THIS DATA PROCESSING ADDENDUM is entered into as of the DPA Effective Date by and between: (1) Bottomline Technologies Limited, a company incorporated and registered in England with company number 8098450 whose registered office is at 1600 Arlington Business Park, Theale, Reading, Berkshire, England, RG7 4SA (“Bottomline”); and (2) the entity who is a counterparty to the Agreement into which this Data Processing Addendum is incorporated and forms a part (“Customer”), and records the Parties’ agreement with respect to the terms and conditions governing the Processing and security of Personal Data provided to Bottomline pursuant to the Agreement.
Supplementary Data Privacy Terms
Current Data Protection Laws mandate that the Processing of Customer Personal Data that Bottomline carries out on your behalf is subject to a contract containing certain specific terms (these are set out in Article 28(3) of the GDPR).
We have determined that a number of our customers have older contracts which do not contain these required terms and have therefore prepared a new Data Processing Agreement “(DPA”) to ensure that these mandated terms are in place for those customers. This new data processing agreement will apply to all customers who have older contracts which do not contain a data processing agreement, a data processing addendum, or a set of integral data processing terms integral to an agreement, which establish the contractual terms required by Article 28(3) of the GDPR.
Please review the latest DPA at the earliest opportunity. Clause 2 of the DPA will enable you to determine whether or not these new terms apply to your organisation, and if so, when the new terms will come into force. For the avoidance of doubt, if your organisation has already negotiated a data processing agreement, data processing addendum or set of integral terms which specifically addresses the requirements of Article 28(3) of the GDPR, this will remain force, and the new DPA will not apply to your organisation.
IMPORTANT NOTES:
- (A) This Data Processing Addendum does not apply to customers with whom Bottomline has (prior to 3rd April 2019) separately agreed a data processing agreement, a data processing addendum, or a set of data processing terms integral to an agreement, which establish the contractual terms required by Article 28(3) of the GDPR in respect of Bottomline’s Processing of those customers’ Personal Data in connection with the Relevant Services.
- (B) Please pay particular attention to Section 2.1, which determines if and when the terms of this Data Processing Addendum will come into force and effect, and form part of your Agreement with Bottomline.
- (C) The Data Protection Laws mandate that the Processing of Customer Personal Data that Bottomline carries out on your behalf is subject to a contract containing certain specific terms (these are set out in Article 28(3) of the GDPR). We have prepared this Data Processing Agreement to ensure that these mandated terms are in place.
- (D) Due to the importance of the factors outlined in (C) above, for customers without existing GDPR compliant agreements with Bottomline, this Data Processing Agreement will come into force and effect in accordance with Section 2.1 notwithstanding any ‘No Variation’, ‘Entire Agreement’ or similar provisions in the Agreement.
