Leping

ADDENDUM TO MAINTENANCE AGREEMENT 23820036 This Addendum (“Addendum”) entered into as of July 10th, 2018, supplements and amends the terms of the Software Maintenance Agreement 23820036 (“Agreement”) entered into by S.Y.B. Estonia OÜ (“Supplier”) and Tervise- ja Heaolu Infosüsteemide Keskus (“Customer”) dated March 13th, 2018. The Supplier and the Customer are hereinafter jointly referred to as the “Parties” and independently as a “Party”. Unless otherwise defined in this Addendum, any capitalized terms not defined herein shall have the meaning given in the Agreement. In Clause 8.3 of the Agreement, the Supplier reserves right to change any terms of the Agreement or its Annexes, as may be reasonably required and consistent with SAP’s practices. Any such changes to terms shall become effective one (1) month after written notice by the Supplier to the Customer, unless otherwise specified in the notice. Despite of such Supplier’s right to change the terms of the Agreement or its Annexes by a unilateral notice, the Parties hereby agree to change the terms of the Agreement or its Annexes consistent with SAP’s practices. 1 Changes In Annex 2 (General Terms and Conditions for SAP Enterprise Support), the Clause 4.1 is changed to read as follows: The Customer may terminate the Support Services for the Software by giving the Supplier one hundred and twenty (120) days’ prior written notice to the end of either i) the Initial Term or ii) any Renewal Term. For the avoidance of any doubt: termination by the Customer applies to all Support Services agreed between the Parties for the Software; any partial termination of the Support Services agreed between the Parties for the Software (whether provided under the Agreement or under another software maintenance agreement between the Parties) is not permitted. The Parties add the following definitions in Annex 2 (General Terms and Conditions for SAP Enterprise Support) “SAP Support Sales Order” shall mean every accepted order between SAP and the Supplier for Support Services for the Customer. “Delivery” means the date when SAP according to its practices has delivered the Software to the Supplier. The Parties change the definitions of “Initial Term” and Renewal Term” in Annex 2 (General Terms and Conditions for SAP Enterprise Support) to read as follows: “Initial Term” shall mean: i. for each SAP Support Sales Order relating to (i) the Software except for SAP BusinessObjects solutions only and (ii) joint transactions (Support Service for SAP BusinessObjects solutions together with Support Service for one or more Software products that are not SAP Business Objects solutions in one order), the Initial Term will start as of the first day of the month following the Delivery of the Software and will end on December, 31st of the next full calendar year (except if the first day of 1  the month following the Delivery of the Software falls on January, 1st of a respective calendar year, in which case the initial term will run until December, 31st of the respective calendar year); or ii. for each SAP Support Sales Order relating only to SAP BusinessObjects solutions, the Initial Term will start as of the day of Delivery of the Software and will end twelve months later (but excluding the date having the same day and month as the day of Delivery of the Software). b) After the Initial Term each SAP Support Sales Order will automatically renew for subsequent twelve months periods: i. for each SAP Support Sales Order relating to (i) Software except for SAP BusinessObjects solutions only and (ii) joint transactions (Support Service for SAP BusinessObjects solutions together with Support Service for one or more Software products that are not SAP Business Objects solutions in one order), on January 1st of each calendar year; ii. for each SAP Support Sales Order relating only to SAP BusinessObjects solutions, on each date having the same day and month as the day of Delivery of the Software. (each a ”Renewal Term”). New Annex 4 is added to the Agreement: Data Processing Annex New Annex 5 is added to the Agreement: Processing of Personal Data by SAP 2 Effective Date of Changes This Addendum shall become effective on 10.08.2018. AGREED AND ACCEPTED: AGREED AND ACCEPTED: S.Y.B. Estonia OÜ (”Supplier”) Tervise- ja Heaolu Infosüsteemide Keskus (“Customer”) By: Juhana Niku-Paavola By: Title: Authorized Signatory Title: Date: 10.07.2018 Date: 2 Annex 4 DATA PROCESSING ANNEX 1 BACKGROUND AND PURPOSE 1.1 The terms of this Annex shall apply to the Agreement between S.Y.B. Estonia OÜ (“Supplier”) and the firm, company, corporation or other entity (“Customer”) with whom the Supplier has entered into an agreement regarding the provision of software and/or services (“Agreement”) if Personal Data is Processed by the Supplier and/or its Subcontractors based on the Agreement. 1.2 The Parties acknowledge and agree that with regard to the Processing of the Personal Data under this Annex, the Customer is the Controller and the Supplier is the Processor. 1.3 This Annex does not apply to the Processing of the Personal Data which belongs to the Supplier’s Customer and Prospect Register. The Supplier is the Controller of the Supplier’s Customer and Prospect Register. 