Data Processing Agreement
Version 1.0 Effective January 2026 Contact security@roziesynopsis.com
Overview
This Data Processing Agreement (“DPA”) sets out the terms on which R Synopsis, Inc. (the “Supplier”) processes personal data on behalf of its customers (each a “Customer”) in providing the Synopsis services. It applies to, and forms part of, the agreement under which the Supplier provides the Services to the Customer (the “Principal Agreement”), and may be updated from time to time.
This DPA applies to the Supplier on its own behalf and on behalf of each Supplier Affiliate. The terms of the Principal Agreement otherwise remain in full force and effect. Except where the context requires otherwise, references to the Principal Agreement include this DPA.
1. Definitions
1.1 In this DPA, the following words and phrases will have the following meanings:
Customer: The customer entity that has entered into the Principal Agreement with the Supplier.
Customer Affiliate: An entity that owns or controls, is owned or controlled by or is under common control or ownership with the Customer, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.
Data Protection Law: All applicable laws protecting the fundamental rights and freedoms of individuals in relation to their personal data and right to privacy as applicable to the Supplier (and its Supplier Affiliates), the Customer and/or the Services, including (without limitation):
(a) the Data Protection Act 2018, UK GDPR and the GDPR as applicable to the processing;
(b) any laws which implement any such laws;
(c) any laws that replace, extend, re-enact, consolidate or amend any of the foregoing; and
(d) all guidance, guidelines, codes of practice and codes of conduct issued by any relevant Data Protection Supervisory Authority relating to such Data Protection Laws (in each case whether or not legally binding).
Data Protection Supervisory Authority: Any regulator, authority or body responsible for administering Data Protection Laws, including any supervisory authority as defined in the GDPR or UK GDPR.
EU Personal Data: Personal data to which Data Protection Law of the European Union, or of a Member State of the European Union or European Economic Area, was applicable prior to its processing by the Supplier.
GDPR: The EU’s General Data Protection Regulation (2016/679), and references to an ‘Article’ refer to an article of the GDPR.
Protected Area:
(i) in the case of EU Personal Data, the member states of the European Union and the European Economic Area and any country, territory, sector or international organisation in respect of which an adequacy decision under Art. 45 GDPR is in force; and
(ii) in the case of UK Personal Data, the United Kingdom and any country, territory, sector or international organisation in respect of which an adequacy decision under United Kingdom adequacy regulations is in force.
Protected Data: Personal data received from or on behalf of the Customer or otherwise obtained in connection with the performance of the Supplier’s (and, where applicable, its Supplier Affiliates’) obligations under the Principal Agreement.
Services: The services being provided by the Supplier to the Customer pursuant to the Principal Agreement, as amended, replaced or superseded from time to time.
Standard Contractual Clauses:
(i) In respect of EU Personal Data, the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, including the text from the module(s) as selected in Annex 1 but not including any clauses marked as optional, and where for the purposes of: (the “EU Standard Contractual Clauses”);
(a) Clause 9 option (a) (where module 2 or 3 is applicable): specific authorisation for sub-processors shall apply and the parties agree that the time period for submitting requests for authorisation shall be 30 days;
(b) Clause 17 (Governing law): the clauses shall be governed by the laws of the Member State where the data exporter is established, provided this allows for third-party beneficiary rights;
(c) Clause 18 (Choice of forum and jurisdiction): the courts of the Member State where the data exporter is established shall have jurisdiction;
(d) Annex I shall be completed as set out in Annex 1;
(e) Annex II, details of technical and organisational measures, shall be as set out in Annex 2; and
(f) Annex III, details of approved sub-processors, shall be as set out in Annex 3
(the “EU Standard Contractual Clauses”);
(i) In respect of UK Personal Data, the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner and laid before Parliament in accordance with s.119A of the Data Protection Act 2018 on 2 February 2022 but, as permitted by clause 17 of such Addendum, the parties agree to change the format of the information set out in Part 1 of the Addendum so that:
(a) the details of the parties in table 1 shall be as set out in Annex 1;
(b) for the purposes of table 2, the addendum shall be appended to the EU Standard Contractual Clauses as defined above (including the selection of modules and options and the disapplication of optional clauses as noted above); and
(c) the appendix information listed in table 3 is set out in Annexes 1, 2 and 3.
Sub-Processor: Any agent, subcontractor or other third party engaged by the Supplier and its Supplier Affiliates (or by any other Sub-Processor) for carrying out any processing activities in respect of the Protected Data.
Supplier: R Synopsis, Inc.
Supplier Affiliate: An entity that owns or controls, is owned or controlled by or is under common control or ownership with the Supplier, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.
UK GDPR: Has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
UK Personal Data: Personal data to which Data Protection Law of the United Kingdom was applicable prior to its processing by the Supplier.
1.2 The Supplier’s (and its Supplier Affiliates’) obligations and the Customer’s (and its Customer Affiliates’) rights and remedies under this DPA are cumulative with, and additional to, any other provisions of the Principal Agreement.
1.3 In the event of any conflict between the terms of the Principal Agreement and this DPA, the terms of this DPA shall prevail. In the event of any conflict between the terms of the Principal Agreement or this DPA with the terms of the Standard Contractual Clauses, where applicable between the parties, the terms of the Standard Contractual Clauses shall prevail.
1.4 The terms ‘personal data’, ‘data subject’, ‘processor’, ‘process’, ‘processing’, ‘processed’, ‘processes’, ‘controller’, ‘personal data breach’, ‘pseudonymisation’ and ‘special categories of data’ have the meanings set out in applicable Data Protection Laws from time to time.
2. General
2.1 The parties agree that the Customer is a controller and that the Supplier (and where applicable each of its Supplier Affiliates) is a processor for the purposes of processing Protected Data pursuant to this DPA.
2.2 The Supplier shall, and shall ensure that its Supplier Affiliates, Sub-Processors and each of their personnel shall, only process Protected Data on the Customer’s documented instructions and in full compliance with the Principal Agreement, this DPA and any obligations imposed by Data Protection Law and shall not by any act or omission cause the Customer (or any other person) to be in breach of Data Protection Law.
2.3 Information relating to the nature of the processing to be carried out by the Supplier (and where applicable each of its Supplier Affiliates) is as set out at Annex 1 to this DPA.
2.4 The Supplier and each of its Supplier Affiliates shall indemnify and keep indemnified the Customer and each of its Customer Affiliates (and their respective officers, employees and other representatives) against all losses, claims, damages, liabilities, fines, interest, penalties, costs, charges, sanctions, expenses, compensation paid to data subjects (including compensation to protect goodwill and ex gratia payments), demands and legal and other professional costs (calculated on a full indemnity basis and in each case whether or not arising from any investigation by, or imposed by, a Data Protection Supervisory Authority) arising out of or in connection with any breach by the Supplier or its Supplier Affiliates of their obligations under this DPA.
2.5 Taking into account the nature of the processing and the information available to it, the Supplier and each of its Supplier Affiliates shall provide the Customer with such information and assistance as the Customer reasonably requires in order to:
2.5.1 carry out any relevant privacy impact assessment (under Article 35);
2.5.2 consult with a Data Protection Supervisory Authority prior to processing (under Article 36); and/or
2.5.3 meet any obligations under Data Protection Law which derive from the activities described in paragraphs 2.5.1 and 2.5.2.
3. Security
3.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as risks to the rights and freedoms of natural persons, the Supplier and each of its Supplier Affiliates shall in relation to the Protected Data implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to those risks including (without limitation) the following (as appropriate):
3.1.1 the pseudonymisation and encryption of personal data;
3.1.2 preserving the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3.1.3 preserving the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
3.1.4 a process for regularly testing, assessing and evaluating the effectiveness of those security measures;
and in any event shall adopt measures no less protective than those set out in Annex 2.
3.2 In assessing the appropriate level of security to be taken under paragraph 3.1, the Supplier and each of its Supplier Affiliates will in particular take account of the risks from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Protected Data transmitted, stored or otherwise processed by or on behalf of the Supplier and each of its Supplier Affiliates.
3.3 The Supplier and each of its Supplier Affiliates will ensure that those of its personnel with access to Protected Data are made aware of their data protection and security obligations and do not process Protected Data except in accordance with the Customer’s instructions or the Principal Agreement.
4. Sub-processing
4.1 The Supplier and each of its Supplier Affiliates shall not engage a Sub-Processor without the Customer’s prior and specific written authorisation. The Customer acknowledges that the Supplier may utilise the Sub-Processors listed in Annex 3.
4.2 If the Supplier (or any Supplier Affiliate or Sub-Processor) engages any processor to carry out specific processing activities on behalf of the Customer (and the Customer agrees to such engagement of such Sub-Processor), the Supplier and each of its Supplier Affiliates will procure that such processor:
4.2.1 only does so on the same terms imposed under this DPA (and where applicable the Principal Agreement);
4.2.2 is informed of the confidential nature of the Protected Data and that they must not disclose Protected Data and is subject to a binding and enforceable written contractual obligation to keep the Protected Data confidential; and
4.2.3 provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR (including the requirements relating to security, integrity and confidentiality),
and the Supplier and each of its Supplier Affiliates shall remain fully liable to the Customer for all of the actions and omissions of the Sub-Processors, including (without limitation) the obligations set out in this paragraph 4.2, as if they were their own.
5. Requests from data subjects and supervisory authorities
5.1 If a data subject makes a request relating to the exercise of his or her legal rights under Data Protection Law, the Supplier and/or each of its Supplier Affiliates shall immediately refer such request to the Customer and shall (at no cost to the Customer) provide the Customer with any assistance reasonably required by the Customer, including (without limitation) reasonable assistance required by the Customer in order to:
5.1.1 respond to a subject access request;
5.1.2 erase personal data in accordance with the data subject’s right to erasure;
5.1.3 allow the data subject to exercise his or her right to restrict processing;
5.1.4 notify any persons who have received personal data about any rectification, erasure or restriction of processing which has taken place at the request of a data subject;
5.1.5 provide the data subject with a copy of his or her data in a structured and common electronic format; or
5.1.6 give effect to the data subject’s rights (under Articles 21 and 22) to object to profiling, automated decision-making and to cease processing for direct marketing purposes.
5.2 The Supplier and each of its Supplier Affiliates shall not respond to any data subject request or any complaint relating to the Protected Data without the Customer’s prior written approval.
5.3 Any information and assistance the Supplier and/or each of its Supplier Affiliates provides under paragraph 5.1 of this DPA will be given without undue delay and in such time as the Customer reasonably requires in order for it to comply with its obligations under Data Protection Law.
6. Personal data breaches and notification
6.1 If the Supplier and/or any of its Supplier Affiliates becomes aware of a personal data breach relating to Protected Data, the Supplier and/or each of its Supplier Affiliates shall:
6.1.1 notify the Customer as soon as reasonably practicable upon becoming aware of the breach, describing the nature of the personal data breach, including where possible:
(a) the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the Supplier’s contact from whom more information can be obtained;
(c) to the extent possible, details of the likely consequences of the personal data breach; and
(d) measures the Supplier and each of its Supplier Affiliates has taken or proposes to take to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effect;
6.1.2 provide the Customer with such information and assistance as it reasonably requires in relation to the personal data breach (including in relation to action to remedy or mitigate the breach); and
6.1.3 document the personal data breach and any related action taken by the Supplier and each of its Supplier Affiliates.
7. Deletion and return of data
7.1 After completing the processing of Protected Data, the Supplier and each of its Supplier Affiliates shall (unless otherwise requested by the Customer to return such data) delete all Protected Data in accordance with applicable laws.
7.2 The Supplier and each of its Supplier Affiliates shall ensure that if any Protected Data is deleted, destroyed or otherwise disposed of, such disposal takes place in a secure manner such that the Protected Data is not recoverable.
8. Records, audits and inspections
8.1 The Supplier and each of its Supplier Affiliates shall maintain complete, accurate and up to date written records of all categories of processing activities carried out on behalf of the Customer as set out in this DPA, comprising:
8.1.1 the names, contact details and (where applicable) data protection officer details for the Supplier, its Supplier Affiliates and any Sub-Processors appointed in accordance with this DPA;
8.1.2 the categories of processing carried out on behalf of the Customer as currently defined in Annex 1;
8.1.3 where applicable (and subject to the Customer’s prior consent in accordance with paragraph 9.1), details of transfers of personal data to a third country or an international organisation, including details of that country or organisation and the documentation of suitable safeguards;
8.1.4 a description of the technical and organisational security measures referred to in paragraph 3.1 of this DPA; and
8.1.5 such other information referred to in Articles 30(1) and 30(2) of the GDPR and as the Customer may require from time to time.
The Supplier and each of its Supplier Affiliates shall make copies of such records available to the Customer promptly upon request.
8.2 The Supplier and each of its Supplier Affiliates shall promptly make available to the Customer such information as is required to demonstrate the Supplier’s (and each of its Supplier Affiliates’) and the Customer’s compliance with their respective obligations under this DPA and Data Protection Law, and allow for, permit and contribute to audits, including inspections, by the Customer (or another auditor mandated by the Customer) for this purpose at the Customer’s request from time to time. The Supplier and each of its Supplier Affiliates shall provide (or procure) access to all relevant premises, systems, personnel and records during normal business hours for the purposes of each such audit or inspection upon reasonable prior notice and provide and procure all further reasonable co-operation, access and assistance in relation to any such audit or inspection.
9. International transfers
9.1 The Supplier and each of its Supplier Affiliates will not transfer Protected Data to any country, territory or location outside the Protected Area unless the Customer has consented to the transfer.
9.2 In the event that the Customer consents to the transfer of Protected Data outside of the Protected Area in reliance upon the Standard Contractual Clauses, the parties shall comply with their respective obligations set out in the Standard Contractual Clauses as though they were set out in full in this DPA, and the Standard Contractual Clauses shall be deemed incorporated into this DPA with effect from the date the transfer commences.
9.3 In the event that any valid adequacy method under applicable Data Protection Law on which the Customer has relied under this DPA to ensure that a data transfer is lawful is held to be invalid, or that any supervisory authority requires transfers of personal data made pursuant to such a decision to be suspended, the Customer may, at its discretion, require the Supplier to cease processing the applicable personal data and to facilitate the use of an alternative data transfer mechanism or safeguard including, as necessary, amendment to this DPA.
10. Other terms
10.1 This DPA shall survive the termination or expiry of the Principal Agreement for any reason.
10.2 The Customer may, at any time on not less than 30 days’ notice to the Supplier, revise this DPA and/or the Principal Agreement to the extent they relate to the processing of Protected Data by replacing the relevant provisions with:
10.2.1 any applicable data controller to data processor standard clauses (as referred to in Articles 28(7) or 28(8) of the GDPR or under any similar or equivalent United Kingdom laws) and/or any similar or equivalent standard clauses issued by any Data Protection Supervisory Authority for similar purposes; and/or
10.2.2 any terms forming part of or required for compliance with any approved code(s) of conduct and/or approved certification mechanism(s) (as referred to in Articles 28(5), 40 and/or 42 of the GDPR or under any similar or equivalent United Kingdom laws) and/or any similar or equivalent code, mechanism or scheme.
10.3 Subject to paragraph 10.4, the Supplier and each of its Supplier Affiliates shall keep confidential and shall not disclose to any other person the Protected Data except as expressly permitted under this DPA. The Supplier and each of its Supplier Affiliates may disclose Protected Data to its employees, contractors, officers and other representatives and Sub-Processors on a need-to-know basis and only to the extent necessary for the purposes of the Principal Agreement and this DPA and in each case only to the extent such disclosure does not conflict with any other provisions of the Principal Agreement and this DPA. To the extent the Supplier and/or each of its Supplier Affiliates is permitted to disclose any Protected Data to any of its employees, contractors, officers or other representatives or Sub-Processors, it shall (without prejudice to any other obligation under this DPA) do so under conditions of confidentiality substantially the same as in this paragraph 10.3 and shall remain fully liable to the Customer for all of the actions and omissions of such recipients, as if they were their own.
10.4 Paragraph 10.3 shall not apply to information that is required to be disclosed in accordance with applicable laws, in which case the Supplier and each of its Supplier Affiliates shall, where practicable and not prohibited by applicable laws, notify the Customer of any such requirement before such disclosure.
10.5 This DPA together with the Principal Agreement constitutes the entire agreement between the parties and supersedes all previous agreements, understandings and arrangements between them in respect of its subject matter, whether in writing or oral.
10.6 Each party acknowledges that it has not relied on, and shall have no remedies in respect of, any representation or warranty that is not expressly set out in this DPA or the Principal Agreement.
10.7 Nothing in this DPA (nor the Principal Agreement) shall limit or exclude any liability for fraud.
10.8 This DPA and any dispute or claim arising out of, or in connection with it, its subject matter or formation (including non-contractual disputes or claims) shall be governed by, and construed in accordance with, the laws of England and Wales.
10.9 The parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this DPA, its subject matter or formation (including non-contractual disputes or claims).
Annex 1: Details of processing of the Customer’s personal data
This Annex 1 includes certain details of the processing of the Customer’s personal data as required by Article 28(3) GDPR.
Annex 2: Security measures
In regard to Synopsis for Exhibitors, Customer Clients must implement their own security measures within their CRM environments, including ensuring secure data storage, access controls, and incident management procedures.