Legal Information

This Data Processing Addendum ("DPA”) forms part of IDrive Inc.’s Terms of Service Agreement or other electronic agreements or mutually executed agreement between IDrive^® and Customer ("you" and "your") applicable to Customer’s use of IDrive^® Services (the "Agreement") and reflects the Parties’ agreement with regard to Processing Customer Personal Data. Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.

1. Purpose and Scope

In the course of providing IDrive^® Service to Customer pursuant to the Agreement, IDrive^® will Process Customer Data on your behalf. Customer Data may include Personal Data. This DPA reflects the parties’ agreement relating to the Processing of Customer Data in accordance with the requirements of Data Protection Laws and Regulations. This DPA will control in the event of any conflict with the Agreement.

2. Definitions

"Data Controller" means the entity that determines the purposes and means of Processing of Personal Data.

"Data Processor" means the entity that Processes Personal Data on behalf of the Data Controller.

"Data Protection Laws and Regulations" means any applicable data protection laws and regulations applicable to the Processing of Personal Data under the Agreement, including the applicable laws and regulations of the European Union, the European Economic Area and their member states, and Switzerland.

"Data Subject" means the individual to whom Personal Data relates.

"Personal Data" means any information relating to an identifiable or identified individual.

"Processing", "Processes" or "Process" means any operation or set of operations performed upon Personal Data whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.

"Sub-processor" means IDrive’s Affiliates or other third-party service providers that Process Customer Data for IDrive^®.

3. Processing of Customer Data

Data Processing Roles. The Parties acknowledge and agree that with regard to the Processing of Customer Data under the Data Protection Laws and Regulations and this DPA, Customer is the Controller and IDrive^® is the Processor. Each Party will comply with the obligations applicable to it under the Data Protection Laws and Regulations with respect to the Processing of Customer Personal Data. IDrive^® has no knowledge of, or control over, the Personal Data that you provide for Processing. You are solely responsible for the accuracy, quality, and legality of the Customer Data and the means by which you acquired the Customer Data.

Data Processing Instructions. This DPA and the Agreement are your complete and final instructions to IDrive^® for the Processing of Customer Data. You and IDrive^® must agree on any additional or alternate instructions. IDrive^® will inform you if, in IDrive's opinion, your instructions violate Data Protection Laws and Regulations. IDrive^® will process Customer Data: (1) in accordance with the Agreement (including all documents incorporated in the Agreement), and (2) to comply with other reasonable instructions you provide to IDrive^® (including by email) where your instructions are consistent with the Agreement. IDrive^® will not otherwise disclose Customer Data to third parties unless required to do so by applicable law, in which case IDrive^® will inform you in advance unless IDrive^® is prohibited from doing so. IDrive^® will not Process Customer Data for any other purpose unless you instruct IDrive^®.

Scope and Duration of Processing. IDrive^® will Process Customer Personal Data as necessary to perform the IDrive^® Service pursuant to the Agreement and in accordance with this DPA. The types of Customer Personal Data and categories of Data Subjects that may be Processed under this DPA are set forth in Exhibit 1 ("Scope of Processing"). IDrive^® will Process Customer Personal Data for the period of the Agreement unless otherwise agreed to by the Parties in writing.

4. Rights of Data Subjects

Access, Rectification, Restriction and Deletion. IDrive^® will enable Customer to access, rectify, restrict processing of and delete Customer Personal Data as far as consistent with IDrive^® Service functionality.

Data Subject Requests. If IDrive^® receives a request from a Data Subject in relation to Customer Personal Data then, to the extent legally permissible, IDrive^® will advise the Data Subject to submit their request to Customer and Customer will be responsible for responding to any such requests including, where necessary, by using the functionality of the IDrive^® Service. If you do not have the ability to access, rectify, restrict, or delete Customer Personal Data as required by Data Protection Laws and Regulations, you can provide written instructions to IDrive^® to act on your behalf. IDrive^® will follow your instructions to the extent they are technically feasible and legally permissible. You will pay IDrive’s costs of providing this assistance.

Cooperation and Assistance. IDrive^® will assist you to address any request, complaint, notice, or communication you receive relating to IDrive’s Processing of Customer Data received from (i) a Data Subject whose Personal Data is contained within the Customer Data, or (ii) any applicable data protection authority. IDrive^® will also assist you with your reasonable requests for information to confirm compliance with this DPA or to conduct a privacy impact assessment. You will pay IDrive’s costs of providing assistance if the assistance exceeds the services provided under the Agreement.

