limitation or exclusion of a Party’s liability toward a Data Subject under the Standard Contractual Clauses.
2.4.11.6. For the purpose of Clause 17 of the 2021 Standard Contractual Clauses the parties choose option 1 and the law of the Republic of Croatia.
2.4.11.7. For the purpose of Clause 18 of the 2021 Standard Contractual Clauses, paragraph (b), the Parties choose the courts of the Republic of Croatia.
2.4.11.8. The contents of Appendix I of the Standard Contractual Clauses are deemed completed with the information found in Sections 2 and 3 hereof. The contents of Appendix II are described in Schedule 2 hereof.
2.4.11.9. In the event of any conflict between the provisions of the Standard Contractual Clauses and this Data Processing Addendum, the Standard Contractual Clauses shall prevail.
2.4.12. comply with the UK International Transfer Addendum, as set out in Schedule 3 hereto.
2.4.13. Additional Provisions for California. To the extent that Heartcount processes Personal Information of consumers subject to the CCPA, the CPRA and applicable regulations thereunder, the Parties shall comply with all applicable provisions of the CCPA, of the CPRA and of applicable regulations thereunder, as amended from time to time. The Parties shall agree to act in good faith to enter into a modified agreement in order to address any such amendment and ensure ongoing compliance with California laws. Heartcount shall not (a) retain, use or disclose such Personal Information for any purpose other than for the specific purposes described under the General Terms or this Data Processing Addendum, or as otherwise permitted by the CCPA, the CPRA or applicable regulations; (b) retain, use or disclose such Personal Information for a commercial purpose other than the specific purposes described under the General Terms or this Data Processing Addendum; or (c) “sell” or “share” such Personal Information (the terms “sell” and “share” having the meaning ascribed to them in the CCPA, CPRA or applicable regulations).
3. INSTRUCTIONS FOR PROCESSING OF CUSTOMER PERSONAL INFORMATION
Heartcount will Process Customer Personal Information in accordance with the following instructions:
| Categories of personal information collected by Heartcount | Categories of data subjects for which such personal information is collected | Categories of processing activities in connection with such information |
| User credentials User credentials permit the users to access the Heartcount Platform and include emails, phone numbers and password hashes. | Company managers and group managers which use the answers and comments provided by the survey respondents to improve their leadership skills Employees answering the surveys and providing comments | Provide, maintain and improve the Heartcount Platform Prevent or address service, security, support or technical issues with the Heartcount Platform Facilitate product discovery and communications throughout the user journey |
| Employee profiles The account administrator creates a profile for each of their employees, which contains the first name, last name, language, gender and email or phone number of the employee. Each employee has access to their employee profile and can update their information. Managers can assign to one or more teams. | Company managers and group managers which use the answers and comments provided by the survey respondents to improve their leadership skills Employees answering the surveys and providing comments | Provide, maintain and improve the Heartcount Platform Prevent or address service, security, support or technical issues with the Heartcount Platform |
| Answers to surveys Answers to surveys can reveal a wide range of Personal information. Employees answer surveys such as “How did you feel at work this week?” and “What has your relationship with your colleagues been like this week?” Employees can also choose to leave a comment on a survey. Comments given by Survey Respondents can reveal a wide range of Personal Information. Heartcount’s internal database includes the identity of the survey respondents. | Employees answering the surveys, which may include company managers and group managers | Provide, maintain and improve the Heartcount Platform Prevent or address service, security, support or technical issues with the Heartcount Platform Provide insight into employee happiness to Company and group managers. Create statistics based on the aggregated personal data for benchmarking and marketing purposes. |
| Employee notes Company and group managers can leave notes on employee profiles that can serve as conversations about the specific employee between multiple managers. | Company and group managers | Provide, maintain and improve the Heartcount Platform Prevent or address service, security, support or technical issues with the Heartcount Platform |
Schedule 1: General description of the technical and organizational security measures in place
All capitalized terms not defined herein shall have the meaning set forth in the General Terms.
