This Data Processing Addendum ("DPA") supplements, and forms part of, the User Terms or the Subscription Agreement (the "Agreement") between the applicable 1080 Agile Pty Ltd contracting entity ("HCMevolve") and the entity or person(s) identified as Customer in the relevant account or Agreement (as applicable) ("Customer").
This DPA applies where and to the extent that HCMevolve is acting as a processor and/or controller of personal data on behalf of Customer under the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of such conflict. In the event of any conflict between the SCCs (defined in Section 1 below) and the Agreement (including this DPA), the SCCs shall prevail to the extent of such conflict.
1.1 Definitions. In this DPA, the following terms shall have the following meanings:
2.1 Relationship of the parties. The parties acknowledge that, except as set out in Section 2.1(b), Customer shall act as a controller and HCMevolve shall act as a processor in respect of its processing of Customer Personal Data disclosed to HCMevolve for the purpose of HCMevolve providing the Services.
2.2 Prohibited Data. Customer will not disclose (and will not permit any Authorised User to disclose) any Sensitive Personal Data (including "Protected Health Information" as defined by the United States Health Insurance Portability and Accountability Act) to HCMevolve for processing.
2.3 Purpose Limitation. HCMevolve shall process Customer Personal Data as necessary to perform its obligations under the Agreement and strictly in accordance with the documented lawful instructions of Customer (including the terms of the Agreement), or as otherwise agreed in writing by the parties (the "Permitted Purpose").
2.4 Security. HCMevolve shall implement appropriate technical and organisational measures to protect Customer Personal Data against a Personal Data Breach and to preserve the security and confidentiality of Customer Personal Data.
2.5 Personal Data Breach. Upon becoming aware of a Personal Data Breach, HCMevolve shall notify Customer without undue delay by written notice with all relevant details reasonably available.
2.6 Confidentiality. HCMevolve shall take reasonable steps to ensure that it has appropriate policies and procedures in place in relation to any person that it authorises to process Customer Personal Data.
2.7 Deletion or return of Customer Personal Data. Upon written request from Customer, HCMevolve shall anonymise, delete or return to Customer all Customer Personal Data in its possession or control subject to any requirement on HCMevolve to retain some or all of the Customer Personal Data to comply with applicable laws.
2.10 Sub-processors. Customer agrees that HCMevolve may engage Sub-processors to process Customer Personal Data for the Permitted Purpose. The Sub-processors currently engaged by HCMevolve and authorised by Customer are listed at sub-processors. HCMevolve shall notify Customer if it adds any new Sub-processors at least 20 days before the proposed addition.
Data exporter: Customer (as identified in the Agreement).
Data importer: The HCMevolve contracting entity (as identified in the Agreement). Contact: Ms Rose Aguilar – admin@hcmevolve.com.
HCMevolve implements a variety of technical and organisational security measures, the details of which are set out at hcmevolve.com/security.
A list of HCMevolve's current Sub-processors is set out at sub-processors.