Table of contents
Table of contents

Reseller Data Processing Agreement

This personal Data Processing Agreement («DPA») contains personal data processing terms between SIA DeskTime («DeskTime») and any company, organization, institution or any person, which is a reseller («Reseller») in accordance with the DeskTime Reseller Program («Program») and for the purposes of resale of DeskTime software («Services»). This DPA forms part of the general Terms of the Program («Terms») and is incorporated into and subject to the Terms. DeskTime and Reseller shall each be referred to as «Party» and collectively as «Parties».

1. Definitions

  • «Data Protection Laws» means GDPR and laws implementing or supplementing the GDPR, to the extent applicable, the data protection or privacy laws of any other country;

  • «GDPR» means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

  • «Personal Data Breach» means a breach of security leading to the accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed (in each case as defined under the GDPR);

  • «Personal Data» means any information relating to a Data Subject (as defined under Data Protection Laws);

  • «Standard Contractual Clauses» means the Standard contractual clauses for data transfers between EU and non-EU countries as adopted by the European Commission;

  • «Sub-processor» shall mean any entity (including any third party, but excluding an employee of the Reseller) engaged by the Reseller to process Personal Data on the DeskTime's behalf;

  • «Third Countries» means all countries outside of the European Economic Area, excluding countries approved as providing adequate protection for Personal Data by the European Commission from time to time;

  • The terms «controller», «personal data», «processing», «processor» and «supervisory authority» shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

2. Roles

2.1The Parties agree and acknowledge that for the purposes of the Program and processing of Personal Data during the Program, DeskTime shall be considered a data controller, and the Reseller shall be considered a data processor.

2.2DeskTime confirms that this DPA contains sufficient instructions to the Reseller regarding the processing of Personal Data, as well as the scope and purposes thereof and therefore constitutes a binding data processing agreement in accordance with Data Protection Laws.

3. Processing of Personal Data

3.1The Reseller shall process Personal Data on behalf of DeskTime in a manner consistent with the terms set out in this DPA and to the extent necessary to provide the Services to DeskTime pursuant to the Terms.

3.2Parties undertake to comply with their obligations under the Data Protection Laws. Each Party is solely responsible for compliance with the Data Protection Laws that apply to it.

3.3The Reseller shall process Personal Data in a manner consistent with this DPA, the instructions of DeskTime, and/or to the extent necessary to provide the Services under the Terms and as further set out in Annex 1. For the avoidance of doubt, unless agreed in writing by the Parties, the Reseller shall not be permitted to process the Personal Data for its own purposes.

3.4If the Reseller cannot provide compliance with DeskTime's instructions for whatever reason (including if the instruction violates the Data Protection Laws), it agrees to inform DeskTime of its inability to comply as soon as reasonably practicable. Any failure by the Reseller to notify DeskTime shall not affect DeskTime's responsibility and liability for its instructions.

3.5In the event that the Reseller is located outside of the European Union (EU) or the European Economic Area (EEA) and processes Personal Data originating from the EU or EEA, the Parties acknowledge and agree that DeskTime may rely on the Standard Contractual Clauses for the transfer of personal data to processors established in third countries (Module two: transfer controller to processor), as set forth in Decision 2021/914/EU, or any successor instrument. The Parties hereby agree that the Standard Contractual Clauses, as referenced herein, shall be incorporated into this DPA by reference, and the Parties shall comply with their obligations therein.

4. Duties and obligations of DeskTime

4.1DeskTime is responsible for ensuring that the instructions provided to the Reseller in relation to processing of Personal Data comply with any applicable laws, including Data Protection Laws.

4.2DeskTime confirms that Personal Data transferred to the Reseller has been collected by DeskTime on a valid lawful basis and DeskTime has obtained any necessary consents, if required, or given any necessary notices as prescribed by the Data Protection Laws.

5. Duties and obligations of the Reseller

5.1The Reseller shall take appropriate organizational, technical and administrative measures to protect the confidentiality, integrity and availability of Personal Data. The set of these measures is further defined and set out in Annex 1 of this DPA.

5.2Parties acknowledge that the adequacy of the security measures mentioned in Annex 1 may change over time, and that an effective set of security measures demands frequent evaluation and improvement. The Reseller will therefore frequently evaluate, tighten, increase or improve such measures to ensure adequate protection of Personal Data.

5.3The Reseller shall take reasonable steps to ensure that access to Personal Data is strictly limited to those individuals who need to know or access the relevant Personal Data, as strictly necessary for the purposes of the Terms, ensuring that all such individuals are subject to strict confidentiality requirements or professional or statutory obligations of confidentiality. This obligation of confidentiality shall not be limited in time and will continue to apply regardless of whether the cooperation of the Parties is terminated.

