Adendo sobre o processamento internacional de dados

Este Adendo de Processamento de Dados, incluindo todos os Cronogramas anexos ("Adendo") com data de 1º de janeiro de 2023 ("Data de vigência do adendo") faz parte do contrato existente ou contemporâneo de bens e serviços ("Contrato”) between: Sycomp A Technology Company, Inc. ("Sycomp") e a empresa cliente ("Empresa") agindo em seu próprio nome e/ou como agente de suas Afiliadas corporativas ao aceitar este Adendo.

Company and Sycomp have entered into an Agreement pursuant to which Sycomp provides to Company certain software and SaaS licenses, professional services and hardware (referred to in this Addendum as the “Soluções"), oferecidos por fabricantes de equipamentos originais, licenciadores de software e SaaS e provedores de serviços terceirizados (os "Parceiros de revenda”). Sycomp collects and processes minimal Company Personal Data (defined below) as defined by Applicable (defined below) Laws in providing the Solutions. Where only the Resale Partners have access to information related to Company Personal Data, including, without limitation, information about Company customers, employees, officers, contractors, and agents, including without limitation, personal information/personal data as defined by Applicable Laws and Sycomp does not have access to and is not involved in the processing of Company Personal Data, Company acknowledges that its relationship with Resale Partners governs the processing of Company Personal Data under Applicable Laws and this Addendum does not apply.

Os termos usados neste Adendo terão os significados definidos neste Adendo. Os termos em letras maiúsculas não definidos de outra forma neste documento terão o significado dado a eles no Contrato. Exceto conforme modificado abaixo, os termos do Contrato permanecerão em pleno vigor e efeito.

As partes, por meio deste instrumento, concordam que os termos e condições estabelecidos abaixo devem ser adicionados como um Adendo ao Contrato.

1.              Termos globais

1.1 Definições.

1.1.1 "Afiliada” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with either Company or Sycomp respectively, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

1.1.2 "Leis aplicáveis" significa qualquer lei de privacidade ou segurança que se aplique aos Dados Pessoais da Empresa. Isso inclui (sem limitação) o Regulamento Geral de Proteção de Dados (UE 2016/679) ("GDPR"), a Diretiva sobre privacidade e comunicações eletrônicas (2002/58/EC), a Lei de Proteção de Dados do Reino Unido (DPA) e o GDPR do Reino Unido, a Lei Federal de Proteção de Dados da Suíça, a Lei de Privacidade do Consumidor da Califórnia de 2018, (Código Civil da Califórnia §§ 1798.100 et seq,) e a Lei de Direitos de Privacidade da Califórnia de 2020, a Lei de Proteção de Dados do Consumidor da Virgínia (Va. Code Ann. tit. 59.1, Ch. 53 et seq.), a Lei de Privacidade do Colorado (Colo. Rev. Stat. Ann. §§ 6-1-1302 et seq.), a Lei de Privacidade do Consumidor de Utah (Utah Code Ann. §§ 13-61-101 et seq.), qualquer outra legislação de privacidade estadual dos Estados Unidos de escopo semelhante aos estatutos mencionados acima e quaisquer regulamentos de implementação adotados (todos os quais podem ser alterados de tempos em tempos.

1.1.3 "Dados pessoais da empresa" means information that is processed by Sycomp, or collected by Sycomp, on behalf of Company which identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular identified or identifiable person or household.

1.1.4                "Titular dos dados" significa qualquer indivíduo ou família identificável incluído, ou previamente incluído, nos Dados Pessoais da Empresa.

1.1.5                "Violação de dados pessoais" significa a destruição, perda, alteração, divulgação ou acesso acidental, não autorizado ou ilegal aos Dados Pessoais da Empresa transmitidos, armazenados ou processados de outra forma. Caso qualquer outra definição de "violação", "violação de dados" ou "violação de dados pessoais" que apareça em qualquer Lei Aplicável seja mais ampla em escopo do que a definição fornecida aqui, a definição na referida Lei deverá prevalecer.

