This Data Processing Addendum (“Addendum”) is incorporated into and forms part of the any agreement governing use of the Services (the “Agreement”) between Wenco International Mining Systems Ltd. (together with its Affiliates, “Wenco”) and the customer entity that is a party to the Agreement (“Customer”).
1.1 All capitalized terms not otherwise defined in this Addendum shall have the meaning given to them in the Agreement. For the purposes of this Addendum:
“Affiliate” means, with respect to any specified entity, any other entity that directly or indirectly controls, is controlled by or is under common control with such entity. The term “control” and correlative terms mean ownership, directly or indirectly, of more than fifty (50%) of the voting stock or partnership interests of the controlled entity;
“Applicable Law” means all present and future laws, statutes, ordinances, regulations, judgement, orders, rules and directions of any court or governmental authority that are applicable to the Agreement and enforceable in Canada, and includes Applicable Privacy Law;
“Applicable Privacy Law” means all data protection laws and regulations applicable to a party’s processing of Personal Information under the Agreement.
"Conflicting Foreign Order" means any order, subpoena, directive, ruling, judgment, injunction, award, decree, decision, request or other requirement issued from a foreign court, agency of a foreign state or other authority outside Canada or any foreign legislation the compliance with which would or could potentially breach Applicable Privacy Law in Canada
“Contact Information” means information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address and business email of the individual;
“Excluded Information” or “Excluded Records” means information, documents or recorded information that (a) relate solely to Wenco internal administration, finances, management, or employment matters, unless they contain Personal Information about an individual other than Wenco Personnel or other third parties with whom Wenco has dealings unrelated to the subject matter of the Agreement; or (b) Customer confirms in writing are excluded from the application of this Addendum;
“Personal Health Information” means personal health information about an individual as defined by Applicable Privacy Law;
“Personal Information” means information about an identifiable individual, excluding Contact Information (unless the Applicable Privacy Law otherwise considers such information as Personal Information) and Excluded Information, that is collected or created by Wenco or otherwise obtained or held by or accessible to Wenco in connection with the Agreement or any previous agreement between Customer and Wenco dealing with the same subject matter as the Agreement, and specifically includes Personal Health Information. Please see Wenco’s Privacy Policy for more information;
“Privacy Policy" means Wenco's then-current privacy policy available at: https://www.wencomine.com/terms-and-policies/terms-and-policies.
“Processing”, “Process” and correlative terms mean any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, amendment, modification, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, erasure or destruction.
“Record” includes books, documents, maps, drawings, photographs, letters, vouchers, papers and any other thing on which Personal Information is recorded or stored by graphic, electronic, mechanical or other means which are collected or produced by Wenco in the course of delivering Services or otherwise performing its obligations under the Agreement, but does not include Excluded Records.
“Security Incident” means any breach of security and/or confidentiality that leads to the accidental or unauthorized destruction, loss, alteration theft, disclosure or other Processing of, or access to, or any form of unlawful Processing of, Personal Information on systems managed or otherwise controlled by Wenco.
“Services” means the products and services provided by Wenco or its Affiliates, as applicable, that are (a) used by Customer, including, without limitation, products and services that are on a trial basis or otherwise free of charge; or (b) ordered by Customer under the Agreement or a purchase order form.
“Third-Party Service Provider” means any processor engaged by Wenco or its Affiliates to assist in fulfilling its obligations with respect to providing the Service pursuant to the Agreement or this Addendum. Third-party service providers may include third parties or Affiliates of Wenco but excludes all Wenco Personnel.
Wenco Network” means Wenco’s data center facilities, servers, networking equipment, and host software systems (e.g., virtual firewalls) that are within Wenco’s control and are used to provide the Services.
“Wenco Personnel” means any employees, officers, directors, contractors, subcontractors, associates, representatives or other persons engaged by Wenco for the purposes of fulfilling Wenco’s obligations under the Agreement;
2.1 This Addendum applies to the Processing of Personal Information by Wenco for or on behalf of Customer in the performance of the Agreement. Except as modified by this Addendum, the terms of the Agreement will remain in full force and effect. If there is a conflict between any of the provisions of the Agreement and the provisions of this Addendum, the provisions of this Addendum will govern and control.
