Data Processing Agreement

1.  Definitions

For the purpose of this DPA, the following terms shall have the meanings set out below. Any capitalized term used but not defined in this DPA has the meaning provided to it in the Agreement.

1.1 “Applicable Laws” means any applicable laws and regulations to a given situation, regardless of the jurisdiction or subject of the law or regulation;

1.2 “Customer Data” means any data uploaded or provided by the Customer. MOCA may process Customer Data in order to provide the Services.

1.3 “Data Protection Laws” means all laws and regulations, including the GDPR, applicable to the Processing of Personal Data under the Agreement;

1.4 “Deletion” shall mean to remove or obliterate Personal Data such that it cannot be recovered or reconstructed, and therefore, excludes encryption and similar techniques.

1.5 “EU Applicable Laws” means any applicable laws and regulations to a given situation, to the extent that these are recognized in the European Union;

1.6 “GDPR” means Regulation (EU)2016/679 (“EU GDPR”) or, where applicable, the “UK GDPR” as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the UK European Union (Withdrawal) Act 2018;

1.7 “Personal Data” means any information relating to an identified or identifiable natural person and includes similarly defined terms in Applicable Data Protection Laws;

1.8 “Process” or “Processing” means any operation or set of operations that are performed upon Personal Data or on sets of Personal Data, whether or not by automatic means, such as access, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclose by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

1.9 “Data Subject”, “MemberState”, “Controller”, “Processor”, “Supervisory Authority”, “Recipients” and “Personal Data Breach” shall have the meaning set forth in the GDPR;

1.10 “Restricted Transfer” means (i) a transfer of Personal Data from MOCA to a Subprocessor, or another establishment of MOCA; (ii) an onward transfer of Personal Data from a Subprocessor to another Subprocessor or another establishment, in each case, where such transfers would be prohibited by Data Protection Laws, such as in the absence of a proper mechanism pursuant to Art. 44 and seq. GDPR. For the avoidance of doubt and without limitation to the generality of the foregoing, the Parties to this DPA intend that transfers of Personal Data to or from the United Kingdom, following any exit by the United Kingdom from the European Union, shall be considered Restricted Transfers, unless and until an Adequacy Decision or another agreement of the sort has been established.

1.11 ”Subprocessor” means any legal or natural person appointed pursuant to Section 7 to Process Personal Data.

2. Details of Processing

2.1 Purpose and scope.

MOCA shall provide Services to the Company in accordance with the Terms of Services. In providing the Services, MOCA shall process the Customer Data on behalf of the Customer. CustomerData may include personal data. Therefore, the Customer shall be:

i. Data Controller with respect to the Customer Data; or

ii. Data Processor, where the Customer processes personal data on behalf of a third party. For the purposes of this DPA and Terms of Services, MOCA is a Data Processor. The Data Processor will process and protect such Personal Data in accordance with the terms of this DPA and Terms of Service.

iii. This Addendum applies with respect to any Personal Data of which Company is the Controller or Processor within the scope of the Data Protection Law and MOCA is Processor or sub-Processor for Company as the case may be (the”Data”).

2.2 Types of Personal Data.

MOCA shall process Personal Data of such categories of data subjects that the Customer uploads or submits when using the Services. This may include, but is not limited to, name, surname, organization, position, personal code, phone number etc. Depending on the nature and contents of the Customer Data provided by the Customer, it may vary in every case.

2.3 Duration of the Processing.

MOCA shall process the Customer Data from the moment the Customer uploads or submits it when using the Services until the earlier of

i. removal thereof by the Customer,

ii. expiry/termination of the Agreement, or

iii. the date upon which processing is no longer necessary for the purposes of either Party performing its obligations under the Agreement (to the extent applicable).

3. Processing of Personal Data

3.1 MOCA shall process Personal Data only according to the documented instructions of the Customer, unless processing is required by applicable Data Protection Laws, in which case, to the extent permitted by applicable Data Protection Laws, MOCA shall inform the Customer of such legal requirements before processing. MOCA shall comply with all applicable Data Protection Laws in processing of Personal Data.

3.2 The Customer shall ensure that appropriate legal basis for processing of Customer Data by MOCA exists.

3.3 The Customer instructs MOCA to process Personal Data as required to perform its obligations under the Service Terms, and follow all information security, confidential and privacy requirements as required under this DPA. Additional Customer instructions outside the scope of the Documented Instructions require prior written agreement between the Parties.

3.4 MOCA shall immediately inform the Customer if the Customer’s instructions are in conflict with the GDPR or other applicable Data Protection Laws. This clause does not in any way impose MOCA with the duty to monitor Customer Data and/or to take any additional steps and/or to acquire additional information to evaluate the lawfulness of the Customer’s instructions.

4. Data Transfer

4.1 Customer acknowledges and agrees that, in connection with the performance of the services under the Agreement, Personal Data will be transferred to a sub-processor located in the Republic of Korea, the European Commission-approved country providing ‘adequate’ data protection.

4.2 To the extent Data Transfer result in transfers of UK Personal Data, either directly or via onward transfer, Standard Contractual Clauses adopted pursuant to or permitted under Article 46 of the UK GDPR (“UK SCCs”) at Exhibit 1 will also apply.

5. Confidentiality Obligation

5.1 MOCA shall take reasonable steps to ensure the reliability of any employee, agent, Subprocessor, or any third party who may have access to the Personal Data, ensuring in each case that access is limited to those individuals who need to know/access the relevant the Personal Data, as necessary for the purposes of the Agreement. All such individuals must be subject to confidentiality undertakings or professional or statutory obligations of confidentiality which must survive to the term of their employment, mandate, or engagement with MOCA.

5.2 According to this Agreement, each Party shall retain any information received regarding this Agreement and the other Party (“Confidential Information”), and shall not disclose the Confidential Information without the prior written consent of the other Party, except for in the following circumstances:

(a) When it is required by law

(b) When any relevant information is already disclosed

6. Technical and Organizational Measures

6.1  MOCA shall implement appropriate technical and organizational measures to protect the Customer Data. MOCA shall select technical and organizational measures taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

6.2  MOCA has been implemented and certified by an accredited auditor information security management system according to international security standards. The information security management system provides for a number of security measures, including, but not limited to:

(i)    pseudonymization and encryption of personal data;

(ii)    measures to ensure the ongoing confidentiality, integrity, availability, and resilience of data processing systems and services;

(iii)   measures to ensure the timely restoration of availability and access to personal data in the event of a physical or technical event;

(iv)   measures to protect access (including remote access) to personal data;

(v)    measures for the physical security of the facilities where personal data is processed and retained; The effectiveness of these security measures is evaluated at least annually.

6.3  MOCA may update the technical and organizational measures from time to time provided that any such updates and modifications do not reduce the overall level of protection afforded to Customer Data by MOCA under this DPA.

7. Subprocessor

7.1 Customer grants MOCA general authorization to engage Subprocessor specified below. For the avoidance of doubt, the foregoing authorization constitutes Customer’s prior written consent to the subprocessing for purposes of Clause 11 of the Standard Contractual Clauses, Exhibit 1.

Airfob Portal