This Data Processing Agreement (this “DPA”) forms part of, and is incorporated by reference into, the Judge.me Terms of Service available at judge.me/terms (the “Terms”) between Judge.me Ltd (company number 12157706), c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB (“Judge.me”, “we”, “us” or “our”) and the Merchant that has accepted the Terms (the “Merchant”, “you” or “your”). Each is a “party” and together the “parties”.

This DPA applies where and to the extent that we process Personal Data on your behalf in connection with the Service. It takes effect when you accept the Terms or first use the Service and continues for as long as we process Personal Data on your behalf. This DPA replaces and supersedes any previous data processing addendum or agreement between the parties in respect of such processing.

Capitalised terms used but not defined in this DPA have the meanings given in the Terms.

1. Definitions and interpretation

1.1  In this DPA:

(a)  “Applicable Data Protection Laws” means all laws and regulations relating to the processing of Personal Data and privacy that apply to a party, including (where applicable) the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), the EU GDPR and applicable ePrivacy laws, in each case as amended, superseded or replaced from time to time.

(b)  “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “processing” and “Sub-processor” have the meanings given in the Applicable Data Protection Laws.

(c)  “Merchant Personal Data” means any Personal Data that you provide to us, or make accessible to us (including via Shopify), or that we otherwise process on your behalf in connection with the Service.

(d)  “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

(e)  “Restricted Transfer” means a transfer of Merchant Personal Data to, or access to it from, a country or recipient that is not covered by adequacy regulations or equivalent adequacy findings under the Applicable Data Protection Laws.

1.2  This DPA is in addition to, and does not relieve either party of, its obligations under Applicable Data Protection Laws. In the event of any conflict between this DPA and the Terms in respect of the processing of Personal Data, this DPA prevails.

2. Roles and scope of processing

2.1  The parties acknowledge that, in respect of the Merchant Personal Data, you are the Controller and we are the Processor. Where you are yourself a processor acting on behalf of a third party controller, you warrant that you are authorised to appoint us as a Sub-processor on the terms of this DPA.

2.2  The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

2.3  We will process the Merchant Personal Data only on your documented instructions (including as set out in this DPA, the Terms and your configuration and use of the Service), unless required to do otherwise by law applicable to us, in which case we will (where legally permitted) inform you of that requirement before processing.

2.4  We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Laws, although we are not obliged to monitor or assess the lawfulness of the Merchant Personal Data or of your instructions.

2.5  To the extent that we process Personal Data as a controller (for example, for our own billing and account administration, security and fraud prevention, compliance with our legal obligations, and the creation and use of aggregated and anonymised data as described in the Terms and our Privacy Policy), we do so as a controller in our own right and this DPA does not apply to that processing.

3. Merchant obligations and warranties

3.1  You are responsible for the lawfulness of the Merchant Personal Data and of the instructions you give us. You warrant and undertake, on a continuing basis, that:

(a)  you will only import, upload, provide or give us access to a database or Merchant Personal Data in respect of which you have provided all required privacy notices and obtained all consents, and otherwise have a valid lawful basis, required under Applicable Data Protection Laws for the processing contemplated by this DPA and the Service;

(b)  your instructions to us will comply with Applicable Data Protection Laws; and

(c)  you have the right to transfer, and to authorise our processing of, the Merchant Personal Data in accordance with this DPA and the Terms.

4. Judge.me obligations

We will:

(a)  process the Merchant Personal Data only as set out in clause 2.3;

(b)  ensure that persons authorised to process the Merchant Personal Data are subject to an appropriate duty of confidentiality;

(c)  implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of Article 32 of the UK GDPR, as set out in Annex 2;

(d)  taking into account the nature of the processing, provide reasonable assistance to you (so far as possible, and at your cost for material or non-routine assistance) by appropriate technical and organisational measures, insofar as possible, to enable you to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws;

(e)  provide reasonable assistance to you (at your cost for material or non-routine assistance) with your obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to us;

(f)  on termination of the provision of the relevant Service, and at your choice, delete or return the Merchant Personal Data (and delete existing copies) unless we are required by law to retain it;

(g)  make available to you information reasonably necessary to demonstrate compliance with this clause and, subject to clause 6, allow for and contribute to audits;

(h)  promptly notify you if we receive a request from a Data Subject to exercise their rights in respect of the Merchant Personal Data, and not respond to that request ourselves except on your documented instructions or as required by law;

(i)  promptly notify you of any complaint, notice or communication from a supervisory authority which relates to the processing of the Merchant Personal Data, and provide reasonable cooperation and assistance in relation to it; and

(j)  maintain, in accordance with Article 30(2) of the UK GDPR, written records of the categories of processing carried out on your behalf.

