III. CallTrackingMetrics as a Processor – Processing Customer Content
5. Customer Instructions. Customer appoints CallTrackingMetrics as a processor to process Customer Content on behalf of, and in accordance with, Customer’s instructions (a) as set forth in the Agreement, this Addendum, and as otherwise necessary to provide the Services to Customer (which may include investigating security incidents and preventing spam or fraudulent activity, and detecting and preventing network exploits and abuse); (b) as necessary to comply with applicable law; and (c) as otherwise agreed in writing by the parties (“Permitted Purposes”).
5.1 Lawfulness of Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Law. Customer acknowledges that CallTrackingMetrics is not responsible for determining which laws are applicable to Customer’s business nor whether CallTrackingMetrics’ provision of the Services meets or will meet the requirements of such laws. Customer will ensure that CallTrackingMetrics’s processing of Customer Content, when done in accordance with Customer’s instructions, will not cause CallTrackingMetrics to violate any applicable law, regulation, or rule, including Applicable Data Protection Law. CallTrackingMetrics will inform Customer if it becomes aware or reasonably believes that Customer’s data processing instructions violate any applicable law, regulation, or rule, including Applicable Data Protection Law.
5.2 Additional Instructions. Additional instructions outside the scope of the Agreement, an Order Form, or this Addendum will be agreed to between the parties in writing, including any additional fees that may be payable by Customer to CallTrackingMetrics for carrying out those instructions.
6.1 Responding to Third Party Requests. In the event that any request, correspondence, enquiry or complaint from a data subject, regulatory authority, or third party is made directly to CallTrackingMetrics in connection with CallTrackingMetrics’s processing of Customer Content, CallTrackingMetrics will promptly inform Customer and provide details of the same, to the extent legally permitted. Unless legally obligated to do so, CallTrackingMetrics will not respond to any such request, inquiry, or complaint without Customer’s prior consent except to confirm that the request relates to Customer.
6.2 Confidentiality Obligations of CallTrackingMetrics Personnel.CallTrackingMetrics will ensure that any person it authorizes to process the Customer Content has agreed to protect personal data in accordance with CallTrackingMetrics’s confidentiality obligations under the Agreement.
7.1 Sub-processors. Customer agrees that CallTrackingMetrics may use sub-processors to fulfill its contractual obligations under the Agreement. Where CallTrackingMetrics authorizes any sub-processor as described in this Section 7, CallTrackingMetrics agrees to impose data protection terms on any sub-processor it appoints that require it to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR.
7.2 General Consent for Onward Sub-processing. Customer provides a general consent for CallTrackingMetrics to engage onward sub-processors, conditional on the following requirements:
(a) Any onward sub-processor must agree in writing to only process data in a country that the European Commission has declared to have an “adequate” level of protection; or to only process data on terms equivalent to the Standard Contractual Clauses, or pursuant to a Binding Corporate Rules approval granted by competent European data protection authorities; and
(b) CallTrackingMetrics will restrict the onward sub-processor’s access to personal data only to what is strictly necessary to provide the Services, and CallTrackingMetrics will prohibit the sub-processor from processing the personal data for any other purpose.
7.3 Current Sub-processors and Notification of New Sub-processors. If CallTrackingMetrics Customer consents to CallTrackingMetrics engaging additional third party sub-processors to process Customer Content within the Services for the Permitted Purposes provided that CallTrackingMetrics maintains an up-to-date list of its sub-processors at https://calltrackingmwtrics.com/legal/subprocessors/ , which contains a mechanism for Customer to subscribe to notifications of new sub-processors. If Customer subscribes to such notifications, CallTrackingMetrics will provide details of any change in sub-processors as soon as reasonably practicable.
7.4 Objection Right for new Sub-processors. Customer may object to CallTrackingMetrics’s appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is in writing and based on reasonable grounds relating to data protection. In such an event, the parties agree to discuss commercial reasonable alternative solutions in good faith. If the parties cannot reach a resolution within ninety (90) days, Customer may suspend or terminate the affected service in accordance with the termination provisions of the Agreement. Such termination will be without prejudice to any fees incurred by Customer prior to suspension or termination. If no objection has been raised prior to CallTrackingMetrics replacing or appointing a new sub-processor, CallTrackingMetrics will deem Customer to have authorized the new sub-processor.
7.5 Sub-processor Liability. CallTrackingMetrics will remain liable for any breach of this Addendum that is caused by an act, error or omission of its sub-processors.
8. Data Subject Rights.
8.1 CallTrackingMetricsServices. As part of the CallTrackingMetrics Services, CallTrackingMetrics provides Customer with a number of self-service features, including the ability to delete, obtain a copy of, or restrict use of Customer Content, which may be used by Customer to assist in complying with its obligations under Applicable Data Protection Law with respect to responding to requests from data subjects via the CallTrackingMetrics Services at no additional cost. In addition, upon Customer’s request, CallTrackingMetrics will provide reasonable additional and timely assistance (at Customer’s expense only if complying with the Customer’s request will require CallTrackingMetrics to assign significant resources to that effort) to assist Customer in complying with its data protection obligations with respect to data subject rights under Applicable Data Protection Law.
9. Impact Assessments and Consultations. CallTrackingMetrics will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer’s expense only if such reasonable cooperation will require CallTrackingMetrics to assign significant resources to that effort) or consultations with regulatory authorities that may be required in accordance with Applicable Data Protection Law.
10. Return or Deletion of Customer Content. To the extent that a Customer’s Account remains active, they are responsible for deleting Customer Content. CallTrackingMetrics will automatically delete any stored Customer Content on CallTrackingMetrics systems sixty days after an Account is cancelled. After deletion any Customer Content archived on CallTrackingMetrics’ back-up systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation.
10.1 Extension of Addendum. Upon termination of the Agreement, CallTrackingMetrics may retain Customer Content in storage for the time periods set forth in Schedule 1 (Details of Processing), provided that CallTrackingMetrics will ensure that Customer Content is processed only as necessary for the Permitted Purposes, and Customer Content remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.
10.2 Retention Required by Law. Notwithstanding anything to the contrary in this Section 10, CallTrackingMetrics may retain Customer Content or any portion of it if required by applicable law, provided that it remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.