Heartcount has implemented and maintains the following technical and organizational security measures:
Pseudonymisation and encryption of Customer Personal Information
| Pseudonymisation | It is Heartcount’s policy to pseudonymize Customer Personal Information whenever possible. Heartcount cannot however pseudonymize the “survey answers” data in the database, otherwise it would not be able to reveal the identity of an employee for the confidential (identified) version of Heartcount. Heartcount cannot pseudonymize the “Employee profile” data in the database, otherwise the managers could not view, add or modify attributes related to their employees. The answers to surveys, the comments and the User attributes are all included in the same internal database. Therefore, it would not be possible to pseudonymize such data. |
| Encryption | The data is encrypted in transit with HTTP over TLS. Certificates are 2048 bits and private keys are stored in a specific secret vault. The data is also encrypted at rest by Heartcount and the Subprocessors. Encryption keys are managed with limited number of employees and secured in a vault with regular rotations. |
Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
| Confidentiality | Heartcount has measures in place to ensure that no person is allowed to access personal information without authorization. Such measures include, without limitation: Heartcount manages accesses to personal information based on the role‐based access control (RBAC) permissions model on a need to access basis and least privileged basis. Heartcount has a secure authentication process in place with mandatory MFA. Heartcounts’s internal database is located at a Amazon Web Services data center. Amazon Web Services Inc. conforms to global security standards such as ISO 27001, ISO 9001, FedRAMP, SOC 1 and SOC 2. Heartcount has measures in place to control physical security at its office (inc. security guard at building entrance, alarm system, visitor registration). All Heartcount’s suppliers that have access to personal data (being AWS, Postmark, and Infobip) and all Heartcount’s employees have signed a non‐disclosure agreement. The data is encrypted in transit with HTTP over TLS. Certificates are 2048 bits and private keys are stored in a specific secret vault. The data is encrypted at rest using AES-256. Encryption keys are managed with limited number of employees and secured in a vault with regular rotations. Regular updates concerning current security attacks are sent to Heartcount’s employees to raise awareness. All employees receive regular security specific training which is reviewed for completion and testing. |
| Integrity | Heartcount has measures in place to ensure that the data integrity is maintained. Such measures include, without limitation: The right to modify or delete any customer data (which includes personal information) is restricted to a limited group of people on a need basis. Employees in the customer success team and in the technical support team are granted the right to modify and delete customer data in Heartcount’s database. Any modification or deletion by such employees is cataloged in an audit log. A group of four key employees have unlimited access to Heartcount’s database. A policy restricting possible modifications and deletions within Heartcount’s database is in place. Heartcount maintains backups of its database in accordance with its retention policy. |
| Availability | Heartcount has measures in place to ensure that personal information is available and is used properly in the intended process. Such measures include, without limitation: Heartcount maintains backups of its database in accordance with its retention policy. Heartcount’s infrastructure and database schema are built from scripts that are kept in its source control system. Therefore, Heartcount can deploy the whole infrastructure dynamically within hours. |
| Resilience | Heartcount has measures in place to ensure that the Heartcount Platform is resilient. Such measures include: Heartcount’s infrastructure can scale automatically depending on the load. Heartcount’s infrastructure is redundant in the same data center. Heartcount’s database server is redundant in two data centers. |
Ability to restore the availability and access to Customer Personal Information in a timely manner in the event of a physical or technical incident
| If causes of outage are within Heartcount’s control, its recovery time objective (RTO) is about 12 hours or less. See measures described above with respect to “availability”. |
Schedule 2: UK international data transfer addendum
Purpose. This Schedule supplements the Data Processing Addendum as incorporated by reference to the General Terms to govern the international transfer of Personal Information out of the United Kingdom. By signing the General Terms, the Parties agree to the terms of this Schedule.
PART 1: TABLES
Table 1 will be completed with the Parties’ details as set out in the General Terms.
TABLE 2 – Selected SCCs
| Addendum EU SCCs | The 2021 Standard Contractual Clauses, including the appendix information as set out in Section 2.4.11 of the Data Processing Addendum. |
TABLE 3 – Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the 2021 Standard Contractual Clauses (other than the Parties), and which for this Addendum is set out in:
| Annex 1A | List of Parties: As described in Section 2.2 of the Data Processing Addendum. |
| Annex 1B | Description of Transfer: As described in Section 3 of the Data Processing Addendum. |
| Annex II | Technical and organisational measures including technical and organisational measures to ensure the security of the data: As described in Schedule 2 to the Data Processing Addendum. |
| Annex III | List of Sub Processors: As described in Schedule 1 to the Data Processing Addendum. |
TABLE 4 – Ending this Addendum
| Ending this Addendum when the Approved Addendum changes | Which Parties may end this Addendum: Exporter and Importer |
PART 2: MANDATORY CLAUSES
| Mandatory Clauses incorporated by this express reference | Incorporation by reference of Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and submitted to Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022 and approved on 21 March 2022, as amended from time under Section 18 of those Mandatory Clauses. |