This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Wayflyer Terms of Business and the Customer Agreements, and governs any Processing of Personal Data carried out by Wayflyer when providing the Services.
Unless otherwise defined in this DPA, capitalised terms will have the meaning given to them in the Terms of Business. In the event of any conflict with the Terms of Business, a Customer Agreement or existing data sharing agreement which may be in place with you, this DPA will take precedence to the extent the conflict relates to the Processing of Personal Data.
1. Definitions
The following definitions apply in this DPA.
“Approved Sub-Processors” means the Sub-Processors who are currently engaged by Wayflyer, a list of which (including a name of those Sub-Processors and a description of their processing activities) is available on request.
“Business Purposes” has the meaning given to it in clause 4.1.
“Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor”, and “Supervisory Authority” have the meanings given to them in the Data Protection Laws, provided that the term “Personal Data” as used in this DPA only applies to Customer Personal Data which Wayflyer Processes in connection with the provision of the Services.
“Customer” or “you” means a customer for any of the Services.
“Customer Agreements” has the meaning given to it in the Terms of Business.
“Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time, including, without limitation and where applicable, (i) the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data ("GDPR"); (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018; (iii) the EU Privacy & Electronic Communications Directive 2002/58/EC; (iv) the California Consumer Privacy Act of 2018, all national implementing legislation and any applicable binding guidance and codes of practice issued by any Supervisory Authority or other relevant regulatory authority. For the avoidance of doubt, if Wayflyer’s Processing activities involving the Personal Data are not within the scope of a Data Protection Law, such law is not applicable for the purposes of this DPA.
“Data Subject Request” has the meaning given to it in clause 7.1.
“Security Measures” has the meaning given to it in clause 6.1.
“Services” has the meaning given to it in the Terms of Business.
“Sub-Processor” means any third party subcontractor engaged by Wayflyer to Process Personal Data in connection with the Services.
“Sub-Processor Notifications” has the meaning given to it in clause 10.3.
“Terms of Business” means the Wayflyer Terms of Business, available at https://www.wayflyer.com/terms
“Wayflyer”, “we” or “us” means Wayflyer Limited, a limited liability company incorporated under the laws of Ireland (company number 602786).
2. Personal data types and processing purposes
2.1 In respect of the Processing of Personal Data under this DPA:
Wayflyer is, depending on the relevant Personal Data, either:
a Processor on your behalf, in which case, the provisions of this DPA (other than clause 12) will apply to the Processing of the Personal Data; or
a Controller, in which case, clause 3 and clauses 12 - 16 (inclusive) will apply to the Processing of the Personal Data.
- you are a Controller.
ANNEX A describes the subject matter, duration, nature and purpose of the processing and the Personal Data type and Data Subject categories in respect of which Wayflyer may Process the Personal Data to fulfil the Business Purposes, along with details of a Controller’s obligations and rights.
3. Customer obligations
3.1 You acknowledge and agree that, as a Controller, you retain control of the Personal Data and are solely responsible for your compliance obligations under the Data Protection Laws, including but not limited to, those arising in respect of:
- your use of the Services;
the accuracy and quality of the Personal Data and the means by which you acquired it;
all necessary transparency and lawfulness requirements under Data Protection Laws;
any notification obligations to Data Subjects in relation to such Processing;
ensuring you have the right to transfer, or provide access to, the Personal Data to us for Processing; and
- any written Processing instructions you give to Wayflyer.
3.2 You will inform us without undue delay if you are cannot comply with clause 3.1, or any aspect of the Data Protection Laws.
4. Instructions
4.1 Wayflyer will only process the Personal Data to the extent, and in such a manner, as is necessary for the provision of the Services in accordance with this DPA, any Customer Agreements and any instructions expressly agreed between us in writing (the “Business Purposes”).
4.2 If Wayflyer is legally required to otherwise Process the Personal Data, we will notify you of the relevant legal requirement before doing so, unless the law prohibits us giving you such notice.
4.3 Wayflyer will immediately inform you if, in our opinion, your instructions do not comply with the Data Protection Laws, in which case we reserve our rights to suspend all Processing (other than merely storing and maintaining the security of the affected Personal Data) until you issue new lawful Instructions. You acknowledge and agree that Wayflyer is not obliged to monitor and assess the lawfulness of instructions on an ongoing basis and we have no obligation to procure or provide legal advice to you in this respect.
4.4 If we are required to invoke clause 4.3, we will not be liable to you under any Customer Agreements for any failure to provide the applicable Services until such time as you issue new lawful Instructions with regard to the Processing.
5. Confidentiality
Wayflyer will ensure that the persons authorised by us to access such Personal Data are bound by appropriate confidentiality obligations.
6. Security
6.1 Wayflyer will, taking into account the nature of the processing, implement technical and organisational measures appropriate to the risk involved in protecting the security, confidentiality and integrity of Personal Data against accidental, unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data, including the security measures set out in ANNEX B (“Security Measures”).
6.2 If you request any changes to the Security Measures, any such changes will be at your cost and will be subject to agreement in writing between us.
6.3 Wayflyer is entitled to, and reserves the right to modify the Security Measures, provided that the Security Measures continue to meet the requirements of Article 32 GDPR.
7. Data subject requests
7.1 Wayflyer will notify you in writing without undue delay if we receive a complaint, dispute or request from a Data Subject that relates to the Processing of the Personal Data, or to your or our compliance obligations under Data Protection Laws, including where a Data Subject makes a request to exercise any of their rights under the Data Protection Laws (such as access rights and rights to rectify, port and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data) (“Data Subject Request”).
7.2 Wayflyer will, at your cost, provide you with reasonable assistance, having regard to the nature of the Processing being carried out by us and by appropriate technical and organisational measures insofar as is possible, to enable you to respond to Data Subject Requests, provided that:
you provide us with a written request setting out the scope of the assistance required; and
Wayflyer will not, and will have no obligation to, communicate directly with any Data Subject unless we are required to do so under applicable Data Protection Laws, or expressly agreed in writing with you.
8. Assistance
Wayflyer will, at your cost and taking into account the nature of the Processing involved, provide you with reasonable assistance to enable you to comply with your obligations arising under (i) Article 32 GDPR (Security); (ii) Articles 33 and 34 GDPR (Data Breach Notification); (iii) Article 35 GDPR (Data protection impact assessments); and (iv) Article 36 GDPR (Prior consultation requests to regulators), provided that Wayflyer will not, and will have no obligation to, communicate directly with any Data Subject or any Supervisory Authority unless we are required to do so under applicable Data Protection Laws, or expressly agreed in writing with you.
9. Personal data breach
9.1 Wayflyer will notify you in writing without undue delay if we become aware of a Personal Data Breach, where and to the extent required under applicable Data Protection Laws, including such information relevant to the Personal Data Breach that is in the possession of, or can reasonably be ascertained by us in the circumstances.
9.2 Wayflyer will not, and will have no obligation to communicate directly with any Data Subject or Supervisory Authority in respect of a Personal Data Breach unless we are required to do so under applicable Data Protection Laws, or expressly agreed in writing with you.
10. Sub-Processors
10.1 You agree that, subject to clause 10.3 regarding the appointment of new Sub-Processors, Wayflyer is generally authorised, at our sole discretion, to appoint Sub-Processors in connection with the provision of the Services, provided that:
we shall impose data protection terms on the Sub-Processors that provide an equivalent level of protection for Personal Data as those imposed by this DPA, to the extent applicable to the nature of the services provided by such Sub-Processor; and
Wayflyer remains responsible for Processing by any Sub-Processor as if the Processing was being conducted by us.
10.2 You acknowledge that the Approved Sub-Processors are currently engaged by Wayflyer and consent to our engagement of such Approved Sub-Processors.
10.3 You may request to be notified of newly appointed Sub-Processors (“Sub-Processor Notifications”) by emailing privacy@wayflyer.com. If you have requested Sub-Processor Notifications, we will notify you before we authorise any new Sub-Processors to Process your Personal Data.
10.4 If you do not object in writing within 10 days of a Sub-Processor Notification, you will be deemed to have approved the new Sub-Processor.
11. Audit
11.1 Wayflyer will, at your cost, on your reasonable request no more than annually (unless you have reasonable grounds to suspect non-compliance with this DPA):
make available to you information reasonably necessary to demonstrate our compliance with the obligations set out in Article 28 GDPR and in this DPA; and
permit you, or a third party auditor acting under your supervision, to conduct, data protection audits, assessments and inspections concerning our data practice practices and / or our compliance with this DPA, provided that Wayflyer may satisfy an audit request in the first instance by providing its then-current SOC 2 report and/or other relevant third-party certifications, and on-site audits, assessments and inspections under this clause 11.1(b) shall only be available where such materials are reasonably insufficient to demonstrate compliance, provided that:
such information requests will be conducted during normal business hours and will not unduly interfere with the provision of the Services and / or Wayflyer’s normal business activities; and
Wayflyer may request any third party auditor acting on your behalf to provide written confidentiality undertakings to our reasonable satisfaction, and we will be entitled to refuse access to any of our premises or records until such time as we have received such undertakings.
11.2 Nothing in this clause 11 will oblige Wayflyer to disclose information which is confidential, commercially sensitive or subject to legal privilege, or to breach any confidentiality obligations which we have to our other customers or to Wayflyer personnel, and Wayflyer will be entitled to restrict or prevent access to any part of our premises or records which we consider in our sole discretion could compromise the security of any such information or data.
12. Wayflyer’s Processing of Personal Data as a Controller
12.1 If Wayflyer processes any Personal Data under this DPA as an independent Controller:
Wayflyer will use such Personal Data as strictly necessary for the Business Purposes.
Wayflyer will ensure that the persons authorised by it to access such Personal Data are bound by appropriate confidentiality obligations.
Wayflyer may, at its sole discretion, appoint Sub-Processors in connection with the provision of the Services in accordance with clause 10 (Sub-Processors).
you acknowledge that in the provision of some Services (such as Wayflyer integrations with certain open banking applications), Wayflyer, on receipt of instructions from you, may facilitate the transfer of Personal Data to and otherwise interact with third party data providers. You agree that if and to the extent such transfers occur, you are responsible for entering into separate contractual arrangements with such third-party data providers. For the avoidance of doubt, such third-party data processors are not Sub-Processors.
taking into account the nature of the processing, Wayflyer will implement appropriate technical and organisational measures, appropriate to the risk to ensure the protection of the security, confidentiality and integrity of Personal Data we receive under the Customer Agreements.
Wayflyer shall make available to you all information necessary to demonstrate compliance with the obligations laid down in this clause 12.1 in accordance with clause 11 (Audit).
Wayflyer shall notify you without undue delay after becoming aware of any Personal Data Breach in relation to such Personal Data and provide you with such reasonable co-operation and assistance as may be required to mitigate against the effects of, and comply with any reporting obligations which may apply in respect of, any such Personal Data Breach.
no Personal Data shall be transferred outside of the European Economic Area by Wayflyer unless any such transfer is effected in a manner which is compliant with Data Protection Laws.
13. Liability
Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Business and the Customer Agreements.
14. Term and termination
This DPA will remain in full force and effect until (a) expiration or termination of the Customer Agreements; or (b) Wayflyer has returned or destroyed all Personal Data in accordance with clause 15 (Data return and destruction), whichever is later.
15. Data return and destruction
Wayflyer shall: (i) at your choice, delete or return all such Personal Data to you; and (ii) delete all existing copies of such Personal Data, except where we are legally required to retain it, or where copies are retained as part of routine, automated backups, which will be deleted in the ordinary course, in which case we will retain the Personal Data in accordance with our data retention policy;
16. Contact Us
To contact us, please email privacy@wayflyer.com
Effective Date: 4 July 2024
ANNEX A
Personal Data processing purposes and details
Subject matter of processing:
Processing of Personal data obtained or accessed by Wayflyer in connection with the provision of the Services
Duration of Processing:
We will Process Personal Data (i) for the duration of the Customer Agreements; or (ii) until we have returned or destroyed all Personal Data in accordance with clause 14 (Data return and destruction), whichever is later
Nature and purpose of Processing
We will Process Personal Data as necessary to provide the Services pursuant to the Customer Agreements.
Types of Personal Data
The types of Personal Data Processed will depend upon Customer’s use of the Services but may include:
- the following, in respect of Customers and prospects:
- Identity Data includes first name, last name, username or similar identifier, title, and date of birth.
- Contact Data includes billing address, email address, and telephone numbers.
- Financial Data includes bank account and payment card details.
- Access Data includes username, login, and password details for your Bank Account, Card Processor Account and other third-party services (including, but not limited to, Adwords, Facebook, Google Analytics, Shopify, Stripe, and such other accounts as may be required from time to time), provided by Customer to us as part of the Online Application Process.
- Transaction Data includes details about payments to and from Customer and other details of services Customer has purchased from us.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices Customer uses to access Wayflyer websites.
- Profile Data includes Customer’s username and password, service purchases or orders made by Customer, their interests, preferences, feedback, and survey responses.
- Usage Data includes information about how Customer uses Wayflyer websites.
- Marketing and Communications Data includes Customer’s preferences in receiving marketing from us and our third parties and Customer’s communication preferences.
- Recruitment Data where Customer is being considered for a role at Wayflyer, CV/resume data will be processed.
- Records of discussions with our customer support teams, including call recordings, when Customer shares comments and opinions with us, ask us questions or make a complaint, including when Customer phones us, we will keep a record of this. This includes when Customer sends us emails, letters, phone our support team or contact us through social media.
- The email address of Customer’s end-users. We do not store this in a form that can be linked to that customer - we transform the information using a hashing algorithm called SHA-256. We store these hashed email addresses exclusively in order to identify trends in your customers and do not use any other personal information for any purpose.
Data Subject Categories
The categories of data subjects will depend upon Customer’s use of the Services but may concern prospects, Customers (including Customer’s employees, consultants and contractors) and Customers’ end customers.
Obligations and rights of the data controller
The obligations and rights applicable to a Controller under Data Protection Laws, including the matters specified in the Agreements
ANNEX B
Technical and Organizational Controls
Details of the technical and organisational security measures implemented by Wayflyer, including its certifications, security policies and current security posture, are set out in the Wayflyer Trust Center at https://trust.wayflyer.com/, as updated from time to time. Further security documentation is available on request.