Controller to Processor
This Data Processing Addendum (“Addendum”) forms part of the agreement entered between the vendor named in the agreement (“Vendor” or “Processor”) and the Playtika entity named in the agreement, including its affiliates (“Playtika” or “Controller”) (the “Agreement”).
The Services provided by Vendor may entail the Processing of Personal Data. Therefore, the parties agree to comply with the following provisions.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum.
1. Definitions
1.1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity;
1.2. “Applicable Data Protection Law” means the relevant data protection laws, rules, regulations, standards, and codes to which the Personal Data are subject, including but not limited to (a) the Israel Protection of Privacy Law 5741-1981 and Privacy Protection Regulations (Data Security) 5777-2017; (b) the EU General Data Protection Regulation 2016/679 and laws enacted by the European Union or Member States pursuant thereto (“GDPR”); (c) the California Consumer Privacy Act of 2018 and the regulations issued thereunder (“CCPA”); (d) data security and data breach notification laws; and (e) any other applicable law with respect to any Personal Data;
1.3. “Data Subject” shall have the meaning ascribed to such term, or a similar term, by Applicable Data Protection Law. If not defined, Data Subject shall mean the individual person who is the subject of Personal Data.
1.4. “Personal Data” shall have the meaning ascribed to the terms “personal data”, “personal information”, or other such terms as provided under Applicable Data Protection Law and shall, at a minimum, include any information that can be used directly or indirectly, alone or in combination with other information, to identify an individual.
1.5. “Playtika Personal Data” means any Personal Data Processed by Processor pursuant to or in connection with the Agreement;
1.6. “Security Incident” means the accidental or unlawful and/or unauthorized access to, or loss, alteration, or disclosure of Personal Data.
1.7. “Standard Contractual Clauses” means the form of the Standard Contractual Clauses pursuant to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for the transfer of personal data to Processors established in third countries which do not ensure an adequate level of data protection.
1.8. “Subprocessor” means any person (including any third party and any Processor Affiliate, but excluding an employee of Processor) appointed by or on behalf of Processor or any Processor Affiliate to Process Personal Data on behalf of Controller in connection with the Agreement;
1.9. The terms, “Business”, “European Commission”, “Member State”, “Processing”, “Service Provider”, and “Supervisory Authority” shall have the same meaning as ascribed to them under Applicable Data Protection Law, and their cognate terms shall be construed accordingly.
2. Subject Matter, Duration, and Terms of Processing
2.2. This Addendum will be effective as of the date of the Agreement, or as of the date signed by both parties if this Addendum is completed after the effective date of the Agreement.
2.3. Vendor will Process Playtika Personal Data only for the term set in the Agreement for providing the Service. Vendor’s obligations and Playtika’s rights under this Addendum will continue for so long as Vendor Processes Playtika Personal Data.
2.4. The Controller will determine the scope, purposes, and manner by which the Playtika Personal Data may be Processed by the Processor. The Processor (and any Subprocessors) will Process the Playtika Personal Data only for the purposes of and to the extent necessary to provide the Services to Controller, in accordance with the Agreement, this Addendum, Applicable Data Protection Law, and as set forth in Controller’s written instructions. Processor will, unless legally prohibited, advise Controller if Processor believes any of Controller’s instructions are in conflict with any applicable law and await instructions from the Controller prior to performing said Processing activity. The Processor certifies that it understands the restrictions specified in this Section 2 and will comply with them.
2.5. Processor shall not sell, disclose, transfer, or otherwise make any use of Playtika Personal Data that would constitute a ‘sale’ under the CCPA.
3. Confidentiality
Without prejudice to any existing contractual arrangements between the parties, the Processor shall treat all Playtika Personal Data as strictly confidential and it shall inform all its employees, agents and/or approved Subprocessors engaged in Processing Playtika Personal Data of the confidential nature of Playtika Personal Data. The Processor shall ensure that all such persons or parties have signed an appropriate confidentiality agreement, unless otherwise bound to an appropriate statutory obligation of confidentiality.
4. Security
4.2. The parties acknowledge that security requirements are constantly changing, and that effective security requires frequent evaluation and regular improvements of outdated security measures. The Processor will therefore establish and implement a process to regularly test and evaluate the measures as implemented in accordance with this Article and will tighten, supplement and improve these measures in order to maintain compliance with the requirements set out in this Article.
5. Data Transfers
5.1. To the extent required by Applicable Data Protection Law, Module Two (Controller-to-Processor) of the Standard Contractual Clauses is hereby incorporated into and forms part of this DPA, including the selections and specifications set out in Annex 3.
5.2. Controller authorizes Processor to transfer Playtika Personal Data across international borders, including from the European Economic Area and/or UK to the United States. Processor will put in place and maintain appropriate controls, consistent with and as required by Applicable Data Protection Law, to ensure the legal transfer of the Playtika Personal Data, such as the Standard Contractual Clauses and transfer assessments including but not limited to cases where Processor’s use of Subprocessors involve transfer of Playtika Personal Data across international borders. Upon request, Processor will provide Playtika with copies of such clauses and/or assessments.
(a) For the purposes of Clause 8 of the Standard Contractual Clauses, the following is deemed an instruction by the Controller to process Playtika Personal Data: (a) Processing in accordance with the Agreement and applicable Order Form(s); (b) Processing initiated by users and (c) Processing to comply with other reasonable documented instructions provided by Controller (e.g., via email).
6. Requests
6.1. Processor will provide Controller written notice promptly, but within no more than three (3) days of receipt of any request it receives from a regulator, law enforcement, court, or any other relevant authority to produce or disclose Playtika Personal Data, except where forbidden to do so by applicable law, so that Controller may contest or attempt to limit the scope of production or disclosure request. If reasonably requested by Controller, Processor agrees to provide assistance to Controller to contest or limit the scope of production.
6.2. Processor will notify Controller in writing of any data subject rights request received by a Data Subject relating to Playtika Personal Data, promptly, but within no more than three (3) days of receiving the request. Processor agrees to comply with all reasonable requests and instructions from Controller related to any such request from a Data Subject. Processor shall not respond to any Data Subject request other than as directed by Controller.
7. Security Incidents
7.1. The Processor shall have in place and follow written policies and procedures to detect, respond to, investigate, and promptly notify the Controller about any Security Incident. These policies and procedures shall include steps to (a) detect, identify, and respond to reasonably suspected and/or confirmed Security Incidents; (b) mitigate harmful effects of such Security Incidents; (c) document relevant information about the Security Incident, including the investigation and remediation thereof; and (d) restore the availability and access to any affected Personal Data in a timely manner.
7.2. Processor shall notify Controller in writing promptly, without undue delay, and within no more than seventy-two (72) hours of any Security Incident from the moment it becomes aware of such Security Incident, that may impact the Processing of Playtika Personal Data. Processor shall use every effort to mitigate the breach and prevent its recurrence; and shall at all times cooperate with the Controller, and follow the Controller’s instructions on issuing any statements or notices to any regulatory authority, law enforcement, news agency/ies, affected Data Subjects, and/or others (“Notices”) regarding such breaches. Controller has the right, in its sole discretion, to provide the content of all Notices or to review and approve the content of all Notices before Processor sends them, provided that Controller shall not unreasonably withhold or delay such content or approval.
7.3. Any notifications made to the Controller pursuant to this Article shall be sent to privacy@playtika.com, and shall contain:
(a) all available details required under Applicable Data Protection Laws to enable Controller to comply with its obligations, including but not limited to a description of the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, and location of residence of Data Subjects concerned;
(b) the name and contact details of the Processor’s data protection officer or another contact point where more information can be obtained if different from that provided in the signature block of this Addendum;
(c) a description of the likely consequences of the Security Incident; and
(d) a description of the measures taken or proposed to be taken by the Processor to address the Security Incident including, where appropriate, measures to mitigate its possible adverse effects.
8. Subprocessors
8.2. Before the effective date of this Addendum, Processor will provide to Controller a list of the Subprocessors Processor currently engages in a form substantially similar to that provided in Annex 4 attached hereto.
8.3. Processor will inform Controller in writing at least sixty (60) days in advance of any new or substitute Subprocessor. Controller shall have the right to object, on reasoned grounds, to any new or substitute Subprocessor. If Controller so objects, Processor may not engage that new or substitute Subprocessor for the purpose of Processing Playtika Personal Data and, if Processor cannot provide the Services without use of such Subprocessor, Controller shall have the right to terminate that portion of the Services and Processor will refund any pre-paid fees to Controller with respect to such terminated Services.
8.4. Processor shall remain fully liable to the Controller for the performance or failure of performance of its Subprocessors.
8.6. The Controller may request that the Processor audit a Subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Controller in obtaining a third-party audit report concerning the Subprocessor’s operations) to ensure compliance with its obligations imposed by the Processor in conformity with this Agreement.
9. Storage and Return and/or Destruction of Personal Data
9.2. Processor will retain Playtika Personal Data in accordance with the retention policy (as communicated to Processor).
9.3. At the expiration of the applicable retention period(s) as indicated in the retention policy (as communicated to Processor), within thirty (30) days of expiration or termination of this Addendum, or earlier upon the Controller’s request, or upon fulfillment of all purposes agreed in the context of the Services, the Processor shall, at the discretion of the Controller, either delete, destroy or return all Playtika Personal Data to the Controller and destroy or return any existing copies of it. In addition, Processor shall ensure that its Subprocessors will also delete, destroy or return all copies of Playtika Personal Data in their possession or control, as appropriate.
