These Data Processing Terms ("DPA") form part of the agreement between VMP Agency LLC, an Arizona limited liability company ("VMP Agency," "Processor"), and each client that uses services provided by VMP Agency (the "Client," "Controller"). This DPA supplements and forms part of the Master Services Agreement, Service Agreement, or Terms of Service between the parties (the "Agreement"), and governs VMP Agency's processing of personal data on Client's behalf in connection with the services VMP Agency provides (the "Services"). By using the Services, or by subscribing to a Service that references these terms, Client agrees to this DPA. If there is a conflict between this DPA and the Agreement regarding the processing of personal data, this DPA controls.
"Applicable Data Protection Laws" means all privacy and data protection laws that apply to the processing under this DPA, including the California Consumer Privacy Act as amended by the CPRA ("CCPA"), other U.S. state privacy laws, and, where applicable, the EU and UK General Data Protection Regulation ("GDPR").
"Personal Data" means information relating to an identified or identifiable person that VMP Agency processes on Client's behalf under the Agreement.
"Data Subject" means the individual to whom Personal Data relates (for example, Client's leads, customers, members, or contacts).
"Processing" means any operation performed on Personal Data, such as collection, use, storage, disclosure, or deletion.
"Subprocessor" means a third party engaged by VMP Agency to process Personal Data in providing the Services.
The terms "Controller," "Processor," "Service Provider," "Business," "sell," and "share" have the meanings given in Applicable Data Protection Laws.
Client is the Controller (and, under the CCPA, the Business) of the Personal Data. VMP Agency is the Processor (and, under the CCPA, the Service Provider). VMP Agency processes Personal Data only to provide the Services and only on Client's documented instructions, including those in the Agreement, this DPA, and Client's configuration of the Services. The subject matter, nature and purpose, duration, categories of Data Subjects, and types of Personal Data are described in Annex 1. If VMP Agency believes an instruction violates Applicable Data Protection Laws, it will notify Client.
Client is responsible for: the accuracy, quality, and legality of the Personal Data and the means by which it acquired it; having a lawful basis and all necessary notices and consents for the processing it instructs; its configuration and use of the Services; and not instructing VMP Agency to process special categories of sensitive Personal Data unless the parties have agreed in writing and put appropriate safeguards in place.
With respect to Personal Data subject to the CCPA, VMP Agency acts as a Service Provider. VMP Agency will not: sell or share the Personal Data; retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted by the CCPA; retain, use, or disclose it outside the direct business relationship between the parties; or combine it with personal information from other sources except as permitted by the CCPA. VMP Agency certifies that it understands and will comply with these restrictions. These terms apply equivalently where other U.S. state privacy laws use similar concepts.
The Services are operated primarily in the United States. If Client's instructions involve the processing of Personal Data subject to the GDPR or UK GDPR, the parties will put in place an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or the UK Addendum, which are incorporated by reference and completed using the details in the Annexes, to the extent required by Applicable Data Protection Laws.
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA does not increase a party's total liability beyond the cap stated in the Agreement.
This DPA takes effect when Client first agrees to it and remains in effect for as long as VMP Agency processes Personal Data on Client's behalf under the Agreement. Sections that by their nature should survive (including confidentiality, deletion or return, records and audit, and liability) survive termination.
This DPA is governed by the laws of the State of Arizona, consistent with the Agreement. Except as amended by this DPA, the Agreement remains in full force and effect.
VMP Agency maintains measures appropriate to the risk, including: encryption of Personal Data in transit; access controls and least-privilege access for personnel; multi-factor authentication where available; logical separation (tenant isolation) of Client data in VMP Agency's own infrastructure; use of reputable infrastructure and platform providers that maintain their own security programs; and procedures for identifying and responding to security incidents. Personal Data that resides in Client's own connected systems is also subject to those platforms' security controls and Client's settings.
VMP Agency uses the following subprocessors to help provide the Services:
VMP Agency keeps the subprocessor list current, and may add a subprocessor when a Client connects a new platform or remove one it stops using. Questions about this DPA or a signed copy for your records: support@vmpagency.com.