Sign Up

CAMP Software
Data Privacy Addendum

This Data Privacy Addendum (the “DPA”) supplements and is incorporated into the Subscription Services Agreement or other agreement between CAMP Software, Inc. (“CSI”) and the person or entity acquiring services from CSI (“Subscriber”) (collectively the “Agreements”). By signing the Agreements, you enter into this DPA on behalf of yourself and in the name of your affiliates as appropriate. Any capitalized term not defined herein will have the meaning given to it in the relevant Agreements.
1. Definitions: Unless otherwise defined herein, all terms shall be as defined in Data Protection Laws.

1.1  “Subscriber  Personal Data” means any information provided to, collected by, or accessed by CSI under the Agreements, in any form or format, that is defined as personal information under Data Protection Laws and that: (a) relates to Subscriber ’s employees, representatives, personnel or end users of the Services, or (b) relates to individuals whose information is processed by CSI as a result of Subscriber ’s use of the Services.

1.2  “Data Protection Laws” means any laws, statutes, declarations, decrees, directives, legislative enactments, orders, ordinances, regulations, rules, or other binding restrictions (including any amendments or successors thereto) pertaining to data protection, privacy, security, and/or the processing of Subscriber Personal Data, to the extent applicable to a party’s obligations under the Agreements.

1.3  “SCC” means sections I, II, III and IV (as applicable) to the extent they reference Module Two (Controller-to-Processor) within the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj  (as well as any amendment, or new legal requirement or contract that replaces, supersedes, or is required to be implemented in connection with the SCC) and as set forth in this DPA.

1.4  “Services” means the software and other offerings provided by CSI to Subscriber as more fully described in the Agreements.

1.5  “Security Breach” means a breach of CSI’s security leading to the accidental or unauthorized access, loss, alteration, or disclosure, of Subscriber Personal Data transmitted, stored, or processed by CSI. A Security Breach shall not include unsuccessful attempts or activities that do not compromise the security of Subscriber Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attaches, or other network attacks on firewalls or networked systems. In addition, a Security Breach shall not include accidental or unauthorized access, loss, alteration, or disclosure, of Subscriber Personal Data arising from the acts or omissions of Subscriber or its employees, agents, or contractors.
2. Processing Details:
2.1 Roles of the Parties. The parties acknowledge and agree that with respect to processing Subscriber Personal Data under this DPA, Subscriber is a “Controller” or “Business” and CSI is a “Processor” or “Service ” The Agreements and this DPA constitute Subscriber ’s instructions to Process Subscriber Personal Data. The description of the processing is set out in Annex 1 Part 1.

2.2 Scope of Processing. CSI will use and Process Subscriber Personal Data to: (i) adhere to Subscriber instructions to deliver the Services and fulfill CSI’s obligations under this DPA, (ii) communicate about the Services and CSI’s affiliate offerings, (iii) detect, investigate, and remediate security incidents and/or a Security Breach, fraud, or other illegal activities, (iv) fulfill internal business purposes, including finance, accounting, and auditing, (v) comply with applicable laws, regulations, and legal processes, and (vi) as otherwise described in the Agreements. CSI will not “Sell” or “Share” Subscriber Personal Data, and CSI will inform Subscriber of any legal requirement which prevents it from complying with Subscriber’s instructions, unless prohibited from doing so by applicable law.

2.3 Subscriber Obligations. Subscriber represents and warrants that, as applicable to Subscriber’s use of the Services, Subscriber shall: (i) comply with Data Protection Laws with respect to Subscriber Personal Data collected, processed, shared, or provided to CSI in using the Services, (ii) maintain a conspicuous privacy notice and/or other legally-required statement, which accurately discloses all applicable data collection, use, sharing, disclosure, and security practices, (iii) secure any required permissions and/or consents or, if otherwise required under Data Protection Laws, establish a valid legal basis to collect, obtain, and share Subscriber Personal Data with CSI for the purposes of providing the Services, and (iv) establish and maintain processes for the exercise of rights individuals may be granted with respect to their Subscriber Personal Data.
3. Data Subject Rights. Subscriber is responsible for responding to any request by a data subject to exercise their rights under Data Protection Laws (each a “Request”). CSI shall reasonably cooperate with Subscriber to enable Subscriber to respond to a Request. In the event that any Request is made directly to CSI, CSI shall direct the data subject to Subscriber to exercise their rights in relation to Subscriber Personal Data and will not directly respond to a Request. CSI shall provide Subscriber with reasonable assistance to enable Subscriber to fulfill its obligations in responding to a Request.

4. Subcontractors and Personnel


4.1 Personnel. CSI shall: (i) inform its personnel with access to Subscriber Personal Data of the confidential nature of Subscriber Personal Data, and (ii) obligate such personnel to maintain the confidentiality of Subscriber Personal Data.


