Data Processing Addendum

Effective date: January 1st 2023

1. Protecting personal data

When you use AstroSwitch, you and we both collect and use information about people (such as visitors to your profile and individuals who appear in your content). European laws have rules which protect that information (known as “EU Data Protection Laws”).

This Data Processing Addendum (“DPA”) applies to you when the use of your AstroSwitch account is subject to the EU Data Protection Laws. It forms part of the Terms but if there’s any conflict between this DPA and the Terms this DPA will take precedence).

2. Responsibilities

Your and our responsibilities under this DPA depend on our roles as either a “controller” or “processor” of personal data under EU Data Protection Laws (summarised below).

When we talk about either of us acting as a “controller”, we mean us or you determining what personal data is for and how it’s used. When we talk about AstroSwitch acting as a “processor”, we mean us handling or processing personal data on your behalf, as the “controller”.

3. Controller Services

Each of us has responsibilities in relation to the Controller Services, which are set out in the table below. To the extent that there are additional obligations under EU Data Protection Laws in respect of the Controller Services, they will remain with each of us and you individually.

4. Processor Services

You will comply with your obligations when acting as a “controller” under applicable data protection laws in respect of Profile Data and AstroSwtich will follow your instructions, and comply with its obligations under EU Data Protection Laws, when acting as a “processor” in relation to the Processor Services as follows:

• we will only process Profile Data in accordance with the Terms. If we become aware that processing for the Permitted Purpose infringes EU Data Protection Laws, we will let you know;
• we will make sure that any person we authorise to process Profile Data will keep it confidential;
• we will implement appropriate technical and organisational measures designed to protect Profile Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access;
• if we become aware of a confirmed personal data breach in respect of Profile Data, we will notify you without undue delay;
• you consent to us engaging third parties (“Subprocessors”) to process Profile Data for the Permitted Purpose, provided that: (i) we maintain an up-to-date list of Subprocessors in our Privacy Notice, which we will update before we make any changes to Subprocessors; (ii) we will impose data protection terms on any Subprocessor as required to protect Profile Data to the standard set by EU Data Protection Laws; and (iii) we remain responsible for any breach of this DPA caused by any Subprocessor. You may object to a Subprocessor before we appoint or replace them, provided your objection is based on reasonable grounds relating to data protection. In that event, we will either not appoint or replace the Subprocessor or, if this is not possible, you may suspend or terminate your account (but you won’t receive a refund of any fees paid upfront);
• taking into account the nature of the processing, we will provide all reasonable and timely assistance to you (at your expense) to enable you complete a legally required data protection impact assessment and to respond to: (i) any request from an individual to exercise its rights under EU Data Protection Laws; and (ii) any other enquiry or complaint received from an individual, regulator or third party in connection with processing Profile Data;
• upon cancellation of your account, we will delete Profile Data in our possession or control for the purposes of the Processor Services (except to the extent we are required by applicable law to retain Profile Data); and
• on request, we will provide copies of relevant security certifications or other documentation necessary to verify our compliance with this DPA in respect of the Processor Services. Such documents will be subject to the confidentiality provisions in the Terms.

5. International data transfers

We will both follow EU Data Protection Laws when transferring personal data to another country. You and we agree that when there is a transfer of personal data from the European Economic Area (EEA) or the United Kingdom (UK) from you to us, the Data Transfer Addendum (see below) forms part of, and is incorporated into, this DPA.

6. Definitions

Words used but not defined in this DPA have the same meaning as in the Terms. Additionally, the following definitions apply:

• “EU Data Protection Laws” means (as applicable) Regulation (EU) 2016/679 (“EU GDPR”); or the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR“).
• “controller“, “processor“, “personal data” and “personal data breach” have the meanings set out in EU Data Protection Laws.

Data Transfer Addendum

This Data Transfer Addendum applies to you when the use of your AstroSwitch account is subject to EU Data Protection Laws. It forms part of the DPA and the Terms (but if there is any conflict between this Data Transfer Addendum and the DPA or Terms, this Data Transfer Addendum will take precedence).

1. Appropriate safeguards

When the transfer of Profile Data from you to us is a Restricted Transfer:

• (a) in respect of personal data protected by the EU GDPR, the Controller to Controller SCCs shall apply to the Controller Services and the Controller to Processor SCCs shall apply to the Processor Services; and
• (b) in relation to personal data that is protected by the UK GDPR, the EU SCCs, completed as set out in (a) above shall apply, and the EU SCCs will be deemed amended as specified by Part 2 of the UK Addendum, which will be deemed entered into and incorporated into this Data Transfer Addendum by this reference.

2. Definitions

This Data Transfer Addendum uses the same terms as in the Terms and DPA. Additionally, the following definitions apply:

• “Restricted Transfer” means: (i) where the EU GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission (“EC”); and (ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018.
• “Controller to Controller SCCs” means module one of the contractual clauses annexed to the EC’s Implementing Decision 2021/914 of 4 June 2021 where: (i) for the purposes of Clause 17, Irish law will govern; (ii) in Clause 18(b), disputes will be resolved by the courts of Ireland; and (iii) Annex I shall be completed as set out in Clause 3 of this Data Transfer Addendum and Annex II shall be completed as set out in the AstroSwitch Security Measures.
• “Controller to Processor SCCs” means module two of the contractual clauses annexed to the EC’s Implementing Decision 2021/914 of 4 June 2021 where: (i) in Clause 9, Option 1 will apply, and the time period for prior notice of Subprocessor changes shall be as set out in Clause 4 of the DPA; (ii) in Clause 17, Option 1 will apply, and Irish law will govern; (iii) in Clause 18(b), disputes shall be resolved before the courts of Ireland; and (iv) Annex I shall be completed as set out in Clause 3 of this Data Transfer Addendum and Annex II shall be completed as set out in the AstroSwitch Security Measures.
• “EU SCCs” means the Controller to Controller SCCs or the Controller to Processor SCCs, as applicable.
• “UK Addendum” means the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner’s Office under s.119A(1) of the UK Data Protection Act 2018. Tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed with the relevant information from the EU SCCs, completed as set out in Clause 3 of this Data Transfer Addendum, and the option “Importer” shall be deemed checked in Table 4.

3. Annex I to the SCCs

A. LIST OF PARTIES

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority in accordance with Clause 13Determined in accordance with Clause 13 of the EU SCCs