Data Processing Agreement

Subject Matter

Provision of the Services and related support by the Services Provider to Feedzai.

Nature and Purpose of the Processing

Services Provider will process Personal Data submitted, stored, sent or received by Feedzai via the Services for the purposes of providing the Services and related technical support to Feedzai in accordance with the Services Agreement, this DPA and any additional instructions provided by Feedzai.

Categories of Data

Feedzai may submit Personal Data to the Services Provider, the extent of which is determined and controlled by Feedzai in its sole discretion, and which may include, as applicable, but is not limited to the following categories of Personal Data:

• Identification data (name).
• Contact details (such as postal address, phone number and e-mail).
• Professional data (such as job title and name of the company).
• Contract data (information regarding the Feedzai customer’s order).
• Usage data (such as data about the customer’s device and how such device interact with Feedzai and Feedzai’s services).
• Location data (such as location derived from the IP address or data that indicates where that Feedzai or Feedzai customers’ is located with less precision, such as at a city or postal code level).
• Content data (such as the content of Feedzai and Feedzai’s customers files and communications).
• Credentials (such as passwords, account login, passwords hints and similar security information used for authentication).

Data Subjects

Personal data submitted, stored, sent or received via the Services may concern one or more of the following categories of data subjects:

• End users of Controller’s platform authorized by Controller to use the Services (who are natural persons).
• Employees, agents, advisors, contractors of Controller (who are natural persons).
• Employees or representatives of Controller’s customers, business partners and services providers (who are natural persons).
• Customers, business partners and services providers of Controller (who are natural persons).
• Any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.

In case FEEDZAI is an EU/EEA entity (or otherwise subject to the GDPR) and the processor an entity outside the EU/EEA the model of SCC Clauses (standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council) found in https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en

UK SCCs: https://ico.org.uk/media/for-organisations/documents/2620100/uk-sccs-c-p-202107.docx

Definitions 

“Feedzai Data” means any data or information in any form or medium provided by or on behalf of Feedzai to the Supplier or which the Supplier is required to process as part of the Services under the Agreement including without limitation any Personal Data.

“Good Industry Practice” means in relation to any undertaking and any circumstances, the exercise of that degree of professionalism, skill, diligence, prudence and foresight which would reasonably and ordinarily be expected from a skilled and experienced person or an internationally recognised company engaged in the same type of activity under the same or similar circumstance.

“Malware” shall mean any software, computer program, code or programming instructions intentionally constructed with the ability to damage, adversely alter, adversely interfere with or otherwise adversely affect, computer programs, data files, equipment, software or operation of computer systems, including the Bank Systems or Supplier Systems, or any other computer program code typically designated to be a ‘virus’, ‘worm’, ‘trojan,’, ’ransomware’, ‘time or logic bomb’, ‘disabling code’, ‘authorisation key’, ‘license control utility’ or ‘software lock’ or ‘routine key-logger’, ‘sniffer’, ‘backdoor’ or similar.

“Security Incident” means an operational, security or cyber incident as a result of an event, or series of unplanned linked events, that have or are likely to have an adverse impact on the integrity, availability, confidentiality and/or authenticity of: (i) the Services being provided to Feedzai; or (ii) Feedzai Data, including Data Incidents.

“Sub-Contractor” means those persons, or organizations, to whom the Supplier, pursuant to the provisions of this Agreement, is permitted to sub-contract some or all of its activities under this Agreement.

Documented Instructions and Technical and Organizational Measures

The Supplier shall implement appropriate technical and organizational measures to ensure a level of security adequate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of the data subjects. These measures shall ensure full compliance with Article 32 of the GDPR. Following is a description of some of the core technical and organizational security measures implemented by the Supplier as of the date of signature.

1.     General Security Procedures
   1.1 Supplier shall be responsible for establishing and maintaining an information security program that is designed to: (i) protect the security and confidentiality of Feedzai Data; (ii) protect against anticipated threats or hazards to the security or integrity of the Feedzai Data; (iii) protect against unauthorized access to or use of the Feedzai Data; (iv) ensure the proper disposal of Feedzai Data, as further defined herein; and, (v) ensure that all employees and Sub-Contractors of Supplier, if any, comply with all of the foregoing. Supplier shall designate an individual to be responsible for the information security program. Such individuals shall respond to Feedzai inquiries regarding computer security and to be responsible for notifying Feedzai-designated contact(s) if a breach or an incident occurs, as further described herein.1.2 Supplier shall maintain and enforce security policies, standards and processes designed to secure Feedzai Data and other data to which Supplier is provided access, and update such policies, standards and processes from time to time consistent with industry standards.
   1.3 Supplier shall provide formal privacy and security awareness training for all personnel and contractors, in line with Good Industry Practices, as soon as reasonably practicable after the time of hiring and prior to being appointed to work on Feedzai Data and annually recertified thereafter. Documentation of security awareness training shall be retained by Supplier, confirming that this training and subsequent annual recertification process have been completed.
   1.4 Supplier shall conduct employee screening checks for all employees and contractors as soon as reasonably practicable after the time of hiring and prior to being appointed or granted access to work on Feedzai Data. These shall be performed within the limits of the local laws, regulations and ethics and shall be proportional to the business requirement.
   1.5 Feedzai shall have the right to review an overview of Supplier’s information security program prior to the commencement of Service and annually thereafter upon Feedzai request.
   1.6 Supplier shall not transmit any unencrypted Feedzai Data over the internet or any unsecured network, and shall not store any Feedzai Data on any mobile computing device, such as a laptop computer, USB drive or portable data device, except where there is a business necessity and then only if the mobile computing device is protected by industry-standard encryption software. Supplier shall encrypt Feedzai Data in transit into and out of the Services over public networks using industry standard protocols.
   1.7 Supplier may be required to obtain and maintain the following compliance standards and reporting documents prior to, or during the provision of Services: (i) ISO/IEC 27001; (ii) PCI DSS (Payment Card Industry Data Security Standard); and (ii) SOC 2 Type II.
   1.8 The Supplier shall ensure that its Sub-Contractors comply with standards no less rigorous than those set out in the Agreement and shall: (i) document and maintain details of the security and cyber resilience arrangements of any Sub-Contractor used in the performance of the Supplier’s obligations in providing the Services; and (ii) promptly disclose (unless it evidences to Feedzai that its subject to a confidentiality undertaking) such documentation as Feedzai may request regarding its Sub-Contractors security arrangements including up to date penetration testing reports.
   1.9 Prior to the provision of Services to Feedzai, the Supplier will provide Feedzai with written notice detailing all of the Sub-Contractors it proposes to use in the provision of the Services. Supplier will notify Feedzai in writing at least thirty (30) days in advance regarding (i) a proposed addition or removal of a Sub-Contractor; or (ii) any changes to the information provided in the Sub-Contractor List. Feedzai will evaluate proposed new Sub-Contractors and notify Supplier of any objections. Supplier will not allow such Sub-Contractor to access any Feedzai Data until the objection is resolved.
2.     Network and Communications Security
   2.1 All Supplier connectivity to Feedzai computing systems and/or networks and all attempts at the same shall be only through Feedzai’s security gateways/firewalls and only through Feedzai-approved security procedures.
   2.2 Supplier shall not access, and will not permit unauthorized persons or entities to access Feedzai computing systems and/or networks without Feedzai’s express written authorization and any such actual or attempted access shall be consistent with any such authorization.
   2.3 Supplier shall take appropriate measures to ensure that Supplier’s systems connecting to Feedzai’s systems and anything provided to Feedzai through such systems does not contain any computer code, programs, mechanisms or programming devices designed to, or that would enable, the disruption, modification, deletion, damage, deactivation, disabling, harm or otherwise be an impediment, in any manner, to the operation of Feedzai’s systems.
   2.4 Supplier shall maintain technical and organizational measures for data protection in line with Good Industry Practice including: (i) firewalls and threat detections systems to identify malicious connection attempts, to block spam, viruses and unauthorized intrusion; (ii) physical networking technology designed to resist attacks by malicious users or malicious code; (iii) encrypted data in transit over public networks using industry standard protocols; and (iv) segregation of networks to prevent the exposure of Feedzai data and to limit the impact in the event of a compromise.
3. Feedzai Data Handling Procedures
   3.1 Disposal of Feedzai Data on paper shall be done in a secure manner, to include shredders or secure shredding bins within the Supplier’s premises from which Feedzai Data is handled or accessed (“Feedzai Work Area”). Shredding must take place within the Feedzai Work Area before disposal or transit outside of the Feedzai Work Area or be performed offsite by a reputable third party under contract with Supplier.
   3.2 All electronic storage media containing Feedzai Data must be wiped or degaussed for physical destruction or disposal, in a manner meeting forensic industry standards such as the NIST SP 800-88 Guidelines for Media Sanitization, prior to departing Feedzai Work Area(s). Supplier shall maintain commercially reasonable documented evidence of data erasure and destruction for infrastructure level resources. This evidence must be available for review at the request of the Feedzai.
   3.3 Supplier shall maintain authorization and authentication technologies and processes to ensure that only authorized persons access Feedzai Data, including: (i) granting access rights on the basis of the need-to-know and least privilege principles; (ii) reviewing and maintaining records of employees who have been authorized or who can grant, alter or cancel authorized access to systems; (iii) requiring personalized, individual access accounts to use passwords that meet complexity, length and duration requirements; (iv) storing passwords in a manner that makes them undecipherable if used incorrectly or recovered in isolation; (v) encrypting, logging and auditing all access sessions to systems containing Feedzai Data; (vi) instructing employees on safe administration methods when computers may be unattended such as use of password protected screen savers and session time limits; (vii) reviewing and recertifying access for all users and applications or systems supporting the Services on a quarterly basis. The Supplier must provide recertification information to Feedzai on request or at least annually; and (viii) ensuring that segregation of duties is in place and preventing any toxic combination of roles.
   3.4 Supplier shall maintain logical controls to segregate Feedzai Data from other data, including the data of other customers.
   3.5 Supplier shall maintain measures to provide for separate processing of data for different purposes including: (i) provisioning Feedzai within its own application-level security domain, which creates logical separation and isolation of security principles between customers; and (ii) isolating test or development environments from live or production environments.
4. Physical Security
   4.1 All backup and archival media containing Feedzai Data must be contained in secure, environmentally controlled storage areas owned, operated, or contracted for by Supplier. All backup and archival media containing Feedzai Data must be encrypted.
   4.2 Technical and organizational measures to control access to data center premises and facilities which contain Feedzai Data are in place and include: (i) staffed reception desks or security officers to restrict access to identified, authorized individuals; (ii) visitor screening on arrival to verify identity; (iii) all access doors, including equipment cages, secured with automatic door locking systems with access control systems that record and retain access histories; (iv) monitoring and recording of all areas using CCTV digital camera coverage, motion detecting alarm systems and detailed surveillance and audit logs; (v) intruder alarms present on all external emergency doors with one-way internal exit doors; and (vi) segregation of shipping and receiving areas with equipment checks upon arrival.
   4.3 Supplier shall maintain measures to protect against accidental destruction or loss of Feedzai Data including: (i) fire detection and suppression, including a multi-zoned, dry-pipe, double-interlock, pre-action fire suppression system and a Very Early Smoke Detection and Alarm (VESDA); (ii) redundant on-site electricity generators with adequate supply of generator fuel and contracts with multiple fuel providers; (iii) heating, ventilation, and air conditioning (HVAC) systems that provide stable airflow, temperature and humidity, with minimum N+1 redundancy for all major equipment and N+2 redundancy for chillers and thermal energy storage; and (iv) physical systems used for the storage and transport of data utilizing fault tolerant designs with multiple levels of redundancy.
   4.4 Supplier shall regularly review physical access rights ensuring that they are immediately revoked when no longer required. The Supplier shall have a process to remove physical access to their premises for any Supplier Employees or Sub-Contractors who have left their employment. Supplier and its Sub-Contractors shall have robust visitor management processes in place to ensure all visitors are logged and supervised. Visitor logs shall be retained for at least 3 months.
5. Devices
   5.1 For devices and applications used in the provision of the Services, the Supplier must: (i) define an acceptable usage policy aligned to Good Industry Practice; (ii) implement geo-location monitoring for connecting devices and all unexpected alerts must be reviewed promptly; (iii) define and implement security configurations for all managed devices that reflect Good Industry Practice (iv) ensure that that Feedzai Data will not be compromised through the loss, theft or use of devices used to store and access Feedzai Data; (v) ensure that all devices used to access Feedzai Data, services (or systems that could impact the security of Feedzai Data or services) verify the identity of the user prior to use; (vi) ensure that managed devices are secure through the installation of regular security updates for all applications and security products; (vii) ensure that all software installed on devices used in the provision of services to Feedzai must be taken from a trusted source; (viii) implement processes for identifying vulnerabilities within managed devices and applications to ensure they are reported, assessed and remediated in timescales appropriate to the level of risk; (ix) ensure that devices are only able to connect to networks which are deemed to be secure or, where the risk is unknown, suitable controls must be implemented to prevent the compromise of devices and connections; (x) ensure that devices used to store Feedzai Data are securely wiped or destroyed when a device is re-provisioned, repurposed, lost or retired; (xi) ensure that no new software, tools or equipment is installed on systems that could materially impact the Services without the Feedzai’s prior written approval; and (xii) ensure devices are adequate and have the minimum specifications to support the provisioning of the Services.
   5.2 Supplier must ensure that all assets have controls in place to mitigate the threat of Malware or other forms of malicious code. The Supplier must ensure that: (a) all assets considered vulnerable to Malware or for which a specific threat exists must have anti-Malware controls in place; (b) anti-Malware controls are managed in such a way that allows for their verification and to remain updated; (c) anti-Malware controls local to an in scope asset must integrate with further controls used for management and communication; (d) where anti-Malware scanning is not capable of producing a definitive answer, additional controls must be implemented to determine safe handling; (e) the capability to both detect and identify Malware must be used, with detected Malware deleted and suspected Malware quarantined within a safe environment for further investigation; and (f) ingress and egress paths to assets must be protected against Malware, including but not limited to, any email, web and file transfer paths.
   5.3 Supplier must ensure that access to the internet or other non-managed networks is monitored and controlled to protect both assets and users from malicious and inappropriate activities.
   5.4 Supplier must ensure that all technology is implemented, maintained and managed in a manner that ensures security updates and patches can be applied.
6. Security Testing
   6.1 During the performance of services under the Agreement, the Supplier shall engage, at its own expense and at least one time per year, a third-party vendor (“Testing Company”) that follows Good Industry Practice to perform penetration and vulnerability testing with respect to Supplier’s systems processing and/or storing Feedzai Data.
   6.2 Security testing activities carried out in accordance with this Agreement shall be to identify design and/or functionality weaknesses in Supplier’s systems processing and/or storing Feedzai Data, which could expose such systems and the data therein to risks from malicious activities. At a minimum, the following security vulnerabilities should be tested: invalidated or un-sanitized input; broken or excessive access controls; broken authentication and session management; cross-site scripting (XSS) flaws; buffer overflows; injection flaws; improper error handling; insecure storage; common denial of service vulnerabilities; insecure or inconsistent configuration management; improper use of SSL/TLS; proper use of encryption; and anti-virus reliability and testing.6.3 Supplier shall provide Feedzai, upon request, an executive summary report of such any tests carried out, including a description of any significant risks identified and an overview of the remediation effort(s) undertaken to address such risks, and attest to Feedzai the date of the most recent security and vulnerability assessment.6.4 On the occurrence of a critical security issue being identified during a particular penetration or vulnerability testing activity, the Supplier shall subsequently engage, at its own expense, the Testing Company to perform additional testing and provide assurance on the resolution of identified security issues. Results thereof shall be made available to Feedzai upon request.6.5 Feedzai will have the right to carry out security penetration and vulnerability testing itself in order to assess the effectiveness of the Supplier’s cyber and information technology security measures if: (i) Supplier fails to have security penetration and vulnerability testing carried out in accordance with this Agreement; and (ii) Feedzai has notified the Supplier of this failure and such failure has not been remediated within 15 days.
7. Security Audits
   7.1 In addition to the information contained in this Schedule, the Agreement, and in clause 4.2 of the DPA, the Supplier shall, and shall procure that any Sub-Contractor on request, make available to Feedzai information necessary to demonstrate compliance with this Schedule.7.2 Feedzai reserves the right to inspect the Supplier premises and any aspect of the security arrangements and processes relating to the Supplier’s and/or its Sub-Contractors’ provision of the Services (including the Supplier’s and/or its Sub-Contractors’ security environment, arrangements, policies, training arrangements for staff and processes used in the performance of the Services) (“Security Audits”) once in each 12 month period during the term of the Agreement. Where the Supplier has performed independent reviews of Sub-Contractors and is able to share these findings, these will be taken into consideration during the Security Audit.7.3 Feedzai shall also have the right to conduct additional Security Audits in the following circumstances: (a) if Feedzai considers it necessary to do so as a result of changes to the Services and where deemed necessary to satisfy Applicable Law or local or national regulation; (b) if following an actual or potential Security Incident it becomes aware of any actual or potential threat; (c) if a Security Audit reveals a deficiency related to the Supplier or any Sub-Contractor; and (d) if Feedzai acting reasonably believes that the Supplier has failed to provide the Services in accordance with the security measures and obligations imposed on the Supplier under this Security Schedule and the Agreement.7.4 During a Security Audit the Supplier shall make available to Feedzai, at the request of Feedzai, access to any Supplier computer systems where Feedzai Data is hosted and access to any Supplier employees to assist in any Security Audit and the Supplier will cooperate fully with any investigation relating to their operations.7.5 Supplier shall procure that any Sub-Contractor allows Feedzai to perform any audits in relation to the provision of the Services to Feedzai, which might include access to its premises by Feedzai or an auditor mandated for this purpose. Feedzai shall give the Supplier reasonable notice of any audit or inspection to be conducted under this Section and ensure that each of its mandated auditors use its best efforts to avoid causing any damage, injury or disruption to the Supplier premises, equipment, Personnel, data, and business while its Personnel and/or its auditor’s Personnel (if applicable) are on those premises in the course of any on-premise inspection.
8. Anonymisation and Pseudonymisation of Personal Data
   8.1 When possible, the Supplier should ensure that data is anonymised or pseudonymised before data processing operations.
   8.2 When pseudonymising data, the key for reverting the process should be protected and stored in an adequate manner and according to industry standards.
   8.3 Anonymisation should be preferred to pseudonymisation.
   8.4 The Supplier should guarantee the anonymisation is not reversible, in accordance with the technological state of the art.
9. Incident Management and Reporting
   9.1 The Supplier and, where appropriate, its Sub-Contractors shall, during the provision of the Services, maintain effective incident management processes and procedures that allow identifying any events resulting in the apparent or actual theft or loss, or the unauthorized use, alteration or disclosure of any Feedzai data and that may, therefore, constitute a Security Incident or Data Incident.
   9.2 On the occurrence of a Security Incident or Data Incident, the Supplier shall immediately commence all reasonable efforts to investigate and correct the causes and remediate the results thereof, and within 1 (one) hour following confirmation of any such event, provide Feedzai notice thereof, and such further information and assistance as may be reasonably requested.
   9.3 Where and in so far as it is not possible to provide all the relevant information, the Supplier shall remain responsible to provide updated information of any remediation actions or mitigation steps taken in follow-up of the Security Incident or Data Incident, and provide reasonable assurance of resolution of discovered issues.
   9.4 The Supplier may not release or publish, or by any means disclose, any filing, communication, notice, press conference or report concerning any Security Incident or Data Incident without Feedzai´s prior authorization.
   9.5 Supplier shall take all steps necessary to prevent a similar Security Incident occurring in the future, where appropriate, supporting Feedzai’s recovery process via all reasonable means (whether the Security Incident relates to data or financial loss).
   9.6 Supplier shall provide relevant findings from any internal investigations or root cause investigations, or take all reasonable steps necessary to provide any assistance to any investigation that Feedzai or a third party (appointed by Feedzai) requires.
10. Other Technical and Organizational Measures
    10.1 A Data Protection Officer should be appointed when the applicable legislation or good practices requires it.
    10.2 When available for the Supplier’s industry, the Supplier should acquire/adhere to Codes of Conduct and/or independent Certification regarding the processing of Personal Data and in accordance with the GDPR.
    10.3 The Supplier should keep itself updated of any developments to legislation, case-law or opinions from supervisory authorities regarding subjects that are relevant for the provision of services and inform the Feedzai if it considers that any of the above may have an impact on the services the Supplier provides.