This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", "Controller") and 4Mica ("4Mica", "Processor") for the use of 4Mica's services (the "Service"). It governs the processing of personal data that 4Mica carries out on the Customer's behalf and reflects the parties' commitments under applicable data-protection laws, including the GDPR where it applies.
If there is a conflict between this DPA and the Terms of Service, this DPA controls with respect to the processing of personal data.
Roles of the parties
For personal data processed on the Customer's behalf, the Customer is the Controller and 4Mica is the Processor. Each party is responsible for complying with the data-protection obligations that apply to its role.
Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", and "supervisory authority" have the meanings given to them in applicable data-protection law. "Subprocessor" means any processor engaged by 4Mica to process personal data.
Scope and details of processing
4Mica processes personal data only to provide, secure, and support the Service. The subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are determined by the Customer's use of the Service.
Customer instructions
4Mica processes personal data only on documented instructions from the Customer, including those set out in the Terms and this DPA, unless required to act otherwise by law. 4Mica will inform the Customer if, in its opinion, an instruction infringes applicable data-protection law.
Confidentiality
4Mica ensures that persons authorized to process personal data are bound by confidentiality obligations and process the data only as instructed.
Security measures
4Mica implements appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the state of the art and the risks involved.
Subprocessors
The Customer authorizes 4Mica to engage subprocessors to provide the Service. 4Mica imposes data-protection obligations on each subprocessor that are no less protective than those in this DPA and remains responsible for their performance. 4Mica will give the Customer notice of changes to subprocessors and an opportunity to object on reasonable data-protection grounds.
Data subject requests
Taking into account the nature of the processing, 4Mica assists the Customer, by appropriate measures, in responding to requests from data subjects to exercise their rights. If 4Mica receives such a request directly, it will refer the data subject to the Customer where required.
Personal data breaches
4Mica notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and provides information reasonably available to help the Customer meet its own notification obligations.
International transfers
Where personal data is transferred across borders, the parties rely on a valid transfer mechanism (such as Standard Contractual Clauses) as required by applicable law.
Audits
4Mica makes available information reasonably necessary to demonstrate compliance with this DPA and allows for audits, subject to reasonable confidentiality, security, and scheduling conditions.
Return and deletion of data
On termination of the Service, 4Mica deletes or returns personal data processed on the Customer's behalf, unless retention is required by law. Data recorded on a public blockchain cannot be deleted.
Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
Term
This DPA takes effect when the Customer begins using the Service and remains in force for as long as 4Mica processes personal data on the Customer's behalf.
Contact
For questions about this DPA or to exercise data-protection rights, contact us at mairon@4mica.xyz.