Terms & Policies

Data Processing Addendum

Download the Data Processing Addendum [PDF]

This Data Processing Agreement (“DPA”) is made and entered into as of this ____day of ____, 2020 forms part of the Securiti Customer Agreement (the “Agreement”). You acknowledge that you, on behalf of [______] incorporated under __________ law, with its principal offices located at ____________________(“Organisation”) (collectively, ”You”, ”Your”, “Client”, or “Data Controller”) have read and understood and agree to comply with this DPA, and are entering into a binding legal agreement with Securiti as defined below (“Securiti”,”Us”, ”We”, ”Our”, “Service Provider” or “Data Processor”) to reflect the parties’ agreement with regard to theProcessing of Personal Data (as such terms are defined below) of GDPR-protected individuals. Both parties shall be referred to as the “Parties” and each, a “Party”.

WHEREAS, Securiti shall provide the services set forth in the Agreement(collectively, the “Services”) for Client, as described in the Agreement; and

WHEREAS, In the course of providing the Services pursuant to the Agreement, we may process Personal Data on your behalf, in the capacity of a “Data Processor”; and the Parties wish to set forth the arrangements concerning the processing of Personal Data (defined below) within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.

NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, theparties, intending to be legally bound, agree as follows:

INTERPRETATION AND DEFINITIONS

1. The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA.
2. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated.
3. Words used in the singular include the plural and vice versa, as the context may require.
4. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
5. Definitions:

1. 1. “Affiliate” means an entity that directly or indirectly Controls, is Controlled by, or is under common Control with another entity, so long as such Control exists. For the purposes of this definition, “Control” means beneficial ownership of 50% or more of the voting power or equity in an entity.
   2. “Authorized Affiliate” means any of Client’s Affiliate(s) which (a)is subject to the Data Protection Laws And Regulations of the European Union, the European Economic Are and/or their member states, Switzerland and/or the United Kingdom, and (b) is permitted to use theServices pursuant to the Agreement between Client and Securiti, but has not signed its own agreement with Securiti and is not a “Customer” as defined under the Agreement.
   3. “Controller” or “Data Controller” means the entity which determines the purposes and means of the Processing of Personal Data. For the purposes of this DPA only, and exceptwhere indicated otherwise, the term “Data Controller” shall include yourself, the Organisation and/or the Organisation’s Authorized Affiliates.
   4. “Data Protection Laws and Regulations” means all laws and regulations, including, without limitation, laws and regulations of the European Union, the EuropeanEconomic Area and their Member States, Switzerland and the United Kingdom, applicable to the Processing of Personal Data under the Agreement.
   5. “Data Subject” means the identified or identifiable person to whom the Personal Data relates.
   6. “Member State” means a country that belongs to the European Union and/or the European Economic Area. “Union” means the European Union.
   7. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General DataProtection Regulation).
   8. “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
   9. “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
   10. “Processor” or “Data Processor” means the entity which ProcessesPersonal Data on behalf of the Controller.
   11. “Security Documentation” means the Security Documentation applicable to the specific Services purchased by Client, as updated from time to time, and as made reasonably available by Securiti.
   12. “Securiti” means Securiti Inc. and any of its affiliates or subsidiaries.
   13. “Securiti Group” means Securiti and its Affiliates engaged in theProcessing of Personal Data.
   14. “Sub-processor” means any Processor engaged by Securiti.
   15. “Supervisory Authority” means an independent public authority which is established by an EU Member State pursuant to the GDPR.