6. Data subject requests and assistance to DeskTime

6.1The Reseller shall inform DeskTime in case it receives:

  • 6.1.1any requests from an individual with respect to Personal Data processed, including but not limited to requests for access and/or rectification, blocking, data portability and all similar requests;

  • 6.1.2any complaint relating to the processing of Personal Data, including allegations that the processing infringes on a Data Subject's rights under Data Protection Law; or

  • 6.1.3any order, demand, warrant, or any other document purporting to compel the production of Personal Data under applicable law.

6.2The Reseller shall immediately notify DeskTime in case it receives any of the above, unless specifically prohibited by applicable laws. The Reseller shall not respond to any of the above unless expressly authorized to do so by DeskTime or as obligated under applicable law or a court order.

6.3The Reseller shall cooperate with and assist DeskTime with respect to any action taken relating to such request, complaint, order or other document as described under Clause 6.1 above. As far as reasonably possible and taking into account the nature of the processing, the information available to the Reseller, the Reseller will implement appropriate technical and organisational measures to provide DeskTime with such cooperation and assistance.

6.4The Reseller shall provide DeskTime with reasonable assistance with regards to:

  • 6.4.1ensuring compliance with DeskTime's obligations pursuant to Data Protection Laws;

  • 6.4.2making available to DeskTime all reasonable information necessary to demonstrate compliance with Data Protection Laws; and

  • 6.4.3performing the necessary data protection impact assessments and prior consultation procedures as mentioned in Articles 35 and 36 of GDPR.

7. Personal Data Breach

7.1In case of a Personal Data Breach, the Reseller shall notify DeskTime without undue delay and not later than 48 hours after becoming aware of a Personal Data Breach. When notifying DeskTime, the Reseller shall provide:

  • 7.1.1Description of the nature of the Personal Data Breach including, where possible, the categories and number of Data Subjects;

  • 7.1.2Name and contact details of the Reseller's data protection officer or other point of contact where more information can be obtained;

  • 7.1.3Description of the likely consequences of the Personal Data Breach;

  • 7.1.4Description of the measures taken or proposed to be taken by the Reseller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

7.2Where it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.

7.3The Reseller will promptly take any necessary and appropriate actions to investigate, mitigate and remediate any effects of a Personal Data Breach, and provide assistance to DeskTime to ensure that DeskTime can comply with its obligations under Data Protection Laws it may be subject to in relation to the Personal Data Breach.

8. Audit rights

8.1Upon DeskTime's written request, Reseller shall provide sufficient information to demonstrate compliance with obligations laid down in this DPA and Data Protection Laws. This information shall be provided to the extent that such information is within the Reseller's control and the Reseller is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.

8.2If information provided by the Reseller in DeskTime's reasonable judgement is not sufficient to demonstrate the Reseller's compliance with this DPA, the Reseller agrees to allow for and contribute to data processing audits, provided that any such audit does not involve the review of any third-party data and that the records and information access in connection with such audit are treated as confidential information.

8.3Such audits are allowed to be carried out by DeskTime or auditors and agents authorized by DeskTime. DeskTime shall bear the costs of any such audit.

8.4Such audit may be performed by DeskTime at the time mutually agreed by the Parties, within 2 (two) weeks as of the moment DeskTime has requested such audit in writing. DeskTime may request such audit once a year or more often, if the Reseller has suffered a Personal Data Breach that has affected DeskTime's Personal Data. The audit shall be performed during the standard working hours of the Reseller, without disturbing the Reseller's business activities.

9. Personal Data sharing with third parties

9.1The Reseller may continue to use those Sub-processors already engaged by the Reseller as at the date of this DPA, subject to the following requirements:

  • 9.1.1the Reseller has carried out an adequate due diligence to ensure that the Sub-processor is capable of providing sufficient level of protection for Personal Data;

  • 9.1.2the Reseller has ensured that the arrangement between the Reseller and the relevant Sub-processor is governed by a written contract including terms which offer at least the same level of protection for Personal Data as those set out in this DPA and meet the requirements of Article 28(3) of the GDPR. If requested by DeskTime, the Reseller shall be able to provide to DeskTime for review copies of such agreements with Sub-processors, which may be redacted to remove confidential commercial information not relevant to the requirements of this DPA.

9.2If the Sub-processor is unable to fulfil its duties in accordance with the data processing agreement referred to in Clause 9.1.2., the Reseller shall remain fully liable to DeskTime for the Sub-processor's duties and activities. The Reseller shall be liable for any consequences of the Sub-Processor's activities in connection with the processing of Personal Data.

