This Data Processing Agreement (DPA) shall apply to the Processing of Personal Data performed by LIGOWAVE on behalf of Client (Client Personal Data) in order to provide the Infinity Cloud Controller Service https://controller.ligowave.com/. This DPA is subject to the terms of the Infinity Cloud Controller Purchase Terms & Conditions (capitalized terms used and not defined herein have the meanings given them in the General Data Protection Regulation 2016/679 (GDPR)).

1. Processing
   1. The Client (i) is the sole Controller of the Client Personal Data or (ii) has been instructed by and has obtained the authorization of the relevant Controller(s) to agree to the Processing of Client Personal Data by LIGOWAVE as set out in this DPA. The Client appoints LIGOWAVE as the Processor to Process Client Personal Data. If there are other Controllers, the Client shall identify and inform LIGOWAVE of any such other Controllers prior to providing their Personal Data, as set out in the DPA.
   2. A list of categories of Data Subjects, types of Client Personal Data, Special Categories of Personal Data and the processing activities is set out in the applicable Personal Data Management Policy (PDMP). The duration of the Processing corresponds to the duration of the Service, unless otherwise stated in the DPA. The nature, purpose, and subject matter of the Processing is the provision of the Service as described in the Infinity Cloud Controller Purchase Terms & Conditions.
   3. The Client shall serve as a single point of contact for LIGOWAVE. As other Controllers may have certain direct rights against LIGOWAVE, the Client undertakes to exercise all such rights on their behalf and to obtain all necessary permissions from the other Controllers. LIGOWAVE shall be discharged of its obligation to inform or notify another Controller when LIGOWAVE has provided such information or notice to the Client. Similarly, LIGOWAVE shall serve as a single point of contact for the Client with respect to its obligations as a Processor under this DPA.
   4. LIGOWAVE shall comply with all European Economy Area data protection laws and regulations (Data Protection Laws) in respect of the Infinity Cloud Controller Service applicable to Processors. LIGOWAVE shall not be responsible for determining the requirements of laws applicable to Client’s business or that LIGOWAVE's provision of the Infinity Cloud Controller Service meet the requirements of such laws. As between the parties, the Client shall be responsible for the lawfulness of the Processing of the Client Personal Data. The Client shall not use the Infinity Cloud Controller Service in conjunction with Personal Data to the extent that doing so would violate applicable Data Protection Laws.
2. Organizational and Technical Measures
   1. LIGOWAVE shall implement and maintain organizational and technical measures (OTM) to ensure the level of security appropriate to the risk for LIGOWAVE’s scope of responsibility. OTM are subject to technical progress and further development. Accordingly, LIGOWAVE reserves the right to modify the OTM provided that the functionality and security of the Infinity Cloud Controller Service are not degraded.
   2. The Client confirms that the OTM provide an appropriate level of protection for the Client Personal Data, taking into account the risks associated with the Processing of Client Personal Data.
3. Data Subject Rights and Requests
   1. To the extent permitted by law, LIGOWAVE shall inform the Client of requests from Data Subjects exercising their Data Subject rights (e.g. rectification, deletion, and blocking of data) addressed directly to LIGOWAVE regarding Client Personal Data. The Client shall be responsible for responding to such Data Subject requests. LIGOWAVE shall reasonably assist the Client in responding to such Data Subject requests in accordance with Section 8.2.
   2. Should a Data Subject bring a claim directly against LIGOWAVE for the violation of their Data Subject rights, the Client shall indemnify LIGOWAVE for any cost, charge, damages, expenses or loss arising from such a claim, to the extent that LIGOWAVE has notified the Client about the claim and given the Client the opportunity to cooperate with LIGOWAVE in the defense and settlement of the claim. Subject to the terms of the Agreement, the Client may claim from LIGOWAVE amounts paid to a Data Subject for the violation of their Data Subject rights caused by LIGOWAVE’s breach of its obligations under the GDPR.
4. Third Party Requests and Confidentiality
   1. LIGOWAVE shall not disclose Client Personal Data to any third party, unless authorized by the Client or required by law. If a government or Supervisory Authority demands access to Client Personal Data, LIGOWAVE shall notify the Client prior to disclosure, unless prohibited by law.
   2. LIGOWAVE requires all of its personnel authorized to Process Client Personal Data to commit themselves to confidentiality and not Process such Client Personal Data for any other purposes, except on instructions from Client or unless required by applicable law.
5. Audit
   1. LIGOWAVE shall allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client of LIGOWAVE companies Processing of Client Personal Data in accordance with the following procedures:
      1. LIGOWAVE requires all of its personnel authorized to Process Client Personal Data to commit themselves to confidentiality and not Process such Client Personal Data for any other purposes, except on instructions from Client or unless required by applicable law.
      2. Upon Client’s written request, LIGOWAVE will provide the Client or its mandated auditor with the most recent certifications and/or summary audit report(s), which LIGOWAVE has procured to regularly test, assess, and evaluate the effectiveness of the OTM.
      3. LIGOWAVE shall reasonably cooperate with the Client by providing available additional information concerning the OTM to help the Client better understand the said OTM.
      4. If further information is needed by the Client to comply with its own or other Controllers audit obligations or a competent Supervisory Authority’s request, the Client should inform LIGOWAVE in writing to enable LIGOWAVE to provide such information or to grant the Client access to it.
      5. To the extent that it is not possible to otherwise satisfy an audit obligation mandated by applicable law, only legally mandated entities (such as a governmental regulatory agency having oversight of the Client's operations), the Client or its mandated auditor may conduct an onsite visit of the facilities used to provide the Infinity Cloud Controller Service, during normal business hours and only in a manner that causes minimal disruption to LIGOWAVE’s business, subject to coordinating the timing of such visit and in accordance with international audit standard’s.
      6. Each party will bear its own costs in respect of paragraphs 5.1.1. and 5.1.2. of Section 5.1. Any further assistance will be provided in accordance with Section 8.2.
6. Deletion of Client Personal Data
   1. Upon the termination or expiration of the Infinity Cloud Controller Plan, LIGOWAVE shall either delete the Client Personal Data, unless otherwise required by applicable law.
7. Personal Data Breach
   1. LIGOWAVE shall notify the Client without undue delay after becoming aware of a Personal Data Breach with respect to the Infinity Cloud Controller Service. LIGOWAVE shall promptly investigate the Personal Data Breach, if it occurred on LIGOWAVE infrastructure or in another area LIGOWAVE is responsible for and shall assist the Client as set out in Section 8.
8. Assistance
   1. LIGOWAVE shall assist the Client by technical and organizational measures, insofar as possible, for the fulfillment of the Client’s obligation to comply with the rights of Data Subjects and in ensuring compliance with the Clients’ obligations relating to the security of Processing, the notification of a Personal Data Breach, and the Data Protection Impact Assessment, taking into account the information available to LIGOWAVE.
   2. The Client shall make a written request for any assistance referred to in this DPA. LIGOWAVE shall charge the Client no more than a reasonable charge to perform such assistance or Additional Instructions. Such charges are to be set to the Client Plan charge.