5. Sub-processors

5.1  You give us general authorisation to appoint Sub-processors to process the Merchant Personal Data, including our hosting, infrastructure, platform and other service providers (such as Shopify). A current list of Sub-processors is set out in, or made available via, Annex 3.

5.2  We will impose data protection obligations on each Sub-processor that are materially no less protective than those in this DPA, and we will remain responsible to you for each Sub-processor’s performance of its obligations. We will give you reasonable notice of any intended addition or replacement of a Sub-processor and give you the opportunity to object on reasonable data protection grounds. If you object, the parties will work together in good faith to resolve the matter and, failing resolution, you may terminate the affected part of the Service.

6. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior written notice (and no more than once in any 12-month period unless required by a supervisory authority or following a Personal Data Breach), allow you or your mandated auditor to conduct an audit, subject to reasonable confidentiality and security requirements and during business hours so as to minimise disruption. We may satisfy this obligation by providing relevant third-party certifications or audit reports.

7. Personal Data Breach

We will notify you without undue delay after becoming aware of a Personal Data Breach affecting the Merchant Personal Data, and will provide you with information reasonably available to us to enable you to meet your obligations under Applicable Data Protection Laws, including, to the extent then available to us, the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed to be taken to address it. We will take all reasonable steps to mitigate the effects of, and to minimise any damage resulting from, the Personal Data Breach. Our notification is not an acknowledgement of fault or liability.

8. International transfers

We may transfer the Merchant Personal Data to, or access it from, countries outside the UK (and, where applicable, the EEA), provided that we ensure an appropriate safeguard recognised under Applicable Data Protection Laws is in place, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, or a transfer to a jurisdiction subject to adequacy regulations. To the extent required, the parties are deemed to have entered into such clauses in respect of Restricted Transfers under this DPA.

9. Liability

Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms. Nothing in this DPA excludes or limits either party’s liability to the extent it cannot be excluded or limited under Applicable Data Protection Laws or other applicable law.

10. Term, termination and general

10.1  This DPA takes effect and continues as set out above and terminates automatically on termination or expiry of the Terms, save for provisions which by their nature survive (including clauses 9 and 10).

10.2  We may amend this DPA from time to time in accordance with the ‘Changes’ provisions of the Terms, and/or where required to reflect changes in Applicable Data Protection Laws.

10.3  If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions continue in full force and effect.

11. Governing law and jurisdiction

This DPA and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation are governed by, and construed in accordance with, the law of England and Wales. The parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales.

Annex 1 – Details of the Processing

Subject matter: the provision of the Service by Judge.me to the Merchant under the Terms.

Duration: for the duration of the Terms and for so long as Judge.me processes Merchant Personal Data, plus any period required by law.

Nature and purpose of processing: hosting, storage, organisation, retrieval, transmission and other processing necessary to provide the Service, including: downloading contact databases made available by the Merchant and sending marketing and promotional emails to contacts at the Merchant’s request via Judge.me Email; collecting, hosting, displaying and managing reviews and related content; sending review requests and other communications that the Merchant configures; and providing related analytics, deliverability and support functions, in each case across the features of the Service that the Merchant chooses to use.

Types of Personal Data: contact and identity data of the Merchant’s customers and contacts (such as name and email address), and any other Personal Data contained in databases the Merchant makes available or otherwise submitted through the Service.

Categories of Data Subjects: the Merchant’s customers, prospective customers, contacts and other individuals whose Personal Data the Merchant makes available for use with the Service.

Annex 2 – Security Measures

Judge.me maintains a comprehensive documented security program that is based on industry standard security framework ISO 27001 (the “Security Program”). Pursuant to the Security Program, Judge.me implements and maintains administrative, physical, and technical security measures to protect the Services and the security and confidentiality of Merchant Personal Data (the “Security Measures”).