PROCESSING OF PERSONAL DATA

1. Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Personal Data, (i) Client is the Data Controller, (ii) Securiti is the Data Processor and that (iii) Securiti or members of the Securiti Group may engage Sub-processors pursuant to the requirements set for thin Section 5 “Sub-processors” below.
2. Client’s Processing of Personal Data. Client shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations and comply at all times with the obligations applicable to data controllers (including, without limitation, Article24 of the GDPR). For the avoidance of doubt, Client’s instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations. Client shall have sole responsibility for the means by which Client acquired Personal Data. Without limitation, Client shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal bases in order to collect, Process and transfer to Securiti the Personal Data and to authorize the Processing by Securiti of the Personal Data which is authorized in this DPA. Client shall defend, hold harmless and indemnify Securiti, its Affiliates and subsidiaries (including without limitation their directors, officers, agents, subcontractors and/or employees) from and against any liability of any kind related to any breach, violation or infringement by Client and/or its authorized users of any Data Protection Laws and Regulations and/or this DPA and/or this Section.
3. Securiti’s Processing of Personal Data.
   1. Subject to the Agreement, Securiti shall Process Personal Data only in accordance with Client’s documented instructions as necessary for the performance of the Services andfor the performance of the Agreement and this DPA, unless required to otherwise by Union or Member State law to which Securiti is subject, in which case, Securiti shall inform the Client of the legalrequirement before processing, unless that law prohibits such information on important grounds of public interest. The duration of the Processing, the nature and purposes of the Processing, as well as thetypes of Personal Data Processed and categories of Data Subjects under this DPA are further specified inSchedule 1 (Details of the Processing) to this DPA.
   2. To the extent that Securiti cannot comply with a request (including, without limitation, any instruction, direction, code of conduct, certification, or change of any kind)from Client and/or its authorized users relating to Processing of Personal Data or where Securiti considers such a request to be unlawful, Securiti (i) shall inform Client, providing relevant details of the problem, (ii) Securiti may, without any kind of liability towards Client, temporarily cease allProcessing of the affected Personal Data (other than securely storing those data), and (iii) if theParties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, andClient shall pay to Securiti all the amounts owed to Securiti or due before the date of termination.Client will have no further claims against Securiti (including, without limitation, requesting refunds for Services) due to the termination of the Agreement and/or the DPA in the situation described in this paragraph (excluding the obligations relating to the termination of this DPA set forth below).
   3. Securiti will not be liable in the event of any claim brought by a third party, including, without limitation, a Data Subject, arising from any act or omission of Securiti, to the extent that such is a result of Client’s instructions.
   4. If Client provides Securiti or any of the entities of the Securiti Group with instructions, requests, suggestions, comments or feedback (whether orally or in writing) with respect to the Services, Client acknowledges that any and all rights, including intellectual property rights, therein shall belong exclusively to Securiti and that such shall be considered Securiti’s intellectual property without restrictions or limitations of any kind, and Client hereby irrevocably and fully transfers and assigns to Securiti any and all intellectual property rights therein and waives anya nd all moral rights that Client may have in respect thereto.

RIGHTS OF DATA SUBJECTS

If Securiti receives a request from a Data Subject to exercise its right to be informed, right of access, right to rectification, erasure, restriction of Processing, data portability, right to object, or its right not to be subject to a decision solely based on automated processing, including profiling(“Data Subject Request”), Securiti shall, to the extent legally permitted, promptly notify and forward such DataSubject Request to Client. Taking into account the nature of the Processing, Securiti shall assist Client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Client’s obligation to respond to a Data Subject Request under Data Protection Laws and Regulations. To the extent legally permitted, Client shall be responsible for any costs arising from Securiti’s provision of such assistance.

SECURITI PERSONNEL

1. Confidentiality. Securiti shall grant access to the Personal Data to persons under its authority (including, without limitation, its personnel) only on a need to know basis and ensure that such persons engaged in the Processing of Personal Data have committed themselves to confidentiality and non-disclosure. Securiti will keep the list of persons to whom access to Personal Data has been granted under periodic review. On the basis of the said review, access to Personal Data can be withdrawn and in this case,Personal Data will not be accessible anymore to those persons.
2. Securiti may disclose and Process the Personal Data (a) as permitted hereunder (b) to the extent required by a court of competent jurisdiction or other Supervisory Authority and/or otherwise as required by applicable laws or applicable Data Protection Laws and Regulations (in such a case, Securiti shall inform the Client of the legal requirement before the disclosure, unless that law prohibits such information on important grounds of public interest), or (c) on a “need-to-know” basis under an obligation of confidentiality to its legal counsel(s), data protection advisor(s) and accountant(s).