9.4. No later than sixty (60) days following expiration or termination of this Addendum, Processor shall provide a Certificate of Return /Destruction/Deletion certifying that Processor has returned, destroyed, and/or deleted all Playtika Personal Data in its possession and control and a Certificate of Destruction by Subprocessors certifying that Processor’s Subprocessors have destroyed all Playtika Personal Data in their respective possession or control.
10. Assistance to Controller
10.2. The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Article 4 (Security), preparation of data protection impact assessments, data transfer assessments and prior consultations with Supervisory Authorities.
10.3. In addition to any other rights provided in the Agreement, Processor acknowledges and agrees that Controller and its regulators have the right to conduct on-site audits of Processor’s architecture, systems, and documentation related to Processor’s compliance with Applicable Data Protection Law and this Addendum. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the Processor’s obligations and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
11.2. Any limitation of liability included in the Agreement shall not apply to this Section 11 of the Addendum.
12. Duration and Termination
12.1. This Addendum shall come into effect on the effective date in accordance with the Agreement.
12.2. For so long as Processor or any of its Subprocessors Processes Playtika Personal Data, termination or expiration of this Addendum shall not discharge the Processor from its obligations under this Addendum.
13. Miscellaneous
13.1. Inconsistency. In the event of any inconsistency between the provisions of this Addendum and the provisions of the Agreement, the provisions of this Addendum shall prevail.
13.2. Governing Law and Jurisdiction.
(a) The parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes regarding its existence, validity or termination or the consequences of its nullity.
(b) This Addendum and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Agreement.
13.3. Severance. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
ANNEX I – Description of Processing
A. LIST OF PARTIES
The data Controller and/or exporter is the Playtika entity named in the Agreement.
The data Processor and/or importer is the Vendor named in the Agreement.
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred: The personal data transferred concerns the categories of data subjects indicated in the Agreement.
Categories of personal data transferred: The personal data transferred concerns the categories of data indicated in the Agreement.
Sensitive data transferred (if applicable): The personal data transferred will not concern any special categories of data unless specified in the Agreement.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). Continuous basis limited to the necessary for Processor to provide the Services as described in the Agreement
Nature of the processing The basic processing activities as necessary for Processor to provide the Services as described in the Agreement.
Purpose(s) of the data transfer and further processing For the Processor to provide the Services as described in the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For so long as the Processor provides the services as described in the Agreement and subject to section 9 to the DPA.
C. COMPETENT SUPERVISORY AUTHORITY
Relevant authority where the data exporter is established. (in case the data exporter is not established in an EU member state – the relevant authority of Romania).
ANNEX II - Playtika Information Security Requirements
Description of the minimum technical and organizational security measures to be implemented by the data Processors / importer in accordance with section 5 of this DPA:
Based on technological developments, and any applicable law, Playtika reserves the right to change above minimum requirements.
ANNEX III - Standard Contractual Clauses (Controller to Processor)
To the extent required by Applicable Data Protection Laws, Module Two (Controller-to-Processor) of the Standard Contractual Clauses is hereby incorporated into and forms part of this DPA, including the following selections and specifications:
Clause 7 (Docking clause) : does not apply.
Clause 11 (Redress): optional wording does not apply.
Clause 17 (Governing Law) : The parties agree that the SCCs shall be governed by the law of the EU Member State in which the data exporter is established. Where the data exporter is not established in an EU Member State, the laws of Romania shall apply.
Clause 18 (Choice of Forum and Jurisdiction): The parties agree that any dispute arising from the SCCs shall be resolved by the courts of the EU Member State in which the data exporter is established. Where the data exporter is not established in an EU Member State, the courts of Romania shall have jurisdiction.
For the purpose of Annex I of the Standard Contractual Clauses, Part A of Annex 1 to the DPA contains the specifications regarding the parties, Part B of Annex 1 to the DPA contains the description of transfer for Module Two, and Part C of Annex 1 to the DPA contains the competent supervisory authority.
For the purpose of Annex II of the Standard Contractual Clauses, Annex II to the DPA contains the technical and organizational measures.
Clause 9 (Use of subprocessors) – General written authorization will apply, and the time period is as specified in section 8 of this DPA.
For the purpose of Annex III of the Standard Contractual Clauses, the list of Subprocessors are set out in Annex IV or as otherwise determined by Section 8 of this DPA. The Subprocessor’s contact person’s name, position and contact details will be provided by Processor upon request
ANNEX IV - Subprocessors
| Subprocessor name | Nature of processing | Location of processing |
|---|---|---|
