This Data Processing Agreement ("DPA") forms part of the ChromaChecker Terms of Service (§5.3) and of the agreement between ChromaChecker Corporation, 4324 Sanddollar Court, New Port Richey, FL 34652, USA (FEIN 46-4952194) ("ChromaChecker") and the customer identified in that agreement ("Customer"). It applies wherever ChromaChecker processes personal data on the Customer's behalf.
The Customer accepts this DPA, including the Standard Contractual Clauses and the UK transfer instrument incorporated by §11, by a separate acceptance given at sign-in by the administrator of the Customer's organisation, who confirms that they have authority to bind the Customer. ChromaChecker records the document and version accepted, the account that accepted it and the time of acceptance, and makes that record available to the Customer on request. Until that acceptance has been given, this DPA applies to the processing as part of the Terms of Service (§5.3).
A countersigned copy is available on request at legal@chromachecker.com for customers whose own procedures require one; execution does not change the terms already in force.
Terms not defined here have the meaning given in Regulation (EU) 2016/679 ("GDPR"). Where the UK GDPR applies, references to the GDPR are read accordingly.
1. Roles
The Customer is the controller and ChromaChecker the processor for the personal data described in Annex I. Where ChromaChecker determines the purposes of processing — its own account administration, licence administration, invoicing, and security of its systems — it acts as a controller, and that processing is governed by its Privacy Policy at chromachecker.com/legal-privacy rather than by this DPA.
2. Instructions
ChromaChecker processes the personal data only on the Customer's documented instructions, including the instructions inherent in the Customer's use of the service. The parties agree that the ChromaChecker Terms of Service and this DPA constitute the Customer's complete and final documented instructions to ChromaChecker in relation to the processing of personal data. Additional instructions outside the scope of the Terms of Service or this DPA (if any) require prior written agreement between ChromaChecker and the Customer, including agreement on any additional fees payable by the Customer for carrying out such instructions. The Customer shall ensure that its instructions comply with all laws, rules and regulations applicable in relation to the personal data, and that the processing of the personal data in accordance with the Customer's instructions will not cause ChromaChecker to be in breach of the GDPR and other applicable EU, UK and EU Member State data protection laws.
ChromaChecker shall inform the Customer if, in its opinion, an instruction infringes the GDPR, and may suspend that instruction until it is resolved.
Where ChromaChecker is required by Union or Member State law to process beyond those instructions, it shall inform the Customer before processing unless that law prohibits it on important grounds of public interest.
3. Customer's obligations as a controller
The Customer agrees that (i) it will comply with its obligations under the GDPR and other applicable EU, UK and EU Member State data protection laws (if and to the extent applicable based on the location of the data subject) in respect of its processing of the personal data, including any obligations specific to its role as a controller and/or processor; and (ii) it has provided notice and obtained (or will obtain) all consents and rights necessary under the GDPR and other applicable data protection laws for ChromaChecker to process the personal data, including the processing of EU and UK personal data in a location outside of the UK or EEA (as applicable), as required to provide the service pursuant to the Terms of Service and this DPA. If the Customer is itself a processor, the Customer warrants to ChromaChecker that the Customer's instructions and actions with respect to that personal data, including its appointment of ChromaChecker as another processor, have been authorised by the relevant controller under applicable data protection laws.
4. Confidentiality
ChromaChecker ensures that every person authorised to process the personal data is bound by confidentiality, whether by contract or statutory duty, and that access is limited to those who need it to provide the service.
5. Security
ChromaChecker implements the technical and organisational measures set out in Annex II, appropriate to the risk of processing a minimal, largely pseudonymous data set. The Customer is responsible for reviewing the information made available by ChromaChecker relating to data security and making an independent determination as to whether the technical and organisational measures implemented by ChromaChecker meet the Customer's requirements and legal obligations under the GDPR and other applicable data protection laws.
The measures may change as the service develops; they may not fall below the level described in Annex II.