1.1.6                "Processo" significa qualquer operação ou conjunto de operações que são realizadas nos Dados Pessoais da Empresa.

1.1.7                "Processamento de registros" significa registros escritos completos, precisos e atualizados de todas as atividades de Processamento realizadas em nome da Empresa.

1.1.8                "Processador" means any entity that performs the Processing of Company Personal Data. For the purposes of this Agreement and Addendum, Sycomp and any authorized subcontractors are Processors.

1.1.9                "Regulador" refere-se a qualquer órgão governamental responsável pela aplicação das Leis Aplicáveis.

1.1.10              "Sell"/"Sale" (Venda) tem o significado que pode ser definido nas Leis Aplicáveis (por exemplo, a Lei de Privacidade do Consumidor da Califórnia de 2018). Por exemplo, e não a título de limitação, "Vender" pode significar vender, alugar, liberar, divulgar, disseminar, disponibilizar ou transferir as informações pessoais de um consumidor pela empresa para outra empresa ou para um terceiro em troca de dinheiro ou outra consideração valiosa.

1.1.11              "Compartilhar" tem o significado que pode ser definido nas Leis Aplicáveis (por exemplo, a Lei de Direitos de Privacidade da Califórnia de 2020). Por exemplo, e não a título de limitação, "Compartilhar" pode significar qualquer divulgação de Dados Pessoais da Empresa (alugar, liberar, divulgar, disseminar, disponibilizar, transferir ou de outra forma comunicar oralmente, por escrito ou por meios eletrônicos ou outros) a um terceiro para publicidade comportamental entre contextos.

1.1.12 "Subprocessador” means any Processor (including any third party and any Sycomp Affiliate) appointed by Sycomp to Process Company Personal Data. This includes (without limitation) entities that are defined as Service Providers subject to the California Consumer Privacy Act of 2018.

1.2            Autorização para processar dados.

1.2.1                The parties do not intend for Sycomp to process Company Personal Data in the ordinary course of performance of the Agreement. However, in the event that Sycomp Processes Company Personal Data Sycomp will do so in compliance with the terms of this Addendum.

1.2.2                Sycomp shall not Process Company Personal Data for any purpose other than those specified in the Agreement, this Addendum, or Company’s documented instructions.  Sycomp shall immediately inform the Company if, in its opinion, any processing instruction violates any Applicable Law.  Sycomp shall not access, retain, use, or disclose Company Personal Data for a commercial purpose other than as needed to provide the Solutions and perform services under the Agreement.

1.2.3                Cronograma 1 to this Addendum sets out certain information regarding Sycomp’s Processing of the Company Personal Data. Company may make reasonable amendments to Cronograma 1 by written notice to Sycomp from time to time.

1.3            Conformidade com as leis aplicáveis. Sycomp and Company each represents and warrant that they will comply with Applicable Laws, including all regulations that have been or are further enacted relating thereto, and other similar laws and regulations. Company represents that it has all rights necessary to provide Company Personal Data to Sycomp in connection with providing the Solutions.

1.4            Confidencialidade e segurança.

1.4.1                Sycomp shall implement and maintain appropriate technical and organizational measures in relation to the processing of Company Personal Data by Sycomp in compliance with Applicable Laws.  Specifically, Sycomp will during the Term of the Agreement maintain ISO/IEC 27001:2013 compliance and provide a certificate evidencing the foregoing upon request by Company.  Sycomp shall ensure that its agents and representatives processing Company Personal Data on behalf of Company have signed agreements requiring them to keep Company Personal Data confidential, and Sycomp shall take all reasonable steps to ensure that Sycomp representatives processing Company Personal Data receive adequate training on compliance with this Addendum and relevant laws.

1.5            Direitos do titular dos dados.

1.5.1                Sycomp shall assist Company in responding to complaints, communications, or requests by a Data Subject to exercise a right under Applicable Laws relating to the Company Personal Data maintained by Sycomp or its Subprocessors. This shall include, at minimum, that Sycomp and its Subprocessors maintain the ability to access, modify, remove from processing, or irrevocably delete or destroy, correct, transport (i.e. right to data portability), restrict or limit use of Sensitive Personal Information (as this phrase may be defined in Applicable Laws), or not to Sell or Share (as those terms may be defined in Applicable Laws) the data of an individual Data Subject when requested by Company (“Data Subject Request”).