Judge.me regularly tests and evaluates its Security Program and may review and update these Security Measures at any time without notice, provided that such updates are equivalent (or enhance) security and do not materially diminish the level of protection afforded to Merchant Personal Data by these Security Measures.

1.  DEPLOYMENT MODEL

1.1.  Architecture. Judge.me is a software-as-a-service offering.

1.2.  Data Storage

1.2.1.  Merchant Personal Data Storage Location

1.2.1.1.  Most Merchant Personal Data is stored in servers located within the US.

2.  JUDGE.ME’ AUDITS & CERTIFICATIONS.

Judge.me plans to use independent third-party auditors to assess the Judge.me Security Program, as described in the following audits, regulatory standards, and certifications:

2.1.  SOC 2 Type II

2.2.  ISO 27001

To the extent that Judge.me chooses not to continue adherence with one or more of the standards noted above, Judge.me will adopt or maintain an equivalent, industry-standard framework.

3.  ADMINISTRATIVE CONTROLS

3.1.  Governance. Judge.me’s CTO leads the Judge.me Security Program and develops, reviews, and approves (together with other relevant internal stakeholders) Judge.me’s security policies and procedures.

3.2.  Change Management. Judge.me maintains a documented change management policy, reviewed at least annually.

3.3.  Policies and Procedures. Judge.me implements a formal Security Program in order to protect the confidentiality, integrity, authenticity, and availability of Judge.me's data and information systems, and to ensure the effectiveness of security controls over data and information systems that support operations.

3.4.  Monitoring & Logging. Judge.me employs monitoring and logging technology to help detect and prevent unauthorised access attempts to its network and equipment.

3.5.  Access Review. Active users with privileged access to Judge.me’s internal version of the platform are reviewed at least quarterly and are promptly removed upon termination of employment. As part of the personnel offboarding process, all accesses are revoked and data assets are securely wiped.

3.6.  Third Party Risk Management. Judge.me maintains a comprehensive third-party risk management program that assesses the security compliance of applicable third parties, including vendors and sub-processors, in order to appropriately measure and manage risk.

3.7.  Personnel Training. Personnel receive training on the Security Policies upon hire and refresher training annually. Personnel are required to certify and agree to the Security Policies and personnel who violate the Security Policies are subject to disciplinary action, including warnings, suspension and up to (and including) termination.

3.8.  Personnel Screening and Evaluation. All personnel undergo background checks prior to onboarding (as permitted by local law), which may include, but are not limited to, criminal record checks, employment history verification and education verification. Judge.me uses a third-party provider to conduct screenings, which vary by jurisdiction and comply with applicable local law. Personnel are required to sign confidentiality agreements.

4.  PHYSICAL AND ENVIRONMENTAL CONTROLS

4.1.  Judge.me Corporate Offices. Judge.me has implemented administrative, physical, and technical safeguards for its software development and support centers. These include, but are not limited to, the below:

4.1.1.  Visitors are required to sign in and be escorted by Judge.me personnel while on premises.

4.1.2.  Physical entry points to office premises are recorded by CCTV and have an access card or biometric verification system at every door, allowing only authorized employees to enter the office premises.

4.1.3.  Equipment and other Judge.me-issued assets are inventoried and tracked.

4.1.4.  Office Wi-Fi networks are protected with encryption, and network access control.

4.2.  Cloud Service Provider Data Centers. Judge.me regularly reviews cloud service provider audits conducted in compliance with ISO 27001 and SOC 2. Judge.me’s cloud providers follow top world-class security and reliability standards.

5.  SYSTEMS & NETWORK SECURITY

5.1.  Platform Controls

5.1.1.  Isolation. Judge.me leverages multiple layers of network security controls, including network-level isolation, for separation between the Judge.me’ development and production environments.

5.1.2.  Firewalls & Security Groups. Firewalls are implemented as network access control lists or security groups within Judge.me’s production environment.

5.1.3.  Hardening

5.1.3.1.  Judge.me employs industry standards to harden images and operating systems under its control that are deployed within the Platform Services, including deploying baseline images with hardened security configuration such as disabled remote root login, isolation of user code, and images are regularly updated and refreshed.

5.1.4.  Encryption

5.1.4.1.  Encryption of data-in-transit. Merchant Personal Data is encrypted using cryptographically secure protocols in transit.

5.1.4.2.  Encryption of data-at-rest. Merchant Personal Data is encrypted using cryptographically secure protocols (AES-256 bit, or the equivalent or better) while at rest within the Judge.me system.

5.1.5.  Monitoring & Logging

5.1.5.1.  Intrusion Detection Systems. Judge.me leverages security capabilities provided natively by cloud service providers for security detection.

5.1.5.2.  Audit Logs.

5.1.5.2.1.  Generation. Judge.me generates audit logs from Merchant’s use of the services. The logs are designed to store information about material events within the platform.

5.1.5.2.2.  Integrity. Judge.me stores audit logs in a manner designed to protect the audit logs from tampering.

5.1.5.2.3.  Retention. Judge.me stores audit logs for at least one year.

5.1.6.  Vulnerability Management & Remediation. Judge.me regularly runs authenticated scans against representative hosts in the SDLC pipeline to identify vulnerabilities and emerging security threats that may impact the Platform Services. Judge.me will use commercially reasonable efforts to address “Critical” vulnerabilities within 180 days, measured from, with respect to publicly declared third party vulnerabilities, the date of availability of a compatible, vendor supplied patch, or for internal vulnerabilities, from the date such vulnerability is confirmed.

5.2.  CORPORATE CONTROLS.

5.2.1.  Access Controls

5.2.1.1.  Authentication. Judge.me personnel are authenticated through single sign-on (SSO), 802.1x (or similar) where applicable, and use a unique user ID and password combination and multi-factor authentication. Privileges are consistent with least privilege principles. Security Policies prohibits personnel from sharing or reusing credentials, passwords, IDs, or other authentication information. If your identity provider supports the SAML 2.0 protocol, you can use Judge.me’ SSO to integrate with your identity provider.

5.2.1.2.  Role-Based Access Controls (RBACs). Judge.me enforces RBACs (based on security groups and access control lists). Only authorized roles, which are defined based on the principle of least privilege and segregation of duties, are allowed to access production systems.

5.2.2.  Workstation Controls: Judge.me enforces certain security controls on its workstations used by personnel, including:

5.2.2.1.  Full-disk encryption

5.2.2.2.  Anti-malware software

5.2.2.3.  Automatic screen lock after 15 minutes of inactivity

5.2.2.4.  Secure VPN

6.  BREACH DETECTION & RESPONSE

6.1.  Detection & Investigation. Judge.me’ dedicated Detection engineering team deploys and develops intrusion detection monitoring across its computing resources, with alert notifications sent to the security incident response team (SIRT) for triage and response. The SIRT employs an incident response framework to manage and minimize the effects of unplanned security events.

6.2.  Personal Data Breaches. Personal Data Breach has the meaning given in this DPA. Unsuccessful attempts or activities that do not compromise the security of Merchant Personal Data, including (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, and packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents, are not, of themselves, treated as security incidents under these Security Measures. Judge.me maintains a record of Personal Data Breaches that includes description, dates and times of relevant activities, and disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel, and appropriate resolution steps are identified and documented. For any confirmed Personal Data Breach, Judge.me will take appropriate, reasonable steps to minimize product and Merchant damage or unauthorized disclosure.

6.3.  Communications & Cooperation. In accordance with applicable data protection laws, Judge.me will notify Merchant of a Personal Data Breach for which that Merchant is impacted without undue delay after becoming aware of the Personal Data Breach, and take appropriate measures to address the Personal Data Breach, including measures to mitigate any adverse effects resulting from the Personal Data Breach.

7.  BACKUPS, BUSINESS CONTINUITY, AND DISASTER RECOVERY

7.1.  Business Continuity and Disaster Recovery. Judge.me Business Continuity (BC) and Disaster Recovery (DR) plans are reviewed, and drills are conducted annually.

7.2.  Data Resiliency. Judge.me performs backups for its platform, generally managed by the cloud service provider capabilities, for data resiliency purposes in the case of a critical systems failure.

Annex 3 – Sub-processors

A current list of Sub-processors (including hosting/infrastructure providers, Shopify and email delivery providers) is maintained and made available by Judge.me, and is available at https://judge.me/help/en/articles/8390001-list-of-judge-me-s-sub-processors, as updated from time to time.