Data Processing Agreement (DPA)

If Behaviorquant processes data on your behalf, it does so on the basis of the Data Processing Agreement below, the terms of which you have confirmed by accepting the Behaviorquant Terms of Use.

Last modified: August 28, 2022

1. Preamble
1.1. Behaviorquant as the Processor (hereinafter referred to as the “Processor”) has undertaken to provide the data processing services described below to you as the Controller (hereinafter referred to as “Controller”). This contract is to be understood as a supplement to the Behaviorquant Terms of Use and specifies the obligations of the Parties regarding data protection that arise from the existing Behaviorquant Terms of Use regarding data processing described in detail. For the purposes of this Agreement, the definitions of terms in the General Data Protection Regulation (Regulation (EU) 2016/679) shall apply.

2. Subject Matter of this Agreement
2.1. The object of the service provision by the Processor for the Controller is the use of data of the Controller for the use of the BQ Software provided by the Processor. The software enables an objective behavioral analysis of decision makers in the finance and investment sector. This generates algorithmically and on the basis of an automated dialogue from science-based stimuli (e.g. questions, tasks and scenarios) feature profiles and behavioral predictions of the users as well as recommendations for decision support and behavior optimization. In this context, the scope, nature and purpose of the data processing are limited to the use of the data categories listed under point 2.2. Special categories of data pursuant to Articles 9 and 10 of the GDPR may only be processed in the systems of the Processor with the written consent of the Controller.

2.2. The following categories of data are processed:
First name, last name, e-mail address, risk attitudes, perceptions and attitudes towards market and investment issues, personality, interests and values, decision-making and information processing style, behavior in investment simulations and amount of fictitious investments, behavioral and cognitive information processing and biases, sentiment and risk assessments about the money and financial markets, response behavior, sociodemographic and firmographic characteristics on gender, age, educational and professional background, professional position, length of work experience, country of occupation, company type and size.

2.3. The following categories of data subjects will be subject to the processing:
Clients, employees, investment target employees.

2.4. The processing of data by the Processor shall generally take place within the European Union or in another contracting state of the Agreement on the European Economic Area (EEA). The Processor is nevertheless permitted to process data outside the EEA in compliance with the provisions of this Agreement if it informs the Controller in advance of the location of the data processing and the requirements of Articles 44 – 48 of the GDPR are met or an exception pursuant to Article 49 of the GDPR applies. The Controller acknowledges that the Processor may also agree with sub-processors on processing outside the EEA, provided that such processing is carried out under the conditions of Art. 44 – 48 of the GDPR or an exception pursuant to Art. 49 of the GDPR exists.

3. Duration of the Agreement
3.1. The term of this Agreement shall be governed by and shall correspond to the term of the respective main agreement, unless the provisions of this agreement give rise to obligations exceeding the aforesaid term.

4. Duties of the Processor
4.1. Right to issue instructions
The Processor shall not make any decision on its own responsibility regarding the way in which the Controller’s data is used. The Processor shall use data and processing results exclusively within the scope of the Controller’s order and on the basis of documented written instructions and shall return them exclusively to the Controller or shall only carry out transfers on the basis of the Controller’s written order. If, in the opinion of the Processor, a written instruction from the Controller violates data protection law, the Processor shall comply with its legal obligation to warn the Controller. The Controller must have issued a written order to use the data provided for the Controller’s own purposes (see Section 4.10.).

4.2. Official order
If the Processor is requested to release data of the Controller on the basis of an official order, the Processor must – if legally permissible – inform the Controller immediately and refer the authorities to the Controller.

4.3. Confidentiality
The Processor declares that all persons entrusted with data processing have been obligated to maintain data secrecy and confidentiality or that they are subject to an appropriate legal obligation of confidentiality. In particular, the confidentiality obligation of the person entrusted with the Data Processing shall remain in force even after the termination of his/her activity and leaving the Processor.
The confidentiality obligation shall also apply to legal entities and partnerships.

4.4. Data Security
The Processor shall take sufficient security measures pursuant to Art 28 (3) lit c and Art 32 of the GDPR, in particular in connection with Art 5 (1) of the GDPR, in order to prevent data from being used improperly or made accessible to third parties without authorization. The measures to be taken are data security measures and measures to ensure a level of protection appropriate to the risk with regard to confidentiality, integrity, availability and resilience of the systems. The state of the art, the implementation costs and the type, scope and purposes of the processing shall be taken into account. The Processor shall take all necessary measures to ensure the security of the Processing pursuant to Art 32 (1) of the GDPR. Technical and organizational measures to be taken by the Processor in principle are listed in Appendix 1, for example.

4.5. Data subject rights
The Processor shall implement the technical and organizational measures to enable the Controller to fulfill the rights of the Data Subjects under Chapter III of the GDPR (information, access, rectification and erasure, data portability, objection as well as automated decision-making in individual cases) at any time within the statutory period and shall provide the Controller with all information necessary for this purpose. If a corresponding request is addressed to the Processor and the Processor indicates that the Applicant mistakenly considers it to be the Controller of the data application it operates, the Processor shall forward the request to the Controller without undue delay and notify the Applicant thereof.

4.6. Review
The Controller shall have the right to inspect and control at any time, including through third parties commissioned by it, the processing of the data provided by it. This shall also include the right of the Controller to carry out inspections (by the Controller itself or by an auditor appointed by it) at the premises of the Processor. The Processor shall provide the Controller with any information necessary to monitor compliance with this Agreement.

4.7. Support
The Processor shall support the Controller by taking appropriate technical or organizational measures to comply with the obligations set out in Art 32 to 36 GDPR (data security measures, notifications of personal data breaches to the supervisory authority, notification of the person affected by a personal data breach, data protection impact assessment, prior consultation).

4.8. Data protection impact assessment
In particular, the Processor shall, upon request of the Controller, assist the Controller in ensuring compliance with all obligations of the Controller in relation to data protection impact assessments and prior consultation, including the obligations of the Controller under Articles 35 and 36 of the GDPR, where the Controller does not otherwise have access to the relevant information and such information is available to the Processor. The Processor shall provide the Controller with appropriate assistance in cooperating with the Supervisory Authority in the performance of its tasks.

4.9. Processing directory
The Processor shall maintain a processing directory for the present commissioned processing in accordance with Art 30 GDPR.

4.10. Return of personal data
Within three months after the termination of this Agreement, the Processor shall either hand over to the Controller or destroy on the Controller’s behalf all Processing Results and documents containing Data. The right to choose in this respect shall be incumbent on the Controller. If the Processor processes the data in a special technical format, the Processor is obliged to hand over the data after the termination of this Agreement either in this format or, at the request of the Controller, in the format in which it received the data from the Controller or in another common format. The only exceptions are those personal data that are subject to an obligation to store personal data under Union law or by law.
The processor is entitled, even after termination of the contract, to further process the data in anonymized form for future product developments and product enhancements as well as for the improvement of algorithms and machine learning processes. In the event of further processing by the Processor, all user data shall be anonymized by the Processor to such an extent that it cannot be attributed to either the responsible party or the Users.

5. Sub-Processors
5.1. The Controller hereby authorizes in a general manner the use of sub-processors by the Processor. The additional processors currently used by the Processor are listed in Appendix 2. In general, contractual relationships with service providers that have as their object the testing or maintenance of data processing procedures or systems by other bodies or other ancillary services, even if access to data cannot be ruled out in the process, are not subject to approval, as long as the Processor makes appropriate arrangements to protect the confidentiality of the data.

5.2. The Processor shall inform the Controller of any intended changes regarding the involvement or replacement of additional processors. In individual cases, the Controller shall have the right to object to the commissioning of a potential additional processor. An objection may only be raised by the Controller for good cause to be proven to the Processor. If the Controller does not raise an objection within 14 days of receipt of the notification, its right to object with regard to the corresponding commissioning shall expire. If the Controller raises an objection, the Processor shall be entitled to terminate the main agreement and this agreement with a notice period of 3 months.

5.3. If the Processor uses another sub-processor to carry out certain processing activities on behalf of the Controller, the Processor shall impose the same data protection obligations on this sub-processor by way of a contract. The parties agree that this requirement is met if the contract has a level of protection corresponding to this contract or if the additional processor is subject to the obligations set out in Art. 28(3) GDPR.

5.4. Subject to the requirements of Section 2.4 of this agreement, the provisions in this Section 5. shall also apply if an additional processor in a third country is engaged. The Controller hereby authorizes the Processor, on behalf of the Controller, to enter into a contract with the additional processor incorporating the EU Standard Contractual Clauses for the transfer of personal data to processors in third countries of 4.6.2021. The Controller agrees to cooperate to the extent necessary in fulfilling the requirements pursuant to Art. 49 GDPR.

6. Miscellaneous
6.1. There are no verbal ancillary agreements to this order processing contract. Amendments or supplements to this contract must be made in writing. This shall also apply to any waiver of the written form requirement.

6.2. Should any provision of this contract be invalid or ineffective, it shall be replaced by a provision that comes as close as possible in its result to the invalid or ineffective provision. The remaining provisions shall remain unaffected.

6.3. This contract shall be governed by Austrian law to the exclusion of its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods. All disputes arising from or in connection with this contract shall be decided exclusively by the Commercial Court of Vienna.