1.5.2                Should Sycomp or any Subprocessor or other subcontractor directly perform any data collection from Data Subjects in connection with the Company’s instructions, Sycomp shall ensure that Data Subjects receive the Company’s Privacy Policy at or before the point at which any information is collected about the Data Subject.

1.5.3                Sycomp shall promptly notify Company if it receives a Data Subject Request.  If required by Applicable Laws, Sycomp will inform the Data Subject that Sycomp is a Service Provider or Processor (based on the Applicable Laws) and the Data Subject should contact the Company or appropriate Resale Partner.  Otherwise, Sycomp shall await instructions from Company concerning whether, and how to, respond to such a request.  Company shall provide Sycomp with current contact information to enable Sycomp to direct Data Subject Requests.

1.6            Violação de dados pessoais.

1.6.1                In the event of any actual or suspected access or acquisition of Company Personal Data by an unauthorized third party, Sycomp shall notify Company immediately of the potential Personal Data Breach without undue delay (but in no event later than 48 business hours after becoming aware of the potential Personal Data Breach) and provide Company, in writing or via email, without undue delay (wherever possible, within 10 business days of becoming aware of the potential Personal Data Breach) with such details as Company reasonably requires, recognizing that this may be supplemented as additional details are discovered over time.  In addition, Sycomp shall investigate and remediate the potential Personal Data Breach and, to the extent that a Personal Data Breach results in a legal obligation for Company or Sycomp to notify relevant authorities or affected Data Subjects or would put affected Data Subjects at risk, Sycomp shall provide the Company with assurances satisfactory to Company that a Personal Data Breach will not recur.  Sycomp warrants that if there has been a Personal Data Breach of Company Personal Data, all responsive steps will be documented and a post-incident review will be made of both the events and also remedial actions taken, if any, to prevent a recurrence.  Sycomp agrees to fully cooperate with Company in Company’s handling of the matter, including without limitation any investigation, reporting, or other obligations required by applicable law or regulation, including responding to regulatory inquiries or investigations, or as otherwise required by Company, and will work with Company to otherwise respond to and mitigate any damages caused by the Personal Data Breach.  Sycomp shall not notify any third party of the Personal Data Breach without Company’s prior, written authorization.

1.6.2                Sycomp shall, and shall require any Subprocessor to, co-operate with Company and each Company Affiliate and take such reasonable commercial steps to assist in the investigation, mitigation, and remediation of any such Personal Data Breach.

1.7            Exclusão ou devolução de dados pessoais da empresa. Sycomp shall, without delay, either securely delete or return any Company Personal Data to Company in hardcopy or electronic form at the Company’s written request. As soon as reasonably possible upon completion of the services anticipated by the Agreement, Sycomp shall securely delete all existing copies of Company Personal Data, in electronic and hard copy form, unless storage of any data is required by Applicable Laws or other relevant laws. In the event that Company Personal Data is stored on backup media, deletion of Company Personal Data will only be required when the backup media is used to restore Sycomp systems.

1.8            Avaliação do impacto da privacidade de dados e consulta prévia. Sycomp shall provide reasonable assistance to Company with any data protection impact assessments which are required under Applicable Law in relation to the Sycomp’s Processing of Company Personal Data.

1.9            Indenização.  Sycomp agrees that it shall reimburse and indemnify Company for all costs incurred in responding to and/or mitigating damages caused by a breach of this Addendum, including security breaches involving Company Personal Data maintained by Sycomp or its Subprocessors or any material breach by Sycomp of its data protection and privacy obligations under this Addendum.

