Last updated on January 7, 2025
This Data Protection Attachment for the PDF-VISION App (“DPA”) is incorporated into and made part of and governs the Processing of Personal Data by CODEVISION as a Processor on behalf of Customer or Customer Affiliates, as applicable. Unless otherwise defined in this DPA, capitalized terms will have the meaning given to them in the Agreement.
General. The terms “Personal Data,” “Personal Data Breach,” “Process/Processing,” “Controller,” “Processor,” “Subprocessor,” and “Data Subject” have the meanings ascribed to them under the General Data Protection Regulation; provided that the term “Personal Data” as used herein only applies to Personal Data for which CODEVISION is a Processor.
“EEA” means the European Economic Area.
“General Data Protection Regulation” or “the GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
“Processor Privacy Code” or “Processor Code” means CODEVISION’s processor binding corporate rules for the Processing of Personal Data, the most current version of which is available on CODEVISION s website.
2.1 Scope of Data Processing. The duration of the Processing of Personal Data will be the same as the duration of the Agreement, except as otherwise agreed to in writing by the parties. The subject matter of the Processing of Personal Data is set out in the Agreement and this DPA. The nature and purpose of the Processing of Personal Data involve the provision of the PDF-VISION App service to Customer, as set out in the Agreement and this DPA.
2.2 Data Processing Limitations. With respect to Personal Data Processed by CODEVISION or CODEVISION Affiliate as a Processor on behalf of Customer or Customer Affiliate or as a Subprocessor where Customer Processes such Personal Data on behalf of its customers (or both), CODEVISION will: (a) Process Personal Data only as necessary to provide the Services in accordance with the terms of the Agreement or as instructed by Customer in writing, including in electronic form, and consistent with the terms of the Agreement; and (b) not disclose Personal Data to third parties except: (i) to employees, service providers, or advisers who have a need to know the Personal Data and are under confidentiality obligations at least as restrictive as those described under this DPA or (ii) as required to comply with valid legal process in accordance with the terms of the Agreement. If CODEVISION has reason to believe Customer’s instructions infringe the GDPR or other EEA data protection provisions, then CODEVISION will immediately notify Customer.
2.3 Assistance to Customer and Regulatory Investigation. Upon written request, CODEVISION will provide reasonable assistance and information to Customer in fulfilling any legal obligations that Customer may have under the GDPR regarding data protection impact assessments, data and systems inventory, records of Processing, and related consultations of data protection authorities, or in the event of an investigation by any governmental authorities, if and to the extent that such investigation relates to Personal Data Processed by CODEVISION in accordance with the Agreement. Such assistance will be at Customer’s sole expense, except where such an investigation was required due to CODEVISION ’s failure to act in accordance with the Agreement.
2.4 Transfers of Personal Data from EEA. In providing the PDF-VISION App service, CODEVISION may transfer and access Personal Data to and from other countries where CODEVISION has operations or Subprocessors, or as otherwise required by applicable law. CODEVISION’s Processor Privacy Code and the additional terms in this Section 2.4 will apply to CODEVISION’s Processing of Personal Data on Customer’s behalf as a data processor in providing the PDF-VISION App service, where such Personal Data is: (i) subject to any restriction under the GDPR or other applicable EEA data protection laws regarding outbound transfers of Personal Data, and (ii) Processed by CODEVISION in a country outside of the EEA. The most current version of the Processor Code is available on CODEVISION’s website, and the terms of the Processor Code are incorporated by reference into this DPA. Capitalized terms used but not defined in this Section 2.4 have the meanings set forth in the Processor Code. CODEVISION will make commercially reasonable efforts to maintain the EU authorization of its Processor Code for the duration of the Agreement and will promptly notify Customer of any subsequent material changes in the EU authorization of its Processor Code. CODEVISION will always remain solely liable to Customer or Customer Affiliate for CODEVISION’s obligations (and those of its Affiliates, if any) under this DPA, and in no event will any other CODEVISION Affiliate owe liability to Customer or Customer Affiliate under this DPA, except where and to the extent required by applicable law.