4.2 Subcontractors.


4.2.1 Subscriber consents to CSI engaging subcontractors or subprocessors to process Subscriber Personal Data (collectively “Subprocessors”) to perform the Services. The current list of Subprocessors (“Subprocessor List”) is incorporated herein as Annex 2 CSI shall update Subscriber with any changes to processors in advance of such change (except where shorter notice is required due to exceptional circumstances). In the event Subscriber reasonably objects to a change made to the Subprocessor List and CSI is unable to provide the Services without the use of such Subprocessor and no other reasonable solution can be mutually agreed to, either party may promptly terminate the Agreements (in whole or in part), by providing written notice to the other party and Subscriber will receive a prorated refund of any prepaid, unused fees for the period following the effective date of termination.


4.2.2
Where CSI uses any Subprocessors to process Subscriber Personal Data to provide the Services, CSI shall contractually impose at least the same level of protection for Subscriber Personal Data as provided for in this DPA. CSI shall require that persons authorized to process Subscriber Personal Data are: (i) informed of the confidential nature of Subscriber Personal Data, and (ii) obligated to keep Subscriber Personal Data confidential. CSI shall remain liable for any breach of the Agreement caused by a Subprocessor to the same extent as if CSI had caused such breach.

5. Security Measures and Compliance Audits. In performing the Services, CSI will implement appropriate technical and organizational security measures to protect Subscriber Personal Data from a Security Breach using measures appropriate to the risks that are presented by the nature of the processing of Subscriber Personal Data (and such measures will meet or exceed those identified in Annex 1 Part I).
6. Security Breach. In the event of a confirmed Security Breach affecting Subscriber Personal Data, CSI shall: (i) promptly inform Subscriber and provide details of the Security Breach Subscriber Personal Data, (ii) provide timely information and reasonable cooperation as Subscriber may require to fulfill its data breach reporting obligations under Data Protection Laws or respond to any inquiries by a data protection authority that may arise from the Security Breach, (iii) investigate the Security Breach, and (iv) take such measures and actions as are appropriate to remedy or mitigate the effects of the Security
7. Data Protection Impact Assessments. CSI will provide Subscriber with reasonable cooperation and assistance in relation to any data protection impact assessment or regulatory consultation that Subscriber is required to make in respect of Subscriber Personal Data under Data Protection Laws.
8. De-Identified Information. CSI may de-identify, anonymize and/or aggregate Subscriber Personal Data and other information derived from the Services, including usage data, statistical and other information related to the performance, operation and use of the Services, and analyses for security and operations management (the “De-identified Information”).
9. Removal and/or Transfer: Upon termination of the Agreement or earlier upon Subscriber’s reasonable request, CSI will cooperate with the removal of Subscriber Personal Data from CSI’s systems unless otherwise provided by applicable laws. CSI may charge Subscriber commercially-reasonable fees to be mutually agreed upon in connection with the removal of Subscriber Personal Data.
10. Cross-Border Data Transfers. Subscriber agrees that CSI and its subprocessors may transfer, store, and Process Subscriber Personal Data in locations other than Subscriber’s country. Where CSI engages in an onward transfer of Subscriber Personal Data, CSI shall employe a lawful data transfer mechanism for transferring Subscriber Personal Data from one country to another.

10.1.1To the extent legally required, by signing the Agreements, Subscriber and CSI are deemed to have signed the SCCs, which form part of this DPA and (except as described in Sections 9.2 and 9.3 below) will be deemed completed as follows: (i) CSI is the “data importer”, and Subscriber and its affiliates established within the European Economic Area that are using the Services are collectively the “data exporter” and each shall comply with the SCC, including the additional terms in this section and Annex 1 Part I; (ii) this DPA and the Agreements constitute Subscriber’s written instructions for purposes of Clause 8.1(a) of the SCC and for the avoidance of doubt include onward transfers to a third party located outside the EEA for the purpose of the performance of the Services; and (iii) by executing this DPA, the parties are executing the SCC. In case of any transfers of Subscriber Personal Data under the SCC from Switzerland subject exclusively to Swiss Data Protection Laws (i) general and specific references in the SCC to GDPR or EU or Member State Law shall hereby be deemed to have the same meaning as the equivalent reference in Swiss Data Protection Laws; and (ii) any other obligation in the SCC determined by the Member State in which the data exporter or data subject is established shall hereby be deemed to refer to an obligation under Swiss Data Protection laws.

10.1.2 With respect to Subscriber Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses as set forth in Annex 1 Part II (“UK SCCs”) forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK SCCs.

10.1.3 Notwithstanding the foregoing, to the extent an alternative legally permissible data transfer mechanism for international transfers under this DPA is available during the term of the Agreements, the parties may cooperate to implement such alternative mechanism in lieu of the SCC.
11. Miscellaneous. All notices under this DPA shall be made in accordance with the Agreements. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected. In the event of any conflict or inconsistency between this DPA and any privacy or security provisions set out in any agreement between the parties, the parties agree that the terms of this DPA shall prevail only with respect to the matters specifically addressed in this DPA. Each party acknowledges that it has read and understood the terms of this DPA and agrees to be bound by them.

Annex 1

Part I: Information Required for the SCC

For the purposes of the SCC, Subscriber is the data exporter and CSI is the data importer and the Parties agree to the following. The information required for the purposes of the Appendix to the SCC is set out in this Annex 1 Part I.
Information required for Sections I – IV of the SCC
Clause 7 (Docking Clause)The option under clause 7 shall apply.
Clause 9 (use of sub-processors)Option 2 under clause 9 shall apply. For the purposes of clause 9(a), the agreed list of sub-processors is set out as provided in Section 4.2 of this DPA. CSI shall inform Subscriber of any changes to sub-processors following the procedure provided for in Section 4.2 of this DPA.

Where CSI enters into the SCC with a sub-processor in connection with the provision of the Services, Subscriber hereby grants CSI authority to provide a general authorisation on Subscriber's behalf for the engagement of sub-processors by those sub-processors engaged in the provision of the Services, as well as decision making and approval authority for the addition or replacement of any such sub-processors.
Clause 11 (Redress)The option under Clause 11 shall not apply.
Clause 13 (Supervision)At Clause 13(a), all three options are retained and apply as relevant where the transfer falls within the territorial scope of Regulation (EU) 2016/679.

Where Subscriber is established in the United Kingdom or falls within the territorial scope of application of UK Data Protection Laws, the Information Commissioner's Office shall act as competent supervisory authority.

Where Subscriber is established in Switzerland or falls within the territorial scope of application of Swiss Data Protection Laws and Regulations, the Swiss Federal Data Protection and Information Commissioner shall act as competent supervisory authority insofar as the relevant data transfer is governed by Swiss Data Protection Laws and Regulations.
Clause 17 (Governing Law)The governing law for the purposes of Clause 17 shall be (i) the laws of the EU Member State in which the Data Exporter is established where the relevant transfer falls within the territorial scope of application of Regulation (EU) 2016/679; or (ii) the laws of England & Wales.
Clause 18 (Choice of forum and jurisdiction)The courts under Clause 18 shall be (i) the courts of Spain where the relevant transfer falls within the territorial scope of application of Regulation (EU) 2016/679; or (ii) the courts of England & Wales. For Data Subjects habitually resident in Switzerland, the courts of Switzerland are an alternative place of jurisdiction in respect of disputes.
Information to be incorporated into Annex I of the SCC
Data ExporterName: The Data Exporter is Subscriber as defined on page 1 of the DPA and its affiliates established within the EU, Switzerland and/or the UK that are using the Services.

Address: As set out in the Agreements.

Contact person’s name, position and contact details: As set out in the Agreements.

Activities relevant to the data transferred under these Clauses: Recipient of the Services pursuant to the Agreement.

Signature and date: By entering into this DPA, Data Exporter is deemed to have signed the SCC, including the Appendix to the SCC.

Role (controller/processor): Controller
Data ImporterName: The Data Importer is CSI as defined on page 1 of the DPA

Address: 11 Continental Blvd, Suite C Merrimack, NH 03054

Contact person’s name, position and contact details: Privacy Team, support@campsoftwareinc.com

Activities relevant to the data transferred under these Clauses:

Signature and date: By entering into this DPA, Data Importer is deemed to have signed the SCC, including the Appendix to the SCC.

Role (controller/processor): Processor.
Categories of data subjects whose personal data is transferredSubscribers and their authorized representatives and users, as well as individuals whose personal data Subscribers may provide in connection with the Services (e.g., personal information relating to Subscribers’ customers, crew information, passengers’ information).
Categories of personal data transferredDepending on the data subject, the personal data transferred may include:

• Personal and work contact information (name, phone number, email address, company information).

• Financial information which Customer chooses to provide (e.g., payment card information, transactional data)

• Flight and aircraft information (e.g., origin and destination, airports, aircraft tail number)

•Passenger information (name, email address, customs clearance information)
Sensitive data transferred (if applicable)None
Frequency of the transferOn-going basis depending on the use of the Services by Subscriber
Nature of the processingCSI will use the personal data transferred on behalf of and at the direction of the Subscriber to provide the Services contracted by the Subscriber, and as set forth in Section 2.2 of this DPA.
Purpose(s) of the data transfer and further processingCSI will process Subscriber Personal Data as necessary in order to perform the Services and any related activities set forth in the Agreements.
Duration of ProcessingCSI will process Subscriber Personal Data for the duration of the Agreements unless otherwise agreed upon in writing.
Sub-Processor TransfersSub-processors will process Subscriber Personal Data (i) as necessary to perform the Services pursuant to the Agreements and (ii) for the duration of the Agreements, unless otherwise agreed in writing.
Competent Supervisory AuthorityAs set out above against Clause 13.
Information to be incorporated into Annex II of the SCC
Technical and Organisational MeasuresIn addition to any data security requirements set forth in the Agreements, CSI shall comply with the following:

CSI will implement, maintain, and continuously control and update, appropriate technical and organisational security measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected. These measures may include:

1. Preventing unauthorised persons from gaining access to data processing systems with which personal data are processed or used (physical access control) by taking measures such as:

• Documenting security and other incidents, maintaining an incident log;

• Protecting and managing physical access to assets and facilities; and

• Implementing and maintaining security controls for each computer room and/or data centre and any area containing personal data.

2. Preventing data processing systems from being used without authorisation (logical access control) by taking measures such as:

•Using appropriate network security devices such as intrusion detection systems, routers and firewalls;

• Periodic review of user access to sensitive applications;

• Secure log-in with unique user-ID/password for each user;

• Locking of unattended workstations;

• Role-based access for critical systems containing personal data;

• Implementing and maintaining process for routine system updates for known vulnerabilities;

• Monitoring for security vulnerabilities on critical systems and applications;

• Deployment and updating of antivirus software; and

• Compliance with applicable laws, regulations and industry standards (including, where relevant, the Payment Card Industry Data Security Standard).

3. Ensuring that persons entitled to use a data processing system can gain access only to the data to which they have a right of access, and that, in the course of processing or use and after storage, personal data cannot be read, copied, modified or deleted without authorisation (access control to data) by taking measures such as:

• Using appropriate network security devices such as intrusion detection systems, routers and firewalls;

• Monitoring the network to detect potential cybersecurity events (i.e. malware, DDoS etc);

• Secure log-in with unique user-ID/password for each user;

• Logging and analysis of system usage;

• Role based access for critical systems containing personal data;

• Deployment and updating of antivirus software;

• Maintaining a documented incident response plan that addresses actions to be carried out should an incident occur; and

• Implementing and maintaining response and recovery procedures which are tested in the event of a disaster.

4. Ensuring that personal data cannot be read, copied, modified or deleted without authorisation during electronic transmission, transport or storage and that it is possible to verify and establish to which bodies the transfer of personal data by means of data transmission facilities is envisaged (data transfer control) by taking measures such as:

Where appropriate in light of the types or nature of the data processed, encryption of communication, tunnelling (VPN = Virtual Private Network), content filter for outgoing data, firewall and secure transport containers in case of physical transport.

5. Ensuring that personal data are protected against accidental destruction or loss (availability control) by taking measures such as:

Maintaining backup procedures and recovery systems, storing redundant servers in separate location, mirroring of hard disks, maintaining uninterruptible power supply and auxiliary power unit, remote storage, climate monitoring and control for servers, fire resistant doors, fire and smoke detection, fire extinguishing system, anti-virus/firewall systems, malware protection, disaster recovery and emergency plan.

6. Ensuring that data collected for different purposes or different principals can be processed separately (separation control) by taking measures such as:

• Implementing data segregation where applicable.

Part II: UK Addendum

For the purposes of this UK Addendum, Subscriber is the data exporter and CSI is the data importer and the Parties agree to the following. To the extent that any transfer of Subscriber Personal Data is subject to United Kingdom law, the UK SCCs shall be deemed executed as follows:
Part 1:
(a) Part 1 Table 1:
a. The start date shall be as set out in the Agreements

b. The parties’ details shall be the parties and their affiliates to the extent any of them is involved in such transfer. For the avoidance of doubt, Subscriber and its affiliates shall be deemed the “exporter,” and CSI and its affiliates shall be deemed the “importer” of such data.

c. Key Contacts:
i. The Key Contact for the data importer shall be the Privacy Team, support@campsoftwareinc.com
ii. The Key Contact for the data exporter shall be the contact as identified in the Agreements

(b) Part 1 Table 2: the Approved SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties.

(c) Part 1 Table 3: The information required for the purposes of Table 3 is set forth in Annex 1 Part I.

(d) Part 1 Table 4: Neither party may end this DPA as set out in Section 19 of the UK SCCs.

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.