Joint Controller Addendum
By agreeing to the Canva Terms or this Joint Controller Addendum specifically, or otherwise by creating, using and/or publishing one or more Canvasites, you agree to the following terms and conditions:
Definitions and interpretation
In this Joint Controller Addendum, the following capitalised terms shall have the following meanings:
“GDPR” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); and (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR").
“Visitor” means an individual user who accesses, interacts with and/or views your Canvasite.
The terms "personal data", "processing", "controller", "processor", "supervisory authority" and "data subject" in these Canva Business JC Terms have the meanings given to them in the GDPR.
Application of this Joint Controller Addendum
This Joint Controller Addendum applies only where and to the extent that the GDPR applies to processing of personal data undertaken in connection with your Canvasite.
Joint controllership responsibilities
You acknowledge and agree that you and Canva are joint controllers in accordance with Article 26 GDPR for the processing of personal data in connection with your Canvasite. The scope of processing for which you and Canva are joint controllers, and the responsibilities that you and Canva each have for compliance with the GDPR in respect of such joint processing, in particular as regards the exercising of the rights of the data subject and to provide transparency information, are set out below.
The joint controllership described in Clause 3.1 applies only to: (i) the initial collection and transmission of personal data through a Canvasite to Canva's systems for processing; (ii) the subsequent processing of such personal data on Canva's (or its data processors') systems as necessary in order to provide Canvasite functionality to you and to your Visitors; and (iii) the processing of personal data as necessary for the purpose of fulfilling the rights of data subjects in accordance with the GDPR (the "Joint Processing").
Where Canva or you engage in any other processing of personal data that is not Joint Processing (for example, processing of personal data that is unrelated to your Canvasite, or personal data processing you undertake on systems that are not operated by Canva or its data processors), then Canva and you shall remain separate and independent controllers provided that there is no joint determination of the purposes and means of such processing.
Canva and your responsibilities for compliance with the obligations under the GDPR with regard to Joint Processing shall be as follows:
Art 6 (Legal basis):
Your responsibility: You must ensure that you also have a legal basis for the processing of personal data you process in connection with the Canvasite.
Arts 12, 13 and 14 (Transparency):
Arts 15 – 21 (Data subject rights):
Canva’s responsibility: If Canva is contacted by data subjects wishing to exercise their rights in respect of their personal data collected through the Canvasite, Canva will either fulfil those rights directly (where it is able to do so) or, where this is not possible, promptly notify you and coordinate with you as necessary to ensure fulfilment of their rights in accordance with the GDPR.
Your responsibility: If you are contacted by data subjects wishing to exercise their rights in respect of their personal data collected through the Canvasite, you will either fulfil those rights directly (where you are able to do so using functionality offered by the Canvasites platform) or, where this is not possible, promptly notify Canva and coordinate with Canva as necessary to ensure fulfilment of their rights in accordance with the GDPR.
In particular, if you process data subjects' personal data collected through your Canvasite for the purpose of sending any direct marketing communications to them (e.g. promotional emails, newsletter or similar) and any data subject objects, you must no longer process their personal data for this purpose. You acknowledge and agree that this is your sole responsibility and that Canva cannot determine or control your processing of data subjects' personal data for your direct marketing purposes.
Art 26 (Making available Joint Controller Addendum):
Your responsibility: Not applicable
Art 32 (Security):
Canva's responsibility: Canva will implement appropriate technical and organisational security measures to protect personal data collected through your Canvasite where this data is processed on Canva's (or its data processors') systems.
All employees of Canva involved in the processing of personal data are bound by appropriate obligations to maintain the confidentiality of such personal data.
Your responsibility: Not applicable
Arts 33, 34 (Personal Data Breaches):
Canva’s responsibility: Canva will comply with reporting obligations arising under the GDPR in respect of any personal data breach affecting personal data it processes in connection with Canvasites.
Your responsibility: Not applicable
You will publish a contact point on your Canvasite through which data subjects may contact you to exercise their data protection rights under the GDPR. You further acknowledge and agree that Canva makes available the following contact points for data subjects who wish to exercise their data protection rights under the GDPR:
If you are contacted by a supervisory authority with regard to the processing of personal data in connection with your Canvasite (a "Request"), you will forward all relevant information regarding the Request to us promptly (and within a maximum of seven (7) calendar days) to firstname.lastname@example.org. You agree to take all reasonable endeavours in a timely manner to cooperate with us in answering any such Request. You are not authorised to act or answer on Canva's behalf.
Updates to this Joint Controller Addendum
We may need to update this Joint Controller Addendum from time to time. By continuing to use Canvasites after any update to this Joint Controller Addendum, you agree to be bound by it. If you do not agree to the updated Joint Controller Addendum, please stop all use of your Canvasite.
If any portion of this Joint Controller Addendum is found to be unenforceable, the remaining portion will remain in full force and effect. If we fail to enforce any portion of this Joint Controller Addendum, it will not be considered a waiver. Any amendment to or waiver of these terms requested by you must be made in writing and signed by us.
This Joint Controller Addendum supplements and applies in addition to the Canva Terms. Any dispute or liability arising out of, or in connection with, this Joint Controller Addendum shall be subject to the Canva Terms (including, with limitation, any provisions in the Canva Terms concerning limitations of liability and governing law and jurisdiction).
Updated 12 November 2021