The Customer agrees that, without prejudice to ChromaChecker's obligations under this Section 5: (a) the Customer is responsible for its use of the service, including making appropriate use of the service to ensure a level of security appropriate to the risk in respect of the personal data, securing its account authentication credentials, managing its data back-up strategies, and protecting the security of the personal data when in transit to and from the service and taking any appropriate steps to securely encrypt or back up any personal data uploaded to the service; and (b) ChromaChecker has no obligation to protect the personal data that the Customer elects to store or transfer outside of ChromaChecker's and its sub-processors' systems (for example, offline or on-premise storage).
6. Data subject requests
Taking into account the nature of the processing, ChromaChecker will assist the Customer in responding to requests to exercise data subject rights. To the extent legally permitted, the Customer shall be responsible for any costs arising from ChromaChecker's provision of such assistance. Where a data subject request reaches ChromaChecker directly, it will forward it to the Customer without undue delay and will not respond on the Customer's behalf.
The Customer agrees that, without prejudice to ChromaChecker's obligations under this Section 6, the Customer is solely responsible for dealing with data subject requests.
The service also allows the Customer to answer most requests without assistance: account data exports as JSON, measurement data as CSV or JSON, and accounts can be deleted from within the application. Where assistance is needed, ChromaChecker responds within 10 working days.
If a law enforcement agency sends ChromaChecker a demand for personal data (e.g., a subpoena or court order), ChromaChecker will redirect the law enforcement agency to request that data directly from the Customer. As part of this effort, ChromaChecker may provide the Customer's contact information to the law enforcement agency. If compelled to disclose personal data to a law enforcement agency, ChromaChecker will give the Customer reasonable notice of the demand to allow the Customer to seek a protective order or other appropriate remedy, to the extent ChromaChecker is legally permitted to do so.
The Customer acknowledges that ChromaChecker is required under the GDPR and the UK GDPR to: (a) collect and maintain written records of certain information, including the name and contact details of each processor and/or controller on behalf of which ChromaChecker is acting and, where applicable, of such processor's or controller's local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, the Customer will, where requested, provide such information to ChromaChecker via the service or other means provided by ChromaChecker, and will ensure that all information provided is kept accurate and up to date.
7. Sub-processors
The Customer hereby gives general authorisation to the sub-processors listed at chromachecker.com/legal-subprocessors, as it stands at the effective date.
Before engaging a new sub-processor or replacing an existing one for processing covered by this DPA, ChromaChecker shall give the Customer 30 days' notice by updating that list and notifying the account's administrative contact. The Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, either party may terminate the affected part of the service without penalty.
ChromaChecker imposes on each sub-processor obligations no less protective than those in this DPA, and remains fully liable for their performance.
8. Personal data breach
ChromaChecker will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, the measures taken, and a contact point for further information. Where the full picture is not yet available, information is provided in phases without undue further delay.
The Customer agrees that:
- an unsuccessful personal data breach will not be subject to this Section 8. An unsuccessful personal data breach is one that results in no unauthorised access to the Customer's personal data or to any of ChromaChecker's equipment or facilities storing the Customer's personal data, and may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorised access to traffic data that does not result in access beyond headers) or similar events; and
- ChromaChecker's obligation to report or respond to a personal data breach under this Section 8 is not and will not be construed as an acknowledgment by ChromaChecker of any fault or liability of ChromaChecker with respect to the personal data breach.
The Customer acknowledges that ChromaChecker will not assess the contents of the Customer's personal data in order to identify information subject to any specific legal requirements. The Customer is solely responsible for complying with the data breach notification obligations applicable to the Customer under applicable data protection laws and for fulfilling any third-party notification obligations related to any personal data breach.
9. Audit
ChromaChecker shall make available the information necessary to demonstrate compliance with Article 28 of the GDPR and the UK GDPR, and will allow and contribute to audits.
Audits are conducted by written questionnaire and documentation — the current Network Connections & Firewall Requirements document, the published security and privacy pages, and written answers to specific questions — provided no more than once in any twelve-month period, unless a supervisory authority requires otherwise or a breach affecting the Customer has occurred.
On-site inspection is available where mandatory law requires it, on 30 days' written notice, during business hours, not more than once per calendar year, subject to confidentiality undertakings and to the reasonable costs of the inspection being borne by the Customer.