1.10         Performance at Sycomp’s Sole Expense. Sycomp’s compliance with this Addendum, and any actions required of Sycomp to comply with Applicable Laws in connection with the Agreement, will be at Sycomp’s sole and exclusive expense and will not result in additional fees for Solutions (except as may already be set forth in the Agreement). Any actions required of Company to comply with Applicable Laws in connection with the Agreement, will be at Company’s sole and exclusive expense (except as may already be set forth in the Agreement).

1.11         Alterações a este Adendo. Sycomp may update the terms of this Addendum from time to time; provided, however, that Sycomp will not materially weaken the protections in this Addendum unless it provides at least 30 days prior written notice to Company, and the opportunity to cancel the Agreement within 7 days of receiving such notice if Company does not agree to the material changes.

1.12 Alterações nas Leis Aplicáveis. Caso quaisquer Leis Aplicáveis sofram alterações materiais em qualquer aspecto que comprometam a adequação deste Adendo em conformidade com quaisquer Leis Aplicáveis novas ou alteradas ("Novas leis"), a Empresa poderá propor alterações a este Adendo que considere razoavelmente necessárias para atender às exigências de quaisquer Novas Leis ("Alterações propostas”).  Both Sycomp and Company shall negotiate any Proposed Amendments in good faith, with Sycomp’s written consent not to be unreasonably withheld.

1.13         Termos gerais.  Any obligation imposed on Sycomp under this Addendum in relation to the Processing of Personal Data shall survive any termination or expiration of this Addendum for so long as Personal Data is Processed.  Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force.  The invalid or unenforceable provision shall be either: (a) amended as necessary to ensure its validity and enforceability, while preserving the intent of the provision as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein. Company and Sycomp expressly recognize and agree that this Addendum includes provisions addressed in other portions of the Agreement.  Company and Sycomp hereby agree that the terms and conditions set out herein shall be added as an Addendum to the Agreement.  This Addendum and the other portions of the Agreement shall be read together and construed, to the extent possible, to be in concert with each other.  In respect of any conflict between the Agreement and this Addendum, the provisions which provide the greatest protection of the Company Personal Data shall prevail; provided, however, that in no event shall this Addendum be deemed to eliminate, limit, or otherwise diminish Sycomp’s obligations or commitments to Company under portions of the Agreement.

2.              Termos internacionais. In the event that Company notifies Sycomp that the personal information of residents of the European Economic Area, Switzerland, the United Kingdom, Brazil, or other applicable jurisdiction outside the United States may be Processed pursuant to the Agreement, the provisions of this Section 2 shall apply to all parties and the Processing of Company Personal Data in connection with the provision of the Solutions.

2.1            Subprocessamento.

2.1.1                Company authorizes Sycomp to engage Subprocessors from the list presented in Schedule 1, Section C. below. Sycomp will inform Company of any addition of a Subprocessor to this list in writing. Upon receiving this notice, Company will have 30 days to object, on reasonable grounds, to the addition of a Subprocessor, where required by applicable law. In the event that Sycomp elects to engage a Subprocessor despite reasonable objection by Company, Company will have the right to terminate the Agreement pursuant to the Termination clause therein.

2.1.2                With respect to each Subprocessor, Sycomp shall:

2.1.2.1 realizar a devida diligência em cada Subprocessador para garantir que ele seja capaz de fornecer o nível de proteção para os Dados Pessoais da Empresa conforme exigido por este Adendo e fornecer evidências dessa devida diligência se solicitado por um órgão regulador;

2.1.2.2            enter into a binding written contract and include terms in the contract between Sycomp and each Subprocessor that are materially similar to the terms set out in this Addendum;

2.1.2.3 garantir que os subprocessadores aprovados tenham concordado em usar as informações somente para fins comerciais da Empresa e em conformidade com todas as Leis, regras e regulamentos aplicáveis e instruções da Empresa; e

2.1.2.4 permanecer totalmente responsável perante a Empresa pelas ações dos Subprocessadores em relação aos Dados Pessoais da Empresa.

