Upflex & Priority Pass Partnership Data Protection Addendum

LAST UPDATED: 9 May 2023

Terms of Service

This Data Privacy, Data Protection and Security Requirements Exhibit (“Exhibit”) forms a part of the User Terms of Service provided via the Upflex Platform to you (“Client” or “you”), or other terms and conditions between the parties that govern the Services. (the “Agreement”). The parties understand, acknowledge, and agree this Exhibit is hereby incorporated into the Agreement.

The purpose of this Exhibit is to establish minimum privacy, data protection and security standards and related requirements for Upflex, Inc. (“Upflex”) in connection with its performance of Services in accordance with the Agreement. Capitalized terms that are not defined in this Exhibit shall have the meaning ascribed to them in the Agreement or under Data Protection Law.

1. Definitions

  1. “Data Protection Laws” means all data protection and privacy laws applicable to a party and its Processing of Personal Data under the Agreement.
  2. “Model Clauses” means the standard contractual clauses annexed to the European Commission’s Implementing Decision.
  3. “Client Data” means any data provided by Client to Upflex in connection with providing the Services.
  4. “Client Personal Data” means personal data that could identify an individual.
  5. “Security Best Practices” means security procedures that are at the highest standards agreed upon by the parties.
  6. “Security Incident” means any loss or misuse of Client Data.
  7. “Security Policies” means statements and guidelines for securing Client Data.
  8. “Services” means those services performed for or on behalf of Client pursuant to the Agreement.

2. Privacy

  1. Role of the Parties. Client is the Data Controller of Client Personal Data, and Upflex shall Process Client Personal Data only as a Data Processor acting on behalf of Client.

  2. General Obligations. Upflex agrees to process Client Personal Data only in compliance with applicable Data Protection Laws.

  3. Details of Processing.

    1. Subject matter: The subject matter of the Processing is Client Personal Data.
    2. Frequency and duration: The frequency and duration is the term of the Agreement.
    3. Nature and purpose: Upflex shall Process Client Personal Data only to provide the Services.
    4. Categories of data subjects: Prospective employees, contractors, clients, and suppliers.

  4. Subprocessing. Client agrees that Upflex may engage subprocessors to Process Client Personal Data.

  5. Selling and Sharing. Upflex may transfer Client Personal Data to its Strategic Business Partners and such transfers may constitute “selling” and “sharing” under applicable laws.

  6. Return or Deletion of Client Data. Upon termination of the Agreement, Upflex shall promptly delete or return all Client Data.

3. Security

Upflex has established an ongoing program of Security Policies, Security Procedures, and Security Technical Controls, including the following:

  1. Information Security:
    • A privacy and security incident management program.
    • Business continuity and disaster recovery plans.
  2. Physical Access:
    • Physical protection mechanisms for all information assets.
  3. Logical Access:
    • Appropriate mechanisms for user authentication and authorization.
  4. Security Architecture and Design:
    • A security architecture that ensures delivery of Security Best Practices.
  5. System and Network Management:
    • Mechanisms to keep security patches current and monitor security alerts.

Security Audit. Client may conduct an audit to verify compliance. Upflex will cooperate and allow reasonable access to all pertinent records.

Security Incidents. Upflex shall notify Client of any Security Incidents within 24 hours and provide details.