1. 定義
このデータ処理契約の目的:
- "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion, as defined in Article 4(2) of the GDPR.
- "Controller" means the customer who determines the purposes and means of Processing Personal Data.
- "Processor" means Morlivo, which processes Personal Data on behalf of the Controller.
- "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
- "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
2. 処理内容
The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which the Processor is subject.
処理の詳細は次のとおりです。
- Subject matter: Provision of translation, transcription, and language processing services.
- Duration: For the term of the underlying service agreement.
- Nature and purpose: Processing Customer Content to deliver translations, transcriptions, and related language services.
- Categories of data subjects: End users and individuals whose data is contained within Customer Content.
- Types of personal data: Names, contact information, and any other personal data contained in materials submitted for processing.
3. セキュリティ対策
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include:
- 保存時 (AES-256) および転送中 (TLS 1.2+) の個人データの暗号化。
- 処理システムとサービスの機密性、完全性、可用性、回復力を継続的に確保する能力。
- 物理的または技術的なインシデントが発生した場合に、可用性を回復し、個人データにタイムリーにアクセスできる機能。
- 技術的および組織的対策の有効性を定期的にテスト、評価、評価します。
- 技術的に実現可能かつ適切な場合の個人データの仮名化。
- 最小特権の原則に基づいた厳格なアクセス制御。
- データアクセスの包括的な監査ログと監視。
The Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4. 副処理者
The Controller provides general authorization for the Processor to engage Sub-processors. The Processor shall maintain an up-to-date list of Sub-processors and make it available to the Controller upon request. The current list of Sub-processors is published on our Privacy Policy page.
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller a reasonable opportunity to object to such changes. Where the Processor engages a Sub-processor, the Processor shall impose on that Sub-processor, by way of contract, the same data protection obligations as set out in this DPA.
The Processor shall remain fully liable to the Controller for the performance of any Sub-processor's obligations under this DPA.
5. データ主体の権利
The Processor shall assist the Controller in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR, including:
- アクセスの権利 (第 15 条)。
- 是正する権利（第 16 条）。
- 消去する権利（第 17 条）。
- 処理を制限する権利（第 18 条）。
- データポータビリティの権利 (第 20 条)。
- 異議を唱える権利（第 21 条）。
If the Processor receives a request from a Data Subject directly, the Processor shall promptly forward the request to the Controller and shall not respond to the Data Subject directly unless authorized by the Controller.
6. 国際送金
The Processor shall not transfer Personal Data to a third country or international organization unless appropriate safeguards are in place as required by Chapter V of the GDPR. Approved transfer mechanisms include:
- 欧州委員会によって採択された標準契約条項 (SCC) (委員会実施決定 (EU) 2021/914)。
- GDPR の第 45 条に基づく十分性の決定。
- 管轄監督当局によって承認された拘束力のある企業規則。
Enterprise customers may configure data residency settings to restrict the processing and storage of Personal Data to specific geographic regions (EU, US, or APAC), minimizing the need for cross-border transfers.
7. 違反通知
The Processor shall notify the Controller without undue delay, and in any event no later than forty-eight (48) hours after becoming aware of a Personal Data breach, as defined in Article 4(12) of the GDPR.
通知には次の内容が含まれます。
- 関連するデータ主体と記録のカテゴリとおおよその数を含む、個人データ侵害の性質の説明。
- 処理者のデータ保護担当窓口の名前と連絡先の詳細。
- 侵害によって起こり得る結果の説明。
- 悪影響を軽減するための措置を含む、違反に対処するために講じられた、または提案された措置の説明。
8. 監査および検査
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable advance notice and confidentiality obligations.
9. 期間とデータの削除
This DPA shall remain in effect for the duration of the underlying service agreement. Upon termination of the service agreement, the Processor shall, at the choice of the Controller, delete or return all Personal Data and delete existing copies, unless Union or Member State law requires storage of the Personal Data. The Processor shall certify in writing that it has complied with this obligation upon the Controller's request.