AUTHORISATION REGARDING SUB-PROCESSORS

1. 1. Securiti’s current list of Sub-processors is hereby enclosed atSchedule 2 to the DPA. Such Sub-processor list shall include the identities and details of thoseSub-processors and their country of location (“Sub-processor List”). The Sub-processor List as of the date of execution of this DPA, or as of the date of publication (as applicable), is hereby, or shall be(as applicable), authorized by Client. In any event, the Sub-processor List shall be deemed authorized by Client unless it provides a written reasonable objection for reasons related to the GDPR within ten(10) business days following the publication of the Sub-processor List. Client may reasonably object for reasons related to the GDPR to Securiti’s use of an existing Sub-processor by providing a written objection to [email protected] In the event Client reasonably objects to an existing Sub-processor, as permitted in the preceding sentences, and the parties do not find a solution in good faith to the issue in question, then Client may, as a sole remedy, terminate the applicable Agreement and this DPA with respect only to those Services which cannot be provided by Securiti without the use of the objected-to Sub-processor by providing written notice to Securiti provided that all amounts due under the Agreement before the termination date with respect to the Processing at issue shall be duly paid to Securiti. Client will have no further claims against Securiti due to (i) past use of approvedSub-processors prior to the date of objection or (ii) the termination of the Agreement (including, without limitation, requesting refunds) and the DPA in the situation described in this paragraph.
   2. Client may find on Securiti’s webpage accessible viahttp://status.securiti.ai a mechanism to subscribe to notifications of new Sub-processors, to whichClient shall subscribe, and if Client subscribes, Securiti shall provide notification of any newSub-processor(s) before authorizing such new Sub-processor(s) to Process Personal Data in connection with the provision of the Services.
2. Objection Right for New Sub-processors. Client may reasonably object to Securiti’s use of a new Sub-processor for reasons related to the GDPR by notifying Securiti promptly in writing within three (3) business days after receipt of Securiti’s notice in accordance with the mechanism set out inSection 5.2 and such written objection shall include the reasons related to the GDPR for objecting to Securiti’s use of such new Sub-processor. Failure to object to such new Sub-processor in writing within three (3) business days following Securiti’s notice shall be deemed as acceptance of the new Sub-Processor. In the event Client reasonably objects to a new Sub-processor, as permitted in the preceding sentences, Securiti will use reasonable efforts to make available to Client a change in the Services or recommend a commercially reasonable change toClient’s use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If Securiti is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Client may, as a sole remedy, terminate the applicableAgreement and this DPA with respect only to those Services which cannot be provided by Securiti without the useof the objected-to new Sub-processor by providing written notice to Securiti provided that all amounts due under the Agreement before the termination date with respect to the Processing at issue shall be duly paid to Securiti. Until a decision is made regarding the new Sub-processor, Securiti may temporarily suspend theProcessing of the affected Personal Data. Client will have no further claims against Securiti due to the termination of the Agreement (including, without limitation, requesting refunds) and/or the DPA in the situation described in this paragraph.
3. Agreements with Sub-processors. Securiti shall respect the conditions referred to in Articles 28.2 and 28.4 of the GDPR when engaging another processor for Processing Personal Data provided by Client. In accordance with Articles 28.7 and 28.8 of the GDPR, if and when the European Commission lays down the standard contractual clauses referred to in such Article, the Parties may revise this DPA in good faith to adjust it to such standard contractual clauses.

SECURITY

1. Controls for the Protection of Personal Data. Taking into account the state of the art, Securiti shall maintain all industry-standard technical and organisational measures required pursuant to Article 32 of the GDPR for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data), confidentiality and integrity of Personal Data, as set forth in theSecurity Documentation which are hereby approved by Client. Securiti regularly monitors compliance with these measures. Upon the Client’s request, Securiti will assist Client, at Client’s cost, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Securiti.
2. Third-Party Certifications and Audits. Upon Client’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement and this DPA, Securiti shall make available to Client that is not a competitor of Securiti (or Client’s independent ,third-party auditor that is not a competitor of Securiti) a copy of Securiti’s then most recent third-party audits or certifications, as applicable (provided, however, that such audits, certifications and the results therefrom, including the documents reflecting the outcome of the audit and/or the certifications, shall only be used by Client to assess compliance with this DPA and/or with applicable Data Protection Laws and Regulations, and shall not be used for any other purpose or disclosed to any third party without Securiti’s prior written approval and, upon Securiti’s first request, Client shall return all records or documentation in Client’s possession or control provided by Securiti in the context of the audit and/or the certification). At Client’s cost and expense, Securiti shall allow for and contribute to audits, including inspections of Securiti’s systems and physical premises, conducted by the controller or another auditor mandated by the controller (who is not adirect or indirect competitor of Securiti) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections. Subject to Section 2.3.2, Client may request measures to be taken by Securiti following the results of the audit or inspection.

PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION

Securiti maintains security incident management policies and procedures specified in Security Documentation and, to the extent required under applicable Data Protection Laws and Regulations, shall notify Client without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, including Personal Data, transmitted, stored or otherwiseProcessed by Securiti or its Sub-processors of which Securiti becomes aware (a “Personal Data Incident”). Securiti shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Securiti deems necessary and reasonable in order to remediate the cause of such a Personal Data Incident to the extent there mediation is within Securiti’s reasonable control. The obligations herein shall not apply to incidents that are caused by Client or Client’s users. In any event, Client will be the party responsible for notifying supervisory authorities and/or concerned data subjects (where required by Data Protection Laws and Regulations).

RETURN AND DELETION OF PERSONAL DATA

Subject to the Agreement, Securiti shall, at the choice of Client, delete or return the Personal Data to Client after the end of the provision of the Services relating to processing, and shall delete existing copies unless applicable law requires storage of the Personal Data. In any event, to the extent required or allowed by applicable law, Securiti may retain one copy of the Personal Data for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. If the Client requests the Personal Data to be returned, the Personal Data shall be returned in the format generally available for Securiti’s Clients.

AUTHORIZED AFFILIATES

1. How this DPA Applies. The Securiti and Client entity that is party to theAgreement is party to this DPA. The Parties acknowledge and agree that, by executing the DPA, the Client enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates, provided that Client shall remain the responsible for the acts and omissions of its Authorized Affiliates. Each Authorized Affiliate agrees to be bound by the obligations under this DPA. All access to and use of the Services by Authorized Affiliates must comply with the terms and conditions of the Agreement and this DPA provided that any violation of the terms and conditions therein by an Authorized Affiliate shall be deemed a violation byClient.
2. Communication and Exercise of Rights. The Client entity that is the contracting party to the Agreement shall, on behalf of itself and its Authorized Affiliates, (a) remainresponsible for coordinating, making, and receiving all communication with Securiti under the Agreement and thisDPA and (b) exercise any rights herein in a combined manner with Securiti under this DPA.

TRANSFERS OF DATA

1. Transfers to countries that offer adequate level of data protection.Personal Data may be transferred from the EU Member States, the three EEA member countries (Norway,Liechtenstein and Iceland) and the United Kingdom (collectively, “EEA”) to countries that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the EEA, the Union, the Member States or the European Commission (“Adequacy Decisions”), without any further safeguard being necessary.
2. Transfers to other countries. If the Processing of Personal Data includes transfers from the EEA to countries outside the EEA which do not offer adequate level of data protection or which have not been subject to an Adequacy Decision (“Other Countries”), the Parties shall comply with Chapter V of the GDPR, including, executing the standard data protection clauses adopted by the relevant data protection authorities of the EEA, the Union, the Member States or the European Commission (“Standard Contractual Clauses”)or comply with any of the other mechanisms provided for in the GDPR for transferring Personal Data to such OtherCountries. In this regard, Client, on behalf of itself and its Authorized Affiliates, as transferor, and Securiti, on behalf of itself and each of its Affiliate, as transferee, hereby enter into the StandardContractual Clauses set out in Schedule 3. To the extent that there is any conflict or inconsistency between the terms of the Standard Contractual Clauses and the terms of this DPA, the terms of the Standard ContractualClauses shall take precedence. The Standard Contractual Clauses shall come into effect on the commencement of a transfer of Personal Data to Other Countries among any Parties to the Standard Contractual Clauses.

TERMINATION

This DPA shall automatically terminate upon the termination or expiration of theAgreement under which the Services are provided. Sections 2.2, 2.3.3, 2.3.4 and 12 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.

RELATIONSHIP WITH AGREEMENT

In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement.

Notwithstanding anything to the contrary in the Agreement and/or in any agreement between the parties and to the maximum extent permitted by law: (A) Securiti’s (including Securiti’s Affiliates’)entire, total and aggregate liability, related to, or for breach of, this DPA and/or Data Protection Laws andRegulations, including, without limitation, if any, any indemnification obligation under the Agreement or applicable law regarding data protection or privacy, shall be limited to the amounts paid to Securiti under the Agreement within twelve (12) months preceding the event that gave rise to the claim. This limitation of liability is cumulative and not per incident; (B) In no event will Securiti and/or Securiti Affiliates and/or their third-party providers, be liable under, or otherwise in connection with this DPA for: (i) any indirect, exemplary, special, consequential, incidental or punitive damages; (ii) any loss of profits, business, or anticipated savings; (iii) any loss of, or damage to data, reputation, revenue or goodwill; and/or (iv) the cost of procuring any substitute goods or services; and (C) The foregoing exclusions and limitations on liability set forth in this Section shall apply:(i) even if Securiti, Securiti Affiliates or third-party providers, have been advised, or should have been aware, of the possibility of losses or damages; (ii) even if any remedy in this DPA fails of its essential purpose; and (iii)regardless of the form, theory or basis of liability (such as, but not limited to, breach of contract or tort).