5. Data Security and Confidentiality

Security Controls. IDrive^® maintains appropriate administrative, technical and organizational safeguards to protect Customer Data from unauthorized or unlawful Processing, from accidental loss, destruction, or damage. As described in Exhibit 2, the Security Controls include measures to help ensure ongoing confidentiality, integrity, availability and resilience of IDrive’s systems and services and for regular testing and effectiveness of controls.

IDrive Personnel. IDrive^® ensures that access to Customer Data is limited to those personnel who require access to Process Customer Data under the Agreement. IDrive^® informs its personnel engaged in the Processing of Customer Data about the confidential nature of such Customer Data. IDrive^® will take appropriate steps to ensure compliance with the Security Controls by its employees, contractors, and Sub-processors to the extent applicable to their scope of performance, including ensuring that all persons authorized to Process Customer Data have agreed to an appropriate obligation of confidentiality.

6. Sub-processors

Authorization and Commitments. You expressly authorize IDrive^® to use Sub-processors to perform specific services on IDrive’s behalf to enable IDrive^® to perform its obligations under the Agreement and this DPA and to provide certain services on IDrive’s behalf, such as support services. IDrive^® has written agreements with its Sub-processors that contain obligations substantially similar to IDrive’s obligations under this DPA. IDrive^® will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processors. IDrive's current Sub-processors including their location and services are listed at: https://www.idrive.com/authorized-sub-processor. IDrive^® will continue to publish changes to its Sub-processors on this website.

Notice and Objection. You have a right to reasonably object to IDrive’s use of a new Sub-processor by notifying IDrive^® in writing within 10 business days after IDrive^® publishes notice of a new Sub-processor. If you do so, IDrive^® will use reasonable efforts to change the affected Software or Cloud Service, or recommend a commercially reasonable change to your configuration or use of the affected Software or Cloud Service, to avoid Processing of Customer Data by the new Sub-processor. If IDrive^® is unable to make or recommend such a change within a reasonable period of time, not to exceed 60 days, you may terminate only the Subscription Term for the Software and Cloud Service that IDrive^® cannot provide without using the new Sub-processor. You must provide written notice of termination to IDrive^® in accordance with the Agreement.

7. Audit and Reports

Reports. IDrive^® uses external auditors to verify its security measure for various security and compliance control standards and certifications. IDrive^® has completed the necessary audits and, upon Customer’s written request, can provide supporting documentation to demonstrate that it meets the standards defined by SSAE 16.

Audit Rights. IDrive^® will provide you with additional information beyond that which is stated in the Report—and will allow and contribute to audits, including inspections—reasonably necessary to demonstrate compliance with Data Protection Laws and Regulations. You will reimburse IDrive^® for any time taken for an audit or inspection at IDrive's then-current professional service rates. IDrive^® will provide those rates to you on request. You and IDrive^® will agree in advance on the timing, scope, duration and reimbursement rates for any audit or inspection. Customer shall promptly notify IDrive^® with information regarding any non-compliance discovered during the course of the audit.

8. Incident Management and Notification.

IDrive^® will notify you without undue delay after becoming aware of a breach of your Customer Data. To the extent known, the notice will include (i) a description of the nature of the personal data breach; (ii) the measures IDrive is taking to address the breach to the extent such measures are within IDrive’s reasonable control, including measures to mitigate its possible adverse effects.

9. Return and Deletion of Customer Data

IDrive^® Service provides Customer with controls to enable Customer to retrieve Customer Data at any time prior to the end of a Subscription Term. Following your Subscription Term, IDrive^® will delete your Customer Data in accordance with the Agreement.

10. Data Privacy Framework Program and Swiss-U.S. Privacy Framework

IDrive^® aligns with the EU-U.S. Data Privacy Framework and the Swiss–U.S. Privacy Shield Framework.

The EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) were established to streamline transatlantic commerce. These frameworks offer U.S. organizations dependable mechanisms for personal data transfers from the European Union / European Economic Area, the United Kingdom (including Gibraltar), and Switzerland to the United States, ensuring consistency with EU, UK, and Swiss law. An organization needs to self-certify its commitment to the DPF Principles with the ITA. This involves being listed on the Data Privacy Framework List, which the ITA updates yearly based on organizations' annual re-certification submissions.

IDrive^® aligns with the EU-U.S. Data Privacy Framework and the Swiss–U.S. Privacy Shield Framework as established by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States, respectively. IDrive^® has certified to the Department of Commerce that it adheres to the Privacy Shield Principles.

If IDrive^® determines it can no longer meet these obligations, IDrive^® will promptly notify you and will cease Processing your Personal Data or take reasonable and appropriate steps to remediate.