Certain words and phrases in this DPA have specific definitions when they start with capital letters. Where a defined term is used, it either has the meaning set out in annex 1 below (Definitions) or the meaning given to it in the relevant clause of this DPA. ”Data controller”, “data subject”, “personal data”, “process”, “processing”, “data processor” “data subject request”, “personal data breach”, “subprocessors” and “supervisory authority” shall have the meaning given to it in the Data Protection Legislation. Where this DPA refers to Sunday as a "data processor", this shall also mean "service provider" or "contractor" as defined under applicable U.S. state privacy laws (including the CCPA/CPRA). Where this DPA refers to the Merchant as a "data controller", this shall also mean "business" as defined under such laws.

2.5 De-Identification and Derived Data. In the course of its activities as an independent business collecting and processing User Data under this clause 2, Sunday is authorized to de-identify, anonymize and aggregate User personal data to create data sets that do not identify and cannot reasonably be used to identify, directly or indirectly, any User or the Merchant ("Derived Data"), as defined in Section 12.3 of the Agreement. The purposes and modalities of such processing are described in Sunday's User Privacy Policy. Derived Data does not constitute personal data or personal information within the meaning of the Data Protection Legislation (including the CCPA/CPRA). The creation, use and exploitation of Derived Data by Sunday is not subject to the obligations of this DPA relating to the processing of personal data. The Merchant acknowledges that the creation of Derived Data falls within Sunday's own business purposes and does not constitute processing carried out on behalf of the Merchant within the meaning of clause 3 of this DPA.

2.6 De-Identification of Merchant Data for Derived Data. Pursuant to the license granted by the Merchant under Section 12.3(a) of the Agreement, Sunday shall de-identify, anonymize and aggregate personal data contained in Merchant Data (including, where applicable, data relating to the Merchant's personnel) for the purpose of creating Derived Data. For the purposes of clause 3.2 of this DPA, this constitutes a documented instruction from the Merchant, the execution of which results in the creation of data that no longer constitutes personal data or personal information within the meaning of the Data Protection Legislation. Once Derived Data has been created, it is no longer subject to the obligations of this DPA relating to the processing of personal data. The conditions of use and exploitation of Derived Data are governed exclusively by Section 12.3 of the Agreement.

3.5 Sunday shall assist the Merchant in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators.

3.6 Sunday shall notify the Merchant without undue delay upon becoming aware of and confirming any accidental, unauthorized, or unlawful processing of, disclosure of, or access to the personal data.

3.7 In order to provide the Sunday Services to the Merchant, Sunday may access and process personal data in any country where Sunday or its subprocessors operate, provided that appropriate safeguards are in place. Where personal data originating from the European Economic Area or the United Kingdom is processed outside those jurisdictions, Sunday and the relevant subprocessor shall ensure that a Valid Transfer Mechanism is in place. Sunday shall comply with all applicable data transfer requirements under the Data Protection Legislation.

3.8 Sunday shall at the written direction of the Merchant, delete or return personal data and copies thereof to the Merchant on termination of this DPA unless required by Data Protection Laws or other applicable laws to store personal data.

3.9 Sunday shall implement, and at all times during this DPA maintain technical and organizational safeguards to protect personal data from unauthorized or unlawful processing or accidental loss or damage: (i) ensuring in each case a level of security appropriate to the risk; and (ii) maintaining PCI DSS level 1 service provider certification; and (iii) in addition maintaining controls in line with accepted industry practices including the International Organization for Standardization's standards: Requirements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

3.10 At a minimum, Sunday’s safeguards for the protection of personal data shall include: (i) securing, cloud systems, backup systems, and computing equipment, including, but not limited to, all endpoint devices and other equipment with information storage capability; (ii) implementing network, application, database, and platform security; (iii) securing information transmission, storage, and disposal; (iv) implementing authentication and access controls within media, applications, operating systems, and equipment; (v) encrypting personal data at rest where possible; (vi) encrypting personal data transmitted over transit in network; (vii) strictly segregating Merchant data from information of Sunday or its other customers so that Merchant Data is not commingled with any other types of information; (viii) conducting risk assessments, and vulnerability scans and promptly implementing, at Sunday’s sole cost and expense, a corrective action plan to correct any issues that are reported as a result of the testing; (ix) implementing appropriate personnel security and integrity procedures and practices; and (x) providing appropriate information security awareness training to Sunday employees.

a data transfer mechanism permitted by the Data Protection Laws as a lawful basis for transferring personal data to a recipient located in a third country in the meaning of GDPR and the Data Protection Act 2018.

Merchant Data which may include personal data or personal information (in particular data relating to the Merchant's personnel such as first name, surname, contact details, role); transactional data relating to the Merchant's Establishment(s); User personal data to the extent processed on the Merchant's documented instructions.

Merchant's personnel (including servers); Users (to the extent their data is processed on behalf of the Merchant in accordance with its documented instructions).

The term of the Agreement, plus the period necessary for the deletion or return of all personal data by Sunday in accordance with clause 3.8 of this DPA.