Terms of Data Processing

Carrot’s Data Processing Agreement and applicable Schedules as of October 26, 2022.

Data Processing Agreement

Download DPA

Australia Canada European union India Israel Japan Singapore Switzerland United Kingdom

For Customers who entered in the Data Processing Agreement on or before October 25, this version of the Data Processing Agreement applies.  For other use cases, this version has been deprecated as of October 26, 2022.

Data Processing Agreements FAQs

1. What is a DPA?

A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs the processing of personal information.

In the most general sense:

• A “Controller” is an entity that determines the purpose and means of the processing of personal information.
• A “Processor” is an entity that processes personal information on behalf of a controller.
• “Processing” refers to almost anything that a processor can do with personal information.
• “Personal Information” is any information that can be linked to an identified or identifiable individual (this individual is sometimes referred to as the “Data Subject”).

2. Generally, when is a DPA needed?

It depends on the jurisdictions and types of data involved.
In many jurisdictions (e.g., the European Union under the GDPR), parties are legally required to execute a DPA if one party will process personal information on behalf of the other party. In the United States, whether a DPA is legally required depends on many factors and is often unclear.

3. When does Carrot enter into DPAs with customers?

It depends on where eligible employees reside.
Generally:

• If there are no eligible employees who are residents of non-U.S. jurisdictions, Carrot will not require a DPA.
• If there are eligible employees who are residents of the European Economic Area (EEA), then we will require a DPA.

We have also compiled a list of country-specific “schedules” that may be attached to the DPA, depending on which non-U.S. jurisdictions are involved.

4. What are Sub-processors and why are they important?

A Sub-processor is an entity that processes personal information on behalf of a data processor. If a data processor engages a Sub-processor, it needs to have a DPA in place with that Sub-processor.

A current list of Carrot’s Sub-processors is available here.

5. Why is a DPA needed?

DPAs between controllers and processors ensure they both understand their obligations, responsibilities, and liabilities. DPAs also help them comply with various regulations, such as the GDPR, and help demonstrate compliance to regulators and individuals.

6. What should a DPA address?

The answer varies depending on the jurisdiction and subject matter involved, but there are certain elements that should always be included in a DPA:

First, DPAs must define:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the types of personal information and categories of data subjects;
• the controller’s obligations and rights.

Second, DPAs must also include specific terms regarding:

• processing only on the controller’s documented instructions;
• the duty of confidence;
• appropriate security measures;
• using sub-processors;
• data subjects’ rights;
• assisting the controller;
• end-of-contract provisions;
• audits and inspections.

7. Why are we being asked to use Carrot’s DPA form?

The ideas of data ownership and confidentiality are specific to Carrot’s standard contracting process, designed to be very pro-user.

8. Why does the Privacy Notice say Carrot is a controller, but the DPA says it is a processor?

It is common for the same entity to be considered a controller in one context and a processor in another context. This is the case for Carrot. Under the GDPR:

• A "data controller" is an entity that determines the purpose and means of the processing of personal data.
• A "data processor" is an entity that processes personal data on behalf of a data controller.