3. CUSTOMER RESPONSIBILITIES. Customer acknowledges that it is responsible for properly implementing access and use controls and configuring certain features and functionalities of PDF-VISION App that Customer may elect to use and that it will do so in such manner that Customer deems adequate to maintain appropriate security, protection, deletion, and backup of Personal Data. CODEVISION will be entitled to rely solely on Customer or Customer Affiliate’s instructions relating to Personal Data Processed by CODEVISION. Customer is responsible for coordinating all communication with CODEVISION under this DPA, including, without limitation, any communication in relation to this DPA on behalf of its Affiliates.
4. INFORMATION SECURITY. CODEVISION will safeguard Personal Data with appropriate technical, physical, and organizational measures as described more fully in the Processor Code and the Agreement for the provision of the PDF-VISION App service. The parties agree that the audit reports and audit rights provided under the Processor Code and Agreement will be used to satisfy any audit or inspection requests by or on behalf of Customer and to demonstrate compliance with applicable obligations of CODEVISION under this DPA.
5. PERSONAL DATA BREACH. CODEVISION will notify Customer without undue delay if CODEVISION becomes aware of a Personal Data Breach affecting the Personal Data. Taking into account the nature of Processing and the information available to CODEVISION, CODEVISION will assist Customer at Customer’s request and at Customer’s expense in complying with Customer’s notification obligations regarding Personal Data Breaches as required by the GDPR.
6. DATA PRIVACY CONTACT. CODEVISION ’s data privacy officer can be reached at the following address:
CODEVISION Inc.
Attn: Chief Privacy Officer
16163 Eugenie-Tessier Street
Montreal, Quebec, Canada, H1A 0A2
7. DATA SUBJECT RIGHTS – ACCESS, CORRECTION, RESTRICTION, AND DELETION. Taking into account the nature of the Processing, the PDF-VISION App provides functionality to assist Customer by appropriate technical and organizational measures, insofar as this is possible, to access, correct, amend, restrict, or delete Personal Data contained in PDF-VISION App to address requests by a Data Subject under the GDPR. To the extent Customer, in its use of CODEVISION App, is not familiar with PDF-VISION App functionality that may be used for these purposes, CODEVISION will provide Customer with additional Documentation or customer support assistance to educate the Customer on how to take such actions in a manner consistent with the functionality of PDF-VISION App and in accordance with the terms of the Agreement. If CODEVISION receives any request from any Data Subject to access, correct, restrict, or delete Personal Data, CODEVISION will advise such Data Subject to submit its request to Customer and Customer will be responsible for responding to any such request using the functionality of PDF-VISION App.
8. SUBPROCESSORS. CODEVISION may engage Subprocessors to provide parts of PDF-VISION App, subject to the restrictions of the Agreement and this DPA. CODEVISION will ensure that Subprocessors Process Personal Data only in accordance with the terms of this DPA and that Subprocessors are bound by written agreements that require them to provide at least the level of data protection required by this DPA. Before appointing any new Subprocessors, CODEVISION will inform Customer of the appointment (including the name and location of such Subprocessor and the activities it will perform) either by electronic mail, via PDF-VISION App, or by publication to a CODEVISION website provided to Customer prior to any appointment. Customer may object to CODEVISION’s appointment by giving written notice to CODEVISION within thirty (30) days of being informed by CODEVISION of such appointment, and if, within thirty (30) days of CODEVISION ’s receipt of Customer’s objection, CODEVISION fails to provide a commercially reasonable alternative to avoid the Processing of Personal Data by the appointed Subprocessor, Customer may, as its sole and exclusive remedy, terminate any PDF-VISION App services to which this DPA applies.
9. RETURN OR DISPOSAL. Prior to termination or expiration of the Agreement for any reason, Customer may retrieve Personal Data processed by PDF-VISION App in accordance with the terms of the Agreement, and at Customer’s request provided in writing to CODEVISION, CODEVISION will promptly return or delete Personal Data from PDF-VISION App, unless applicable law requires storage of the Personal Data.