2.2            Transferências internacionais de dados.  

2.2.1                Sycomp must have prior written consent or instruction from Company to transfer any Company Personal Data internationally or, in the case of Company Personal Data received from Company within the European Economic Area (“EEA”), Switzerland or United Kingdom (“UK”), to transfer such data outside the EEA or to any international organization (an “International Transfer”).  If Company consents to such an international transfer, Sycomp shall ensure that such transfer (and any onward transfer thereafter): (i) is pursuant to a written contract including adequate provisions relating to security and confidentiality of any Company Personal Data; (ii) is made pursuant to a legally enforceable mechanism for such cross-border data transfers of Company Personal Data under relevant laws (the form and content of which shall be subject to the Company’s written approval); (iii) is made in compliance with this Addendum; and (iv) otherwise complies with relevant privacy laws.  Unless the parties are able to avail themselves of an alternative transfer mechanism based on an adequacy mechanism approved by the EEA, Switzerland, and the UK (“Adequacy Mechanism”, e.g. a transfer mechanism based on Executive Order 14086 which is to facilitate the EU-US Data Privacy Framework between the United States and the European Union), the parties shall execute and annex to this Addendum as necessary approved Standard Contract Clauses (“SCCs”) or other legally acceptable contractual provisions to facilitate Company Personal Data transfers.

2.2.2                Território.

2.2.2.1            Espaço Econômico Europeu. Com relação à facilitação de transferências internacionais de Dados Pessoais da Empresa de residentes do EEE, considera-se que as partes executaram as CECs do EEE que estão incorporadas a este Adendo no Anexo 2.

2.2.2.2            Área Econômica Europeia e Reino Unido. Com relação à facilitação de transferências internacionais de Dados Pessoais da Empresa de residentes do EEE e residentes do Reino Unido, considera-se que as partes executaram as Cláusulas Contratuais Contratuais do EEE e o Adendo de Transferência Internacional de Dados do Reino Unido, que estão incorporados a este Adendo no Anexo 2 e no Anexo 3.

2.2.2.3            Somente no Reino Unido. Com relação à facilitação de transferências internacionais de Dados Pessoais da Empresa de residentes do Reino Unido ("Reino Unido") e nenhum Dado Pessoal da Empresa de residentes do EEE, considera-se que as partes assinaram o Contrato de Transferência Internacional de Dados do Reino Unido, que está incorporado a este Adendo no Anexo 4.

2.2.2.4            Brasil. Com relação à facilitação de transferências internacionais de Dados Pessoais da Empresa de residentes no Brasil, considera-se que as partes executaram e anexaram a este Contrato as SCCs do Brasil, se e quando disponíveis.

2.2.2.5 Em caso de conflito, esses anexos com as SCCs, o Acordo/Adendo Internacional de Transferência de Dados do Reino Unido ou outras disposições específicas terão precedência, quando aplicável, sobre os termos deste Adendo.

2.2.2.6 Para fins de quaisquer transferências de dados pessoais também sujeitas à Lei Federal de Proteção de Dados da Suíça de 19 de junho de 1992 ("FADP"): (i) o termo "estado-membro" não deve ser interpretado de forma a excluir os titulares de dados na Suíça da possibilidade de mover ações judiciais para fazer valer seus direitos em seu local de residência habitual, de acordo com a Cláusula 18(c) e (ii) as cláusulas também protegem os dados de pessoas jurídicas até a entrada em vigor da FADP revisada.

2.2.2.7 Caso as partes possam contar com um Mecanismo de Adequação para facilitar uma Transferência Internacional, as partes concordam que o mecanismo de transferência apropriado deverá ser esse Mecanismo de Adequação e não as Cláusulas Contratuais Padrão ou o Acordo/Adendo de Transferência Internacional de Dados do Reino Unido.

2.3            Registros relevantes e direitos de auditoria.

2.3.1                Sycomp shall maintain Processing Records, and shall make available to Company on request in a timely manner such information (including the Processing Records) as is reasonably required by Company to demonstrate Sycomp’s compliance with its obligations under Applicable Laws and this Addendum, which Company may disclose to regulatory authorities.  Processing Records shall contain, at a minimum, a description of all Company Personal Data Processed by Sycomp on behalf of Company, the type of Processing, the purposes of the Processing, a record of consent (if any), and any other information reasonably required by Company.

