Data Processing Addendum

1. Roles

The Customer determines the purposes and means of processing Customer Data and is the controller (or equivalent, such as a “business” under the CCPA) of it. Retaiva processes Customer Data on the Customer’s behalf as a processor (or “service provider”). Where the Customer is itself a processor for another controller, Retaiva is its subprocessor, and the Customer is responsible for obtaining that controller’s authorizations. Each party will comply with Data Protection Law applicable to it.

2. Processing Details

• Subject matter and duration: provision of the Service for the term of the Customer’s subscription and any post-termination export period.
• Nature and purpose: hosting, storage, retrieval, display, transmission, backup and deletion of Customer Data to provide the Service.
• Data subjects: the Customer’s staff, retail customers, suppliers and, for Plus Pharma, patients and doctors.
• Personal data: names and contact details, transaction history, staff identifiers and, for Plus Pharma, dates of birth, allergy status, pharmacy notes, prescription and dispensing records and prescription documents.
• Special categories: health data recorded through Plus Pharma, protected by the measures in section 6.
• Frequency: continuous, while the Service is used.

3. Instructions

Retaiva will process Customer Data only on the Customer’s documented instructions, which are the Terms of Service, this DPA and the Customer’s use and configuration of the Service, unless required by law. Retaiva will tell the Customer if it believes an instruction breaches Data Protection Law, unless the law prohibits this, and may suspend the affected processing until the instruction is confirmed or changed.

4. Customer Responsibilities

The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis for it, giving every notice and obtaining every consent the law requires, the accuracy of Customer Data, and responding to individuals and regulators. The Customer will not instruct Retaiva to process personal data in breach of Data Protection Law.

5. Confidentiality

Retaiva will ensure that people authorized to process Customer Data are bound by confidentiality obligations and access it only as needed to provide, support or secure the Service.

6. Security

Retaiva will maintain appropriate technical and organizational measures, including those described on the Security page: encryption in transit and at rest, role-based access, logical separation of each business’s data, append-only audit records, backups, and restricted administrative access. Retaiva may update these measures provided the overall level of protection is not reduced. The Customer is responsible for configuring user access, protecting its devices and credentials, and using the security features provided.

7. Subprocessors

The Customer gives general authorization for Retaiva to use the subprocessors listed on the Subprocessors page. Retaiva will impose data protection obligations on each subprocessor at least as protective as this DPA and remains responsible for their performance. Retaiva will update the list and notify business owners before a new subprocessor processes Customer Data. The Customer may object on reasonable data protection grounds within 14 days of notice; if the parties cannot resolve the objection, the Customer may cancel the affected Service, which is its only remedy.

8. International Transfers

Customer Data is hosted by Amazon Web Services in the United States (region us-east-2, Ohio). The Customer acknowledges that Customer Data is transferred to and processed in the United States and in the countries where subprocessors operate, and is responsible for any notice or authorization required for that transfer under law applicable to it.

To the extent Customer Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA: Module Two where the Customer is a controller and Module Three where it is a processor, with the Customer as data exporter and Retaiva as data importer. Clause 7 does not apply; under Clause 9 option 2 (general authorization) applies, with notice as in section 7; the option in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland. Annex I is completed by section 2 and this DPA’s parties, Annex II by section 6, and Annex III by the Subprocessors page. The competent supervisory authority is determined under Clause 13.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, completed with the information above, and either party may end it as its Section 19 allows. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act and the Swiss Federal Data Protection and Information Commissioner as the competent authority. If the SCCs conflict with this DPA, the SCCs prevail.

9. CCPA Service Provider Terms

Where the CCPA applies, Retaiva will not sell or share Customer Data; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Customer; or combine it with personal information from other sources, except as the CCPA permits. Retaiva will comply with the CCPA, provide the same level of protection it requires, and notify the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate any unauthorized use of Customer Data.

10. Personal Data Incidents

Retaiva will notify the Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. The notice will describe what is known, the likely consequences and the measures taken or proposed, and will be updated as more is learned. Retaiva will cooperate with the Customer’s investigation and any notifications the Customer is required to make. Notice is not an acknowledgment of fault or liability. The Customer is responsible for notifying regulators and individuals where the law requires.

11. Requests from Individuals and Assistance

The Service provides tools for the Customer to access, correct, export, restrict and, where permitted, anonymize personal data, and the Customer is responsible for responding to requests from individuals. If Retaiva receives a request directly from an individual about Customer Data, it will refer the individual to the Customer and will not respond substantively unless required by law. Taking into account the nature of the processing, Retaiva will give reasonable assistance with requests the tools do not cover, and with data protection impact assessments and prior consultations, at the Customer’s reasonable cost where the assistance goes beyond the Service’s standard features.

12. Return and Deletion

The Customer can request an export of Customer Data at any time during the subscription and for 30 days after termination. Afterwards, Retaiva will delete Customer Data from active systems, and it will expire from backups in the ordinary backup cycle, unless retention is required by law or a legal hold applies. Records the Customer has marked for retention in the Service will not be deleted through ordinary deletion requests.

13. Information and Audits

Retaiva will make available information reasonably necessary to demonstrate compliance with this DPA, including a description of its security measures and subprocessors. Where that information is insufficient, or a regulator requires it, the Customer may request an audit no more than once in any 12 months, on at least 30 days’ notice, at its own cost, by an independent auditor bound by confidentiality, conducted in a way that does not disrupt the Service or compromise the security or confidentiality of other customers.

14. Liability

Each party’s liability arising out of or in connection with this DPA, including the SCCs where the law permits, is subject to the exclusions and limits of liability in the Terms of Service, and counts toward the aggregate limit there. Nothing in this DPA limits the rights of data subjects that the SCCs or Data Protection Law do not allow to be limited.

15. Term and Precedence

This DPA applies while Retaiva processes Customer Data. Obligations that by their nature continue, including confidentiality and deletion, survive termination. On data protection matters, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms of Service.