10. Deletion and return
On termination of the service, and at the Customer's choice, ChromaChecker will delete or return the personal data within 30 days, and will delete existing copies unless Union or Member State law requires storage. Backup copies containing the data are purged within 60 days.
Records ChromaChecker must keep by law — billing records for seven years — are retained for that purpose only and remain subject to §4 and §5.
11. International transfers
The service is hosted on OVH infrastructure in Canada (Beauharnois, Quebec) and is operated by ChromaChecker Corporation, a company established in the United States whose personnel handling customer data work from the United States. Personal data of data subjects in the UK and the European Economic Area is therefore transferred outside the UK and the EEA.
If ChromaChecker transfers personal data protected under this DPA to a jurisdiction for which the European Commission or the UK Secretary of State, as applicable, has not issued an adequacy decision whereby the data protection laws of that jurisdiction are deemed substantially equivalent to those of the EU or the UK, ChromaChecker will ensure that appropriate safeguards have been implemented for the transfer of the personal data in accordance with applicable data protection laws.
Where required, any transfer of personal data made subject to this DPA to any country which does not ensure an adequate level of data protection shall be undertaken by ChromaChecker in accordance with the standard contractual clauses issued by the European Commission (Commission Implementing Decision (EU) 2021/914) in the form that can be accessed here (the "SCCs") and/or the UK International Data Transfer Agreement in the form that can be accessed here, as applicable.
Module Two (transfer controller to processor) of the SCCs applies where the Customer is a controller; Module Three (transfer processor to processor) applies where the Customer is itself a processor.
For the purposes of the SCCs entered into between the parties, the following shall apply:
- (a) the list of parties and the description of the transfer in Annex I of the Clauses shall be as described in Annex I to this DPA;
- (b) the technical and organisational measures in Annex II of the Clauses shall be as described in Annex II to this DPA;
- (c) the optional docking clause (Clause 7) applies;
- (d) for Clause 9, Option 2 (general written authorisation) applies, with the notice period of §7 of this DPA;
- (e) the optional language in Clause 11 (independent dispute resolution body) does not apply;
- (f) for Clause 13, the competent supervisory authority is the one identified in Annex I, section C;
- (g) for Clauses 17 and 18, the governing law and the courts are those of Ireland.
Where applicable, the UK transfer instrument shall form an integral part of this DPA as if fully set forth herein. The information required by its appendices or tables is set forth in Annex I to this DPA.
Transfers to ChromaChecker's sub-processor OVH in Canada rely on the European Commission's adequacy decision 2002/2/EC for organisations subject to PIPEDA and on the corresponding UK adequacy regulations.
To the extent that the Customer or ChromaChecker is relying on a specific statutory mechanism to normalise international personal data transfers that is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, the Customer and ChromaChecker agree to cooperate in good faith to promptly terminate the transfer or to pursue a suitable alternative mechanism that can lawfully support the transfer.
12. Liability and precedence
This DPA forms part of the ChromaChecker Terms of Service, and the liability provisions of the Terms of Service apply to it. Where this DPA conflicts with the Terms of Service in relation to the subject matter hereof, this DPA prevails.
13. Governing law and jurisdiction
This DPA (insofar as it relates to any EU personal data being processed hereunder) and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this DPA, or its subject matter or formation, shall be governed by and construed in accordance with the laws of the Republic of Ireland.
This DPA (insofar as it relates to any UK personal data, if any, being processed hereunder), and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this DPA (only insofar as it relates to UK personal data being processed hereunder) or its subject matter or formation, shall be governed by and construed in accordance with the law of England and Wales.
Each party irrevocably agrees that the courts of Ireland shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the processing of any EU personal data under this DPA.
Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the processing of any UK personal data under this DPA.
14. Contact
Data protection: privacy@chromachecker.com · Legal: legal@chromachecker.com
EU representative (GDPR Article 27) and UK representative (UK GDPR Article 27): Data Protection Representative Limited (DataRep), The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland.
Annex I — the processing (also Annex I of the SCCs and the UK instrument)
A. List of parties
| Data exporter | Data importer | |
|---|---|---|
| Name | The Customer, as identified in its ChromaChecker account and order | ChromaChecker Corporation |
| Address | As held on the Customer's account | 4324 Sanddollar Court, New Port Richey, FL 34652, USA |
| Contact | The account's administrative contact | privacy@chromachecker.com |
| Activities relevant to the transfer | Use of the ChromaChecker platform to measure and control colour in its printing operation | Provision of the ChromaChecker colour measurement and quality control platform, and the CC Capture and CC Sync applications |
| Role | Controller (Module Two), or processor acting for its own customer (Module Three) | Processor |
| Signature and date | Accepted at sign-in as described in the preamble, where the acceptance record serves as signature and date; or by countersigned copy | Countersigned copy on request |
B. Description of the transfer
| Subject matter | Provision of the ChromaChecker colour measurement and quality control platform, and the CC Capture and CC Sync applications |
| Duration | The term of the main agreement, plus the deletion periods in §10 |
| Nature and purpose | Storing and processing colour measurement data submitted by the Customer's operators; account administration for those operators; support at the Customer's request |
| Categories of data subject | The Customer's employees and contractors who hold accounts or take measurements |
| Categories of personal data | Account identifier (need not be a real name); contact email address (may be a shared or pseudonymous mailbox); the identifier of the operator recorded against a measurement. The organisation's formal address is company data. Measurement data — spectral values, colour coordinates, instrument serial numbers — is technical data about a printing process |
| Sensitive data | None. The service is not to be used to submit special categories of personal data |
| Frequency | Continuous, for as long as the Customer uses the service |
| Retention | The term of the agreement; deleted or returned within 30 days of termination, backups purged within 60 days (§10) |
| Transfers to sub-processors | OVH (hosting of the entire platform, Canada — Beauharnois, Quebec; for the term of the agreement). SocketLabs, Inc. (outbound mail relay carrying one-time sign-in codes, bug reports and system email; United States; for the term of the agreement). The current list: chromachecker.com/legal-subprocessors |
C. Competent supervisory authority
For EU personal data: the supervisory authority of the EU Member State in which the data exporter is established (SCC Clause 13). For UK personal data: the Information Commissioner's Office.
Annex II — technical and organisational measures
- Hosting. The platform runs in a single data centre operated by OVH in Beauharnois, Quebec, Canada. Production data is not stored elsewhere.
- Transport security. Current ChromaChecker applications connect using TLS 1.2 or 1.3. Certificate verification is mandatory and cannot be disabled; from version 4.0.567 the applications verify against the operating system's trust store.
- Credential handling. Credentials on a workstation are held in the operating system's credential store — macOS Keychain, Windows Credential Manager — never in plain text files.
- Two-factor authentication. Available on all accounts, with a one-time code delivered to the address registered on the account. The Customer's own administrator decides whether it is required, independently for three scopes: the organisation's administrator account, operators and managers signing in on the web, and every sign-in to CC Capture. ChromaChecker does not enable or disable it on the Customer's behalf. The factor is an email code; authenticator applications and hardware security keys are not supported at present. Delivery uses the mail relay named in Annex III, which therefore forms part of the authentication path.
- Data minimisation by design. Real names are not required; account identifiers and mailboxes may be pseudonymous.
- Access control. Administrative access to production systems is limited to a small number of named personnel who need it, each with individual credentials, and each bound by a written confidentiality undertaking signed before access is granted. Names, roles and countries of work are kept in an internal access register, available on audit. Administrative sign-ins are recorded in the servers' own logs.
- Backups. Production databases are backed up weekly to the hosting provider's infrastructure in Canada. Older copies are deleted on a rotating basis, within the periods set out in §10.
- Network transparency. Every network destination the applications use is published, with purpose and port, in the Network Connections & Firewall Requirements document; every plugin that opens a connection or a listening port declares it publicly. With no plugins enabled the application listens on nothing.
- Incident handling. Suspected security incidents are escalated at once to the infrastructure administrator; the Customer is notified as set out in §8.
- Deletion. Deletion routines and backup purge windows as in §10.
Annex III — sub-processors
The current list is published at chromachecker.com/legal-subprocessors and forms part of this DPA. At the effective date it comprises OVH (hosting, Canada) and SocketLabs, Inc. (mail relay, United States).