2.3.2                Sycomp shall provide reasonable additional assistance, information, and cooperation to Company at Company’s expense to comply with Company’s obligations under the Applicable Laws with respect to: (i) data security; (ii) data breach notification; (iii) responding to requests relating to Company Personal data and/or Company’s data privacy or security practices from regulators or individuals; and (iv) conducting data privacy impact assessments.  Sycomp shall implement and maintain appropriate technical and organizational measures to assist Company in the fulfilment of Company’s obligations to respond to Data Subjects’ requests relating to Company Personal Data.  This includes ensuring that all requests relating to Company Personal Data are recorded and then referred to Company within three (3) days of receipt of the request.  Sycomp shall otherwise cooperate with Company in Company’s efforts to monitor Sycomp’s compliance.

3.              Termos dos Estados Unidos. In the event that Company notifies Sycomp that the personal information of residents of the United States may be Processed pursuant to the Agreement, the provisions of this Section 3 shall apply to all parties and the Processing of Company Personal Data in connection with the provision of the Solutions.

3.1             Relacionamento das Partes. To the extent Sycomp processes Company Personal Data subject to the Data Protection Laws, Sycomp is a “Service Provider” as defined by the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020, a “Processor” as defined by the Virginia Consumer Data Protection Act and the Colorado Privacy Act, and any other term similar in meaning as those terms are understood pursuant to the Applicable Laws.

3.2            Finalidade do processamento dos dados pessoais da empresa. Any Company Personal Data that Sycomp receives, accesses, transfers, or collects in connection with the Solutions is done solely for the purpose of Sycomp delivering the Solutions, as described in greater detail in Schedule 5 below, and shall not constitute a Sale of such data and shall not otherwise be for any monetary or other consideration. Further, no Company Personal Data is shared for targeted or cross-contextual advertising purposes.

3.3            Sycomp Treatment of Company Personal Data. In the course of providing the Solutions to Company and in connection with Company User Information it receives, accesses, transfers, or collects in connection with the Solutions, Sycomp will:

3.3.1 não tomar nenhuma medida que possa fazer com que a Empresa não cumpra as Leis Aplicáveis ou outras leis de privacidade;

3.3.2 não coletar quaisquer Dados Pessoais da Empresa adicionais de qualquer Titular de Dados, exceto quando estritamente necessário para fornecer as Soluções à Empresa;

3.3.3 tratar todos os Dados Pessoais da Empresa como "Informações Confidenciais" de acordo com as disposições de confidencialidade do Contrato;

3.3.4 não tentar identificar ou reidentificar qualquer Titular de Dados e não associar nenhuma informação pessoal a qualquer Titular de Dados ou à atividade on-line de qualquer Titular de Dados, exceto quando estritamente necessário para fornecer as Soluções à Empresa;

3.3.5 não misturar os Dados Pessoais da Empresa com os dados de terceiros, exceto quando estritamente necessário para fornecer as Soluções à Empresa;

3.3.6 não vender, compartilhar ou licenciar a terceiros, em nenhuma circunstância, ou usar em benefício de terceiros, quaisquer Dados Pessoais da Empresa; e

3.3.7 notificar a Empresa imediatamente caso determine que não poderá mais cumprir suas obrigações de acordo com as Leis Aplicáveis.

3.4            Subcontratados. Should Sycomp engage any subcontractors who will Process Company Personal Data, Sycomp shall include terms in the contract between Sycomp and each subcontractor that are materially similar to the terms set out in this Addendum.

3.5            Registros relevantes e direitos de auditoria. Where required by Applicable Laws, and upon Company’s request, Sycomp shall make available to Company Personal Data reasonably necessary to demonstrate compliance with this Addendum and/or Applicable Laws.

3.6            Certificação. Sycomp certifies that it understands and will comply with the restrictions on the use of Company Personal Data in connection with providing the Solutions.