AMENDMENTS

This DPA may be amended at any time by a written instrument duly signed by each of the Parties.

LEGAL EFFECT

This DPA shall only become legally binding between Client and Securiti when the formalities steps set out in the Section “INSTRUCTIONS ON HOW TO EXECUTE THIS DPA” below have been fully completed.

SIGNATURE

The Parties represent and warrant that they each have the power to enter into, execute, perform and be bound by this DPA.

You, as the signing person on behalf of Client, represent and warrant that you have, or you were granted, full authority to bind the Organisation and, as applicable, its Authorized Affiliates to this DPA. If you cannot, or do not have authority to, bind the Organisation and/or its Authorized Affiliates, you shall not supply or provide Personal Data to Securiti.

By signing this DPA, Client enters into this DPA on behalf of itself and, to the extent required or permitted under applicable Data Protection Laws and Regulations, in the name and on behalf of its Authorized Affiliates, if and to the extent that Securiti processes Personal Data for which such Authorized Affiliates qualify as the/a “data controller”.

This DPA has been pre-signed on behalf of Securiti.

Instructions on how to execute this DPA.

1. To complete this DPA, you must complete the missing information; and
2. Send the completed and signed DPA to us by email, indicating the Client’s name, to [email protected]

List of Schedules

• SCHEDULE 1 - DETAILS OF THE PROCESSING

• SCHEDULE 2 - SUB-PROCESSOR LIST

• SCHEDULE 3 – STANDARD CONTRACTUAL CLAUSES

The parties’ authorized signatories have duly executed this Agreement:

Client:

Signature:

Client Legal Name:

Print Name:

Title:

Date:

Securiti INC

Signature:

Legal Name:

Print Name:

Title:

Date:

SCHEDULE 1 - DETAILS OF THE PROCESSING

Subject matter

Securiti will Process Personal Data as necessary to perform the Services pursuantto the Agreement, as further instructed by Client in its use of the Services.

Nature and Purpose of Processing

1. Providing the Service(s) to Client.
2. Setting up profile(s) for users authorized by Clients.
3. For Client to be able to use the Services.
4. For Securiti to comply with documented reasonable instructions provided byClient where such instructions are consistent with the terms of the Agreement.
5. Performing the Agreement, this DPA and/or other contracts executed by theParties.
6. Providing support and technical maintenance, if agreed in the Agreement.
7. Resolving disputes.
8. Enforcing the Agreement, this DPA and/or defending Securiti’s rights.
9. Management of the Agreement, the DPA and/or other contracts executed by theParties, including fees payment, account administration, accounting, tax, management, litigation; and
10. Complying with applicable laws and regulations, including for cooperatingwith local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
11. All tasks related with any of the above.

Duration of Processing

Subject to any Section of the DPA and/or the Agreement dealing with the durationof the Processing and the consequences of the expiration or termination thereof, Securiti will Process Personal Datafor the duration of the Agreement, unless otherwise agreed upon in writing.

Type of Personal Data

Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in its solediscretion, and which may include, but is not limited to the following categories of Personal Data:

1. First name
2. Last name
3. Address
4. Phone number
5. Email address
6. Payment information
7. Any other Personal Data or information that the Client decides to provide tothe Securiti or the Services.

The Client and the Data Subjects shall provide the Personal data to Securiti by supplying the Personal data toSecuriti’s Service.

In some limited circumstances Personal Data may also come from others sources, forexample, in the case of anti-money laundering research, fraud detection or as required by applicable law. Forclarity, Client shall always be deemed the “Data Controller” and Securiti shall always be deemed the “DataProcessor” (as such terms are defined in the GDPR).

Categories of Data Subjects

Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in its solediscretion, and which may include, but is not limited to Personal Data relating to the following categories of datasubjects:

1. Client’s customers and/or clients
2. Client’s users authorized by Client to use the Services
3. Employees, agents, advisors, freelancers of Client (who are natural persons)
4. Prospects, Clients, business partners and vendors of Client (who are naturalpersons)
5. Employees or contact persons of Client’s prospects, Clients, businesspartners and vendors

SCHEDULE 2 – SUB-PROCESSOR LIST

SCHEDULE 3 – STANDARD CONