DATA PROCESSING AGREEMENT
Exhibit 10.4
THIS DATA PROCESSING AGREEMENT (“Data Processing Agreement”) is made and entered into on 23 July 2020 (“Effective Date”) by and between
| 1. | Mateon Therapeutics INC., a company organized and existing under the laws of Delaware and having its registered office at 00000 Xxxxxx Xx., Xxxxx 000, Xxxxxx Xxxxx, XX 00000, XXX (“Controller”); and |
| 2. | Impatients N.V., acting under the name myTomorrows, a company organized and existing under the laws of the Netherlands and having its registered office at Xxxxxxx Xxxxxxxxx 00, 0000 XX Xxxxxxxxx, xxx Xxxxxxxxxxx (“Processor”); |
Each of the above parties are individually referred to as “Party” and jointly as “Parties”.
RECITALS
| A. | WHEREAS, Controller and Processor entered into a service agreement as of 23 July 2020 (“Agreement”) pursuant to which Processor agreed to provide certain services to Controller as specified in the Agreement, including any statements of work, and Privacy Annex (Annex 1) to this Data Processing Agreement (“Services”); |
| B. | WHEREAS, Controller engages Processor to on behalf of Controller process Personal Data defined in the Privacy Annex (Annex 1) and any other personal data processed by Processor on behalf of Controller pursuant to the Agreement (“Personal Data”); |
| C. | WHEREAS, this Data Processing Agreement includes the terms and conditions governing the processing of Personal Data by Processor on behalf of Controller with the aim to ensure the Parties comply with Applicable Laws as defined below. |
NOW, THEREFORE, the Parties agree as follows:
1. DEFINITIONS AND INTERPRETATION
1.1. For the purposes of this Data Processing Agreement, the following terms shall have the following definitions and interpretation:
“Applicable Laws” means any EU, EU Member State, national, regional and local laws, rules, regulations, declarations, requirements, guidelines approved by supervisory or other competent bodies and polices that apply to or govern the processing of Personal Data as set out in the Privacy Annex (Annex 1), including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and relevant national laws, as amended from time to time.
“EEA” means European Economic Area.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
“Subprocessor” means any data processor (including any third party and any Processor Affiliate) engaged by Processor to process personal data on behalf of Controller.
| Page 1 of 7 |
“Supervisory Authority” means (a) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (b) any similar regulatory authority responsible for the enforcement of Applicable Laws.
1.2 Other terms like “process/processing”, “data subject”, “(data) processor”, “(data) controller”, “data protection impact assessment”, etc. shall have the meaning ascribed to them in the Applicable Laws with regard to the Personal Data.
2. PROCESSING OF PERSONAL DATA
2.1. Processor shall provide the Services and shall process the Personal Data within the context of the Agreement on behalf of Controller and for the specific purposes as set out in the Privacy Annex (Annex 1) to this Data Processing Agreement.
2.2. Processor represents and warrants that it shall not process, transfer, modify, amend or alter the Personal Data or disclose or permit the disclosure of the Personal Data to any third party other than in accordance with the Controller’s documented instructions (in the Principal Agreement or otherwise), unless processing is required by EU or Member State law to which Processor is subject, in which case Processor shall to the extent permitted by such law inform Controller of that legal requirement before processing that Personal Data. Processor shall not process Personal Data for own purposes, except where it is regarded as data controller for the processing of Personal Data.
2.3. Controller represents and warrants that it is fully authorized and entitled to provide the Personal Data to Processor for processing and let Processor process the Personal Data for the purposes of the Agreement and for the specific purposes as set out in the Privacy Annex (Annex 1) and in execution of the Services.
3. DATA SUBJECT RIGHTS
3.1. Processor shall promptly, and in any case within five (5) working days, notify Controller if it receives a request from a data subject under any Applicable Laws in respect of Personal Data, including requests by a data subject to exercise rights in Chapter III of GDPR, and shall provide full details of that request.
3.2. Processor shall provide all reasonable assistance to Controller to enable Controller to comply with any exercise of rights by a data subject under any Applicable Laws in respect of Personal Data and comply with any assessment, enquiry, notice or investigation under Applicable Laws in respect of Personal Data or this Data Processing Agreement.
4. SECURITY OF PERSONAL DATA
4.1. Without prejudice to any other security requirements agreed upon between the Parties, Processor shall protect the processing of Personal Data and ensure a level of security of the Personal Data appropriate to the risk in accordance with Article 32 GDPR, among others by taking appropriate technical and organisational measures, that in view of the current state of the art and the related costs are in line with the nature of the Personal Data to be processed, the scope, context and purposes of the processing of the Personal Data, as well as the risk varying according to likelihood and severity for the rights and freedoms of data subjects. These measures encompass, where appropriate:
4.1.1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
4.1.2. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
| Page 2 of 7 |
4.1.3. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.
4.2. The Parties acknowledge that security requirements are constantly changing, and that effective security requires frequent evaluation and regular improvements of outdated security measures. Processor shall therefore continuously evaluate the technical and organisational measures as described herein and shall tighten, supplement and improve these security measures to maintain compliance with Applicable Laws.
5. PERSONAL DATA BREACHES
5.1. Processor shall notify Controller without unreasonable delay upon becoming aware of a Personal Data Breach in connection with the processing of Personal Data and shall provide Controller with information to allow Controller to meet any obligations to report a Personal Data Breach under the Applicable Laws. Such notification shall as a minimum:
5.1.1. describe the nature of the Personal Data Breach, the data subjects concerned, and the Personal Data records concerned;
5.1.2. communicate the name and contact details of Processor’s data protection officer or other relevant contact form whom more information may be obtained;
5.1.3. describe the likely consequences of the Personal Data Breach; and
5.1.4. describe the measures taken or proposed to address the Personal Data Breach.
5.2. Processor shall provide all reasonable assistance and shall take all reasonably steps to assist in the investigation, mitigation and remediation of each Personal Data Breach to enable Controller to (i) perform a thorough investigation into the Personal Data Breach, (ii) formulate a correct response; and (iii) to take further steps in respect of the Personal Data Breach in order to meet any requirements under the Applicable Laws.
6. SUBPROCESSORS
6.1. From the Effective Date of this Data Processing Agreement, Processor may use the Subprocessors set out in the Privacy Annex (Annex 1). Processor may use additional Subprocessors to process Personal Data only with the prior written approval of Controller, which approval shall not be unreasonably withheld.
7. INTERNATIONAL TRANSFERS
7.1. If and insofar the Personal Data is processed outside of the EEA, the Parties shall only process the Personal Data when there is an adequate level of protection in place.
8. CONFIDENTIALITY
8.1. In accordance with the confidentiality provisions of the Agreement, Processor shall keep Personal Data confidential. For the avoidance of doubt, all Personal Data shall be considered as Confidential Information in the Agreement.
9. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
9.1. Processor shall provide reasonable assistance to Controller with any data protection impact assessments which are required under Article 35 GDPR and with any prior consultations to any Supervisory Authority of Controller or any of its affiliates which are required under Article 36 GDPR, in each case in relation to processing of Personal Data by Processor on behalf of Controller and taking into account the nature of the processing and information available to Processor.
| Page 3 of 7 |
10. PROVISION OF INFORMATION AND AUDITS
10.1. Processor shall make available to Controller on request any relevant information that is reasonably necessary to demonstrate compliance with this Data Processing Agreement.
10.2. Processor shall allow for and reasonably contribute to audits of the processing of Personal Data and the premises where such processing takes place. Processor shall provide all reasonable cooperation to Controller in respect of any such audit and shall at the request of Controller, provide Controller with evidence of compliance with its obligations under this Data Processing Agreement. Processor shall immediately inform Controller if, in its opinion, an instruction pursuant to this Clause 10 infringes any Applicable Laws.
11. INDEMNITY AND LIABILITY
11.1. Notwithstanding any provisions of the Agreement or this Data Processing Agreement to the contrary, each Party shall indemnify, defend and hold harmless the other Party from any claims (including third party claims), suits, demands, judgements, actions, liabilities, expenses (including reasonable attorney’s fees) and damages of any kind relating to its breach of this Data Processing Agreement, and/or its negligence or wilful misconduct.
11.2. Notwithstanding any provisions of the Agreement or this Data Processing Agreement to the contrary, the limitation of liability set forth in the Agreement shall also apply to this Data Processing Agreement.
12. DURATION AND TERMINATION
12.1. This Data Processing Agreement shall remain in full force and effect for the duration that Processor processes Personal Data on behalf of Controller under the Agreement.
12.2. Any obligation imposed on either Party under this Data Processing Agreement, or any provision that by their nature is intended to survive this Data Processing Agreement shall survive any termination or expiration of this Data Processing Agreement.
13. STORAGE, RETURN AND DESTRUCTION
13.1. Processor shall store the Personal Data no longer than strictly necessary (i) for the provision of Services; (ii) if a storage period is agreed between the Parties, no longer than this storage period; or (iii) to comply with statutory obligations.
13.2. Processor shall promptly, of the earlier of: (i) no longer processing of Personal Data; or (ii) termination of the Agreement, at the choice of Controller either: (a) return a complete copy of all Personal Data to Controller and securely wipe all other copies of Personal Data processed by Processor or any Subprocessor; or (b) securely wipe all copies of Personal Data processed by Processor or any Subprocessor; and in each case provide written confirmation to Controller that it has complied with this Clause 13, except insofar Processor is required by Applicable Laws to retain such Personal Data.
14. MISCELLANEOUS
14.1. Modifications or amendments of this Data Processing Agreement shall only be effective if made in writing and signed by an authorized representative of both Parties.
14.2. If any provision of this Data Processing Agreement is invalid or unenforceable, then the remainder shall remain valid and in force.
14.3. In the event of inconsistencies between the provisions of this Data Processing Agreement and the Agreement and/or any Scope of Work, the provisions of this Data Processing Agreement shall prevail with regard to the Parties’ data protection obligations.
| Page 4 of 7 |
14.4. This Data Processing Agreement shall be governed by and in accordance with the laws of the Netherlands, without giving effect to any choice of law principles that would require the application of the laws of a different jurisdiction. Any disputes arising out or in connection with this Data Processing Agreement shall be brought exclusively before the competent court of Amsterdam, the Netherlands.
IN WITNESS WHEREOF, the Parties hereto have executed this Data Processing Agreement as of the Effective Date by their duly authorized signatories.
| Impatients N.V. | Mateon Therapeutics INC. | |||
| Signature: | /s/ Xxxxx Xxxxx | Signature: | /s/ Xxxxx Xxxx xx Xxxxxxx | |
| By: | Xxxxx Xxxxx | By: | Pieter Xxxx xx Xxxxxxx | |
| Title: | CEO | Title: | General Counsel | |
| Date: | 24 July 2020 | Date: | 23 July 2020 | |
| Page 5 of 7 |
PRIVACY ANNEX (ANNEX 1)
1. SUBJECT MATTER OF THE PROCESSING OF PERSONAL DATA
Processor and Controller have entered into the Agreement pursuant to which Processor agreed to provide certain Services to Controller, wherein Processor, as a service provider to Controller, shall conduct Expanded Access Program management and RWD collection management for (potential) patients on behalf of Controller. In providing these Services, Processor shall process Personal Data of these (potential) patients. This Annex 1 states which Personal Data will be processed by Processor and for what purposes.
2. NATURE AND PURPOSE OF THE PROCESSING OF PERSONAL DATA
Controller shall obtain the necessary consent of the (potential) patients participating in Expanded Access Programs, to be processed by Processor for the following purposes:
| ● | Expanded Access Program management on Mateon’s behalf for the Services as specifically described in the Agreement (and separate Statements of Work). | |
| ● | RWD collection management on Mateon’s behalf for the Services as specifically described in the Agreement (and separate Statements of Work). |
3. CATEGORIES OF PERSONAL DATA TO BE PROCESSED
Processor shall process the following (categories of) Personal Data in the performance of the Services to Controller under the Agreement:
| ● | Personal identification data including first name, last name, initials, date of birth, sex/gender, email address, phone number, city of residence, country of residence. | |
| ● | Technical/device data including browser, IP-address, usernames. | |
| ● | Personal medical data including relevant health care information (e.g. weight, heart rate, disability), relevant demographics, relevant disease history, dosing, safety data, effectiveness data, ethnic origin (if necessary). |
4. CATEGORIES OF DATA SUBJECTS TO WHOM THE PERSONAL DATA RELATES
Processor shall process the Personal Data of the following (categories of) data subjects in the execution of the Services to Controller under the Agreement:
| ● | Patients participating in an Expanded Access Program | |
| ● | Patients participating in RWD collection. |
5. LIST OF SUBPROCESSORS
Processor uses the following Subprocessors in the execution of the Services to Controller under the Agreement:
| Name | Description | Location | ||
| Microsoft Azure / Dynamics 365 | Provides applications and servers that myTomorrows uses for general day-to-day business and performance of its day-to-day services to clients (e.g. emails and storage). | EU | ||
| Castor EDC | Provides an application and servers for the collection and management of data that is used by myTomorrows in the performance of the Services, including RWD collection. | EU |
| Page 6 of 7 |
6. DATA PROTECTION CONTACTS
All notices, requests, demands and approvals under this Data Processing Agreement and with regard to any privacy matters shall be sent to the following contacts:
| myTomorrows | ||
| Name: | Pieter Xxxx xx Xxxxxxx | |
| Function: | General Counsel and Data Protection Officer | |
| Email: | xxxxxxxxxx.xxxxxxxxx@xxxxxxxxxxx.xxx | |
| Phone: | x00 (0)00 000 0 000 | |
| Mateon Therapeutics | ||
| Name: | ||
| Function: | ||
| Email: | ||
| Phone: | ||
| Page 7 of 7 |