2 DEFINITIONS As used in this Annex the following terms shall have the following meanings: “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. “Laws” means mandatory laws in force from time to time in Finland, Estonia and Lithuania (together referred to as “Countries”) relating to the protection of Personal Data and the Processing, including but not limited to the EU General Data Protection Regulation 2016/679 (“GDPR”), and all binding EU and national data protection legislation in force in the Countries. “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) which information is Processed under the Agreement on behalf of the Customer. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed. “Process” or “Processing” means any operation or set of operations which is performed on the Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Processor” means a natural or legal person, public authority, agency or other body, which Processes the Personal Data on behalf of the Controller. 3  “Separate Pricing” is defined in Section 3. “Service” or “Services” means the responsibilities of the Supplier under the Agreement to provide software and/or services to the Customer. “Third Parties” is defined in Section 3. 3 PROCESSING 3.1 The types of the Personal Data and categories of the Data Subjects of Personal Data can be the Customer’s users’: (a) name; (b) user name; (c) title; (d) position; (e) email address; (f) employer or other organization; (g) phone number; and (h) possible Personal Data in IP address. 3.2 The Supplier and any person acting under the authority of the Supplier, who has access to the Personal Data, may Process the Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a country outside the European Economic Area (EEA) and European Union (EU) or an international organisation, unless required to do so by EU or EU member state law to which the Supplier is subject. In such a case, the Supplier shall inform the Customer of that legal requirement before the Processing, unless that law prohibits such information on important grounds of public interest. Such instructions are hereby given by the Customer to the Supplier and include and are limited to: the Customer gives the Supplier instructions to Process the Personal Data in order for the Supplier and its subcontractors to provide the Services to the Customer in accordance with the Service specification applicable to the Agreement. If the Customer desires to amend the documented instructions or give new documented instructions to the Supplier, the amended and new instructions are subject to the Supplier’s written consent and may be priced in accordance with the Separate Pricing. 3.3 The Supplier shall: 3.3.1 ensure that persons authorised to process the Personal Data on its behalf have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; 3.3.2 in accordance with the Separate Pricing, taking into account the nature of the Processing, assists the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer 's obligation to respond to requests for exercising the Data Subject's rights laid down in the Laws; 3.3.3 in accordance with the Separate Pricing, assist the Customer in ensuring compliance with the obligations pursuant to the Laws, in the performance of data protection impact assessments and consultations with the supervisory authorities as required pursuant to the Laws; 3.3.4 in accordance with the Separate Pricing, as requested by the Customer in writing, delete or return all Personal Data to the Customer after the end of the provision of the Services relating to the Processing, and delete existing copies unless EU or EU member state law requires storage of the Personal Data; and 3.3.5 in accordance with the Separate Pricing, make available to the Customer information necessary to demonstrate compliance with the obligations laid down in the Laws and allow for and contribute to audits, including inspections, 4  conducted by the Customer or another auditor mandated by the Customer to audit the Supplier’s compliance with this Annex. The Supplier shall inform the Customer if, in its opinion, the Customer’s instruction infringes the Laws. The Customer shall notify the Supplier of the audit in writing at least thirty (30) days in advance. The auditor may not be a competitor of the Supplier or other company in the Supplier’s group of companies. The information regarding the Supplier’s operations learnt during the audits are the Supplier’s trade secrets. The Customer is liable for the auditor’s compliance with the terms of the Agreement. 3.4 Based on the Agreement, the Supplier might provide to the Customer third party software and those third parties might provide services for the purpose of the Customer. Those third parties (“Third Parties”) are not subcontractors of the Supplier and are not acting under the authority of the Supplier. 3.5 If based on the Laws or any other applicable legislation, regulations or decisions of authorities or the Customer’s instructions, the Supplier is at any time instructed or required to assist the Customer in performing the Customer’s obligations to respond to requests for exercising the Data Subjects’ rights or is otherwise required to perform any other tasks or activities relating to the Personal Data or the Processing that are not the Supplier’s Service duties, the Customer shall pay to the Supplier a separate price for such tasks or activities on a time and material basis in accordance with the Supplier’ consultation price list in force from time to time (such prices payable by the Customer to the Supplier are referred to as “Separate Pricing”). These tasks or activities can be e.g. providing information to a Data Subject on the Personal Data possessed by the Supplier, or removing or transferring Personal Data or responding or reporting to data protection authorities or allowing audits or inspections. 4 USE OF SUBCONTRACTORS The Supplier may engage subcontractors i.e. sub-Processor(s) for the purpose of the Processing. The Supplier may use also its group companies as its subcontractors. The Supplier has entered into data processing agreement(s) with the subcontractors, or the Processing by the Supplier’s group companies can be based on the Supplier’s legitimate interest where applicable under the Laws. 5 CUSTOMER’S DUTIES 5.1 The Customer acts as the Controller in relation to all Personal Data. The Customer is (among other things) liable for the correctness of the Personal Data and the lawfulness of the Processing of the Personal Data and for other duties and liabilities of the Controller. 5.2 The Customer shall take backup copies of the Personal Data before providing the Personal Data to the Supplier or its sub-Processors. 5.3 The Customer warrants to the Supplier that: (a) the Personal Data has been obtained lawfully; (b) the Services to be provided by the Supplier and its sub-Processors will be consistent with and appropriate to the specified and lawful purposes for which the Customer is engaged in relation to the Personal Data; (c) the Customer has not and will not disclose the Personal Data or any part thereof to the Supplier or its sub-Processors in a manner incompatible with applicable legislation; and (d) the Supplier and its sub-Processors are authorized under applicable legislation to Process the Personal Data. 5.4 The Customer undertakes that the Personal Data will not contain anything unlawful and that the Personal Data or its storage or other Processing by the Supplier and its sub-Processors for the provision of the Services does not infringe any rights of third parties. 6 SECURITY Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Customer and the Supplier shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) in accordance with the Separate Pricing and as 5  reasonably instructed by the Customer, the pseudonymisation and encryption of the Personal Data, (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing. 7 NOTIFICATION OF PERSONAL DATA BREACH 7.1 The Supplier shall notify the Customer without undue delay after becoming aware of a Personal Data Breach. 7.2 The Supplier shall in accordance with the Separate Pricing, assist the Customer in ensuring compliance with the Customer’s obligations pursuant to Laws to notify the Personal Data Breach to the supervisory authority and/or to the Data Subjects, taking into account the nature of the Processing and the information available to the Supplier. 8 TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES 8.1 The Supplier and its subcontractors do not themselves transfer the Personal Data to countries outside the European Economic Area (EEA) and European Union (EU) (“Third Country”) unless agreed with the Customer. 8.2 If the Customer or a user of the Customer uses the provided software or Services in Third Countries or if the Customer or a user contacts the Supplier or its subcontractor in Service matters from locations in Third Countries, it is deemed that the Customer has consented to the transfer of the relevant Personal Data to Third Countries for the said purpose. 9 LIMITATION OF LIABILITY 9.1 For the avoidance of doubt, the limitations of liability and disclaimers of warranties elsewhere in the Agreement shall apply also to this Annex. 9.2 Without limiting the validity of limitations of liability or disclaimer of warranties in the Agreement, the Supplier shall not be liable for any failures or damages caused by (i) the non-performance or delay by the Customer or (ii) the inaccuracy, incorrectness or illegality of the Personal Data, materials, information, data or instructions provided by the Customer to the Supplier or its sub-Processors. 6 Annex 5 Processing of Personal Data by SAP The Supplier is not liable for SAP’s compliance of SAP’s obligations. 1. Obligations of the Customer 1.1 The Customer shall be solely responsible for the permissibility of the processing of personal data by SAP and the Supplier as well as for safeguarding the rights of the data subjects. SAP is entitled to process personal data of the Customer as required for SAP to fulfill its contractual obligations towards the Supplier. The Supplier is entitled to process personal data of the Customer as required for the Supplier to fulfill its contractual obligations towards the Customer. 1.2 The Customer shall give commissions related to the processing of personal data and parts thereof to the Supplier or SAP in writing, by facsimile, via e-mail, via SAP’s support portal or implied by making use of the SAP Products. 1.3 The Customer shall make available the personal data for processing to SAP and the results of the processing shall be transferred back by SAP by using a defined transfer procedure or in accordance with the functionality implemented in the SAP products. 1.4 The Customer shall inform the Supplier without delay, if the Customer detects errors or irregularities when examining the results of the processing of personal data. 2. Obligations of SAP 2.1 SAP shall process the personal data of the Customer exclusively in accordance with the Customer’s instructions communicated directly to SAP or relayed to SAP by the Supplier. Instructions may include (without limitation) the correction, erasure and/or the blocking of personal data. The personal data shall not be used by SAP for any other purpose. SAP shall not preserve such personal data longer than instructed by the Supplier. The statutory preservation periods remain unaffected. 2.2 For processing personal data, SAP shall only use personnel which committed themselves to observe data secrecy and secrecy of telecommunications in accordance with Article 16 of Directive 95/46/EC. 2.3 SAP shall implement all technical and organisational measures to comply with the requirements of Article 17 no. 1 of Directive 95/46/EC. In particular, SAP shall take and regularly check the following protection measures: • Access Control: SAP shall install access control systems. • System Access Control: SAP shall control and log access to data processing systems. • Data Access Control: SAP shall define, implement and monitor a concept for user rights, rules for passwords and login procedures. • Data Transmission Control: SAP shall ensure personal data transmission in encrypted form or by a secure alternative procedure. Transmissions must be logged and guidelines for personal data transmissions must be laid down in writing. • Data Input Control: SAP shall implement a detailed logging system for input, modification and deletion of personal data. • Job Control: SAP shall define in writing and establish control mechanisms to ensure that data are processed strictly in accordance with the instructions of the Provider. • Availability Control. SAP shall run a state of the art backup system and define a restore operation procedure to protect personal data from accidental destruction or loss. • Data Separation Control: SAP shall ensure by technical means and defined organisational procedures that personal data collected for different purposes (e.g. different Providers) can be processed separately. Technical means can be separated computer systems or demonstrably logical separation. Access by one customer to the data of any other customer must be prevented. 7 2.4 If the security measures implemented by SAP do not meet the legal requirements, SAP shall notify the Supplier without delay. 2.5 SAP shall notify the Supplier and/or the Customer, if SAP considers an instruction given by the Customer (directly or indirectly via the Supplier) to be in violation of data protection regulations. SAP shall not be obliged to perform a comprehensive legal examination. 2.6 At the Supplier’s written request, SAP shall reasonably support the Customer in dealing with requests from individual data subjects and/or a supervisory authority with respect to the processing of personal data controlled by the Customer. The Customer may give such reasonable instructions to the Supplier who will communicate them to SAP. Such support by SAP and the Supplier shall be at the Customer’s expense. SAP shall notify the Supplier about inspections and measures of a supervisory or any other competent authority. 3. Subcontractors 3.1 SAP is authorized to engage subcontractors for the processing of personal data in such manner that they shall act as further sub-commissioned processors of personal data (Unter-Auftragsdatenverarbeiter). SAP shall pass on to its subcontractors all SAP's obligations vis-à-vis the Supplier and obligate sub-commissioned processors of personal data to obey all relevant data protection rules. 3.2 SAP may engage sub-contractors that may provide support, including access to personal data, in connection with performing its contractual obligations and which are not to be regarded as sub-commissioned processors of personal data. Such support may be provided by sub-contractors engaged by SAP. In such cases SAP shall be obliged to provide in the sub-contracting agreement with such support provider for appropriate contractual provisions in accordance with applicable data protection laws and to take the appropriate control measures, in order to ensure the protection and security of the personal data processed hereunder. 4. Monitoring Rights 4.1 The Supplier shall have all necessary right to verify in accordance with Article 17 no. 2 of Directive 95/46/EC that SAP processes the personal data duly. These monitoring rights shall be carried out in coordination with SAP. After notifying SAP the monitoring can be carried out, in particular, during SAP’s usual business hours on SAP’s premises where the personal data processing is performed. To the extent that any personal data controlled by the Customer is processed by SAP, the Customer shall have the same monitoring rights as the Supplier. 4.2 SAP shall ensure that the Supplier has the monitoring rights set forth in Section 4.1 also vis-à-vis sub-commissioned processors of personal data retained by SAP. 4.3 SAP shall reasonably support the Supplier throughout these verification processes and provide the Supplier with the required information. 4.4 SAP shall contractually safeguard the Supplier's powers of disposal and monitoring rights under this Annex vis-à-vis SAP's subcontractors who may come into contact with the personal data. 4.5 Services rendered by SAP and the Supplier in connection with the Customer’s monitoring rights shall be at the Customer’s expense. 5. Special Confidentiality Obligation; Obligation to Observe Data Secrecy 5.1 SAP undertakes to the Supplier to treat the personal data, which have become known to SAP, confidential and to use such data exclusively for the commissioned data processing. 5.2 SAP undertakes to the Supplier to impose on its employees, who may obtain knowledge of personal data, the same obligations as entered into above by SAP. 8