9.3The Reseller shall notify DeskTime 30 days prior to any intended changes in the Sub-processors, providing DeskTime the possibility to reasonably object to such changes. If DeskTime objects to the changes, the Reseller shall not engage the proposed Sub-processor until reasonable steps have been taken to address the objections raised by DeskTime and DeskTime has been provided with written notice of such steps. If the objections of DeskTime are not addressed, the Reseller shall allow DeskTime to terminate cooperation according to the Terms. DeskTime shall not be liable under the Terms or applicable law for any termination by DeskTime under this Clause.

9.4Subject to the requirements of Clause 9, DeskTime agrees that the Reseller may appoint a Sub-processor located in a Third Country, provided that it ensures that such data transfer and processing takes place in accordance with the requirements of the Data Protection Laws. DeskTime grants the Reseller a mandate to execute the Standard Contractual Clauses with the processing details set out in this DPA applying for the purposes of Appendix 1 and Appendix 2 of the Standard Contractual Clauses, with any relevant subcontractor or affiliates it appoints on behalf of DeskTime.

10. Liability

10.1Each Party is liable for damages incurred by the other Party which are caused directly by a Party's breach of the commitments made in this DPA, subject to the limitations and exclusions of liability agreed in the Terms.

10.2The Reseller shall not be liable, and DeskTime shall indemnify and hold harmless the Reseller for any claim or complaint from a Data Subject regarding any action by the Reseller as a result of direct instructions received from DeskTime.

10.3The Reseller shall be liable for any damage and/or loss caused to the Data Subject and/or DeskTime (including any administrative fines applicable to DeskTime for the activities of the Reseller), if the Reseller has breached the applicable Data Protection Laws, Terms, this DPA or DeskTime's instructions in relation to the processing of Personal Data. The Reseller shall reimburse and mitigate the damages and losses caused to the Data Subjects and/or DeskTime.

11. Term, termination and deletion of Personal Data

11.1This DPA shall take effect as of the signing of this DPA and continue in full force and effect as long as the Terms are in force, until all Personal Data is returned to DeskTime or deleted in accordance with the provisions of this DPA or applicable Data Protections Laws, after which this DPA will automatically simultaneously terminate, with the exception of the clauses which by their nature should continue to remain in full force and effect.

11.2Upon termination of this DPA, the Reseller shall promptly and not later than within 15 days of the date of termination of the Terms, delete or return to DeskTime all copies of Personal Data. DeskTime acknowledges that the Reseller may choose to use anonymization measures, rather than delete certain Personal Data, given that such anonymization is irreversible. The Reseller shall confirm the deletion or return of Personal Data in response to such request in writing.

12. Miscellaneous

12.1This DPA and all non-contractual or other obligations arising out of or in connection with, including the Standard Contractual Clauses, are governed by the laws of Republic of Latvia.

12.2Nothing in this DPA reduces the Reseller's obligations under the Terms in relation to the protection of Personal Data or permits the Reseller to process (or permit the processing of) Personal Data in a manner which is prohibited by the Terms. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

12.3This DPA shall form an integral part of the Terms. In the event of any inconsistency arising between the provisions of this DPA and the Terms, the provisions of this DPA shall prevail.

12.4If any provision of this DPA is held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall be enforced.

12.5Any disputes and conflicts that may arise during the term of this DPA shall be resolved by the Parties through mutual negotiations. Disputes and disagreements for which no agreement has been reached shall be resolved in accordance with the applicable laws of Republic of Latvia.

Annex 1: Details of Personal Data Processing

a)Categories of data subjects – individuals or representatives of legal entities, which have expressed their interest to use DeskTime services

b)Categories of Personal Data – name, surname, e-mail address, phone number

c)Sensitive data – not applicable

d)Frequency of transfer – continuous basis as per the Terms

e)Nature and purpose of the processing – processing of information during Program

f)Retention period of Personal Data – Personal Data shall be retained only during the Program as per Terms and instructions of DeskTime

g)Competent supervisory authority – Datu valsts inspekcija (State Data Inspectorate) of Republic of Latvia

Technical and organisational measures to ensure the security of Personal Data

Examples of possible measures:

  • Measures of pseudonymisation and encryption of personal data

  • Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

  • Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

  • Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

  • Measures for user identification and authorisation

  • Measures for the protection of data during transmission

  • Measures for the protection of data during storage

  • Measures for ensuring physical security of locations at which personal data are processed

  • Measures for ensuring events logging

  • Measures for ensuring system configuration, including default configuration

  • Measures for internal IT and IT security governance and management

  • Measures for certification/assurance of processes and products

  • Measures for ensuring data minimisation

  • Measures for ensuring data quality

  • Measures for ensuring limited data retention

  • Measures for ensuring accountability

  • Measures for allowing data portability and ensuring erasure

  • Enabling multi-factor authentication where possible

Effective as of October 7, 2023.

Download PDF