2.2 An overview of the categories of Personal Information, the categories of data subjects, and the nature and purposes for which Personal Information is being Processed is provided in Appendix 1 (Processing Details).
3.1 As between Customer and Wenco, Customer will remain the exclusive owner and controller of all Personal Information, and Wenco acts solely as a service provider/processor with respect to all Personal Information.
3.2 Wenco’s Processing activities are as set out in the Agreement. Wenco shall only Process Personal Information as follows:
For greater certainty, the Agreement constitutes Customer’s documented instructions regarding Wenco’s Processing of Personal Information for the purposes of rendering the Services contemplated by the Agreement. Wenco shall use reasonable efforts to follow Customer’ s instructions pursuant to paragraph (iii) above. Wenco shall notify Customer (ex. via email) if Wenco is unable to comply with such instructions or if, in its opinion, any instruction violates Applicable Law.
3.3 Wenco may also Process Personal Information where required to do so by Applicable Law. In such a case, Wenco will inform Customer of that legal requirement prior to such Processing, unless prohibited by such Applicable Law.
3.4 For clarity, Wenco shall not:
3.5 Wenco shall not disclose the Personal Information to any third party without the prior written consent or instruction of the Customer, except where required by Applicable Law or as otherwise specified in the Agreement, this Addendum, or any other agreement, instrument or document between Wenco and Customer. In the event Wenco is legally required to disclose Personal Information, to the extent permitted, Wenco will endeavor to provide Customer with reasonable notice of the demand via email or postal mail to allow Customer to seek a protective order or other appropriate remedy. In addition, Wenco shall not use Personal Information to develop or market any product or service that could directly identify or re-identify individuals.
3.6 Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Information and the means by which Customer acquired Personal Information.
3.7 Customer shall not submit, store, or send any sensitive personal information or special categories of personal data (collectively, “Sensitive Data”) to Wenco for processing, and Customer shall not permit nor authorize any of its employees, agents, contractors or data subjects to submit, store or send any Sensitive Data to Wenco for processing. Customer acknowledges that Wenco do not request or require Sensitive Data as part of providing the Service to Customer, that Wenco do not wish to receive or store Sensitive Data, and that Wenco's obligations in this Addendum will not apply with respect to Sensitive Data. The terms “sensitive personal information” and “special categories of personal data” have the meanings given in Applicable Privacy Laws.
5.1 The Parties acknowledge and agree that as between Customer and Wenco:
At Customer’s request, Wenco will reasonably cooperate with Customer in responding to third party requests about Wenco’s Processing of Personal Information or any Security Incident. Except where prohibited by Applicable Law, Wenco will promptly notify Customer (ex. via email) about any such request received by Wenco, without responding to such request without Customer’s further instructions, if applicable. Wenco will enable Customer to access, correct and delete, or restrict its Processing of, Personal Information during the term of the Agreement in a manner consistent with the functionality of the Services, the Agreement and this Addendum. Where such functionality is not provided, Wenco will correct, delete or provide, or restrict its Processing of Personal Information in accordance with Customer’s documented instructions and Applicable Privacy Law.
Notwithstanding the provisions of this Addendum, Wenco retains the right to use and disclose aggregated and De-Identified Data in any manner. “De-Identified Data” means information (or any portion thereof) that has been de-identified, aggregated and/or anonymized such that the De-Identified Data cannot reasonably be used, alone or in conjunction with other data in the possession of Wenco, to identify or re-identify any individual.
8.1 Wenco will only grant access to the Personal Information to Wenco Personnel where such access is necessary for the performance of the Services contemplated by the Agreement or to comply with Customer documented instructions, and subject to the following terms:
Customer hereby acknowledges and agrees that Personal Information and Records may be Processed, maintained, shared stored, managed and/or administered by Wenco outside of Canada using cloud computing or other information technology infrastructure selected by Wenco and managed using third party service providers.
10.1 Authorized Third Party Service Providers. Customer acknowledges and agrees that Wenco may use third-party service providers to fulfil its contractual obligations under the Agreement and this Addendum or to provide certain services on its behalf, such as providing hosting or support services. Customer hereby consents to Wenco’s use of third-party service providers as described in this Section 10 and as further described in Appendix 3 (Third Party Service Providers).
10.2 Third-party service provider Obligations. Where Wenco uses any authorized third-party service provider as described in Section 10.1:
11.1 Security Incident.If Wenco becomes aware of a Security Incident, Wenco will (a) without undue delay and, in any event, within 48 hours, notify Customer of the Security Incident; and (b) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.
11.2 Wenco Assistance. In order to assist Customer in relation to any data breach notifications Customer is required to make under Applicable Law, policies or agreement, Wenco will include in the notification such information about the Security Incident as Wenco is reasonably able to disclose to Customer, taking into account the nature of the Services, the information available to Wenco, and any restrictions on disclosing the information, such as confidentiality. Wenco will cooperate with Customer, to the extent reasonably requested, in relation to any notifications Customer is required to make under Applicable Law, including to any regulatory authority having jurisdiction or data subjects, following a Security Incident and will provide Customer such additional information regarding the Security Incident, as may be reasonably requested by Customer, in due course. Subject to Applicable Law, Wenco will not inform any third party of any Security Incident without first obtaining Customer’s prior written consent. If instructed by Customer, Wenco will refer any external communications relating to a Security Incident to Customer. Notwithstanding the foregoing, Wenco may, at its discretion, inform other entities that are directly affected by the Security Incident and its professional advisors, including Security Incident management professionals, however, except with respect to its professional advisors, Wenco should not make any reference, express or implied, to Customer.
11.3 Failed Security Incidents. Customer agrees that a failed Security Incident will not be subject to the terms of this Addendum. A “Failed Security Incident” is one that results in no unauthorized access to Personal Information or to any part of the Wenco Network, or equipment or facilities storing Personal Information, and may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful login attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents.
11.4 Notification. Notification of Security Incidents, if any, will be delivered to one or more of Customer’s administrators by any means Wenco selects, including via email. It is Customer’s sole responsibility to ensure Customer’s administrators maintain accurate Contact Information on the Wenco management console and secure transmission at all times.
11.5 Corrective Action. Wenco will cooperate with Customer in preventing the occurrence or recurrence of any breach of this Addendum, the Agreement, or Applicable Law, including, if requested to do so, by preparing a written proposal to address or prevent further occurrences within Wenco’s systems.
11.6 Records. Wenco will maintain records any Security Incident in accordance with Applicable Privacy Law.
11.7 No Acknowledgement of Fault by Wenco. Wenco’s obligation to report or respond to a Security Incident under this Addendum is not and will not be construed as an acknowledgement or admission by Wenco of any fault or liability with respect to the Security Incident.
Independent Determination. Customer acknowledges that it has reviewed the information made available by Wenco relating to data security and its security standards and agrees that the security measures implemented and maintained by Wenco, as described in Section 4 and further described in Appendix 2 (Security Standards), are taking into account industry standard practices and procedures, the costs of implementation and the nature, scope, context and purposes of the Processing of Personal Information, as well as the risks to individuals.
12.1 Audit and Compliance.
This Addendum will come into effect on the effective date of the Agreement and will continue in force until the termination of the Agreement (the “Termination Date”).
14.1 Except as otherwise specified in the Agreement, Wenco will retain the Personal Information and Records for as long as required to engage in the uses described in this Addendum, unless a longer retention period is required by Applicable Law.
14.2 Customer may access, export and retrieve Personal Information or Records in a standard format at any time during the term of the Agreement in a manner consistent with the functionality of the Services, terms of the Agreement and this Addendum. Export and retrieval may be subject to technical limitations, in which case, Wenco and Customer will find a reasonable method to allow Customer to export and retrieve and Personal Information, at Customer’s expense.
14.3 Upon written request of the Customer, or upon termination/expiration of the Agreement, or fulfillment of all purposes agreed in the context of the Services contemplated under the Agreement whereby no further Processing of Personal Information is required, Wenco will within a reasonable period of time, in line with Applicable Privacy law, except where specific retention periods are required or permitted by Applicable Law: (i) return all Personal Information and Records in its possession or control; or (ii), or use commercially reasonable efforts to delete or destroy all Personal Information and Records remaining on servers hosting the Services, at Customer’s option and expense, excluding back-up copies. Customer hereby acknowledges and accepts the functionality of the Services and the data retention and deletion applications as made available by Wenco, which may impact Personal Information. If Wenco is required for any reason, such as requirements under Applicable Law, to retain any Personal Information or Record, Wenco’s obligations pursuant to this Addendum will continue in full force and effect with respect to such retained Personal Information or Record.
The liability of each party under this Policy will be subject to the exclusions and limitations of liability set out in the Agreement. Customer agrees that any regulatory penalties incurred by Wenco in relation to the Personal Information that arise as a result of, or in connection with, Customer’s breach of any term of this Addendum or Applicable Law will count towards and reduce Wenco’s liability under the Agreement as if it were liability to the Customer under the Agreement.
If an amendment is required to this Addendum in order to comply with the Applicable Law or any requirements stipulated by the other agreements or policies, Wenco reserves the right to amend this Addendum as necessary to maintain compliance with Applicable Law and the updated version will be accessible on Wenco’s website.
Any questions regarding this Addendum may be sent to Wenco’s Privacy Officer at privacy@wencomine.com
18.1 If a provision of this Addendum conflicts with a provision of the Agreement, the provision of this Addendum will prevail only as it relates to the protection or process of Personal Information.
1. Nature and Purpose of Processing. Wenco will Process Personal Information as necessary to perform the Services pursuant to the Agreement and the Addendum, and as further instructed by Customer throughout its use of the Services.
2. Duration of Processing. Subject to this Addendum, Wenco will process Personal Information during the term of the Agreement. Notwithstanding the foregoing, Wenco may retain Personal Information, or any portion of it, if required by Applicable Law or regulation, provided that such Personal Information remains protected in accordance with the terms of this Addendum and Applicable Law.
3. Categories of Data Subjects. Customer may upload Personal Information in the course of its use of the Services, the extent to which is determined and controlled by Customer in its sole discretion, relating to the following categories of data subjects:
4. Categories of Personal Information. Wenco may collect and Customer may upload Personal Information in the course of Customer’s use of the Services, the type of and extent to which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to the following categories of Personal Information:
I. Technical and Organizational Measures
We are committed to protect our Customers’ Personal Information. Taking into account the best practices, the costs of implementation and the nature, scope, circumstances and purposes of processing, as well as the likelihood of occurrence and severity of the risk to the rights and freedoms of natural persons, we take the following technical, physical and administrative measures. When selecting the measures, the confidentiality, integrity, availability and resilience of the systems are considered.
1. Confidentiality. We use a variety of physical and logical measures to protect the confidentiality of Personal Information. Those measures include:
Physical Security
2. Integrity. Appropriate change and log management controls are in place, in addition to access controls to be able to maintain the integrity of Personal Information such as:
Change & Release Management
3. Availability. We implement appropriate continuity and security measures to maintain the availability of its services and the data residing within those services:
4. Data Processing. It refers to ensuring that Personal Information will only be processed in accordance with the Agreement and the related company measures. We have established internal privacy policies, agreements and conduct regular privacy trainings for employees to ensure Personal Information is processed in accordance with the Agreement and legal obligations.
5. Retention Period. We follow generally accepted standards to store and protect the Personal Information we collect, both during transmission and once received and stored, including utilization of encryption where appropriate. We retain Personal Information for as long as required to engage in the uses described in this Policy, unless a longer retention period is required by Applicable Law. The criteria used to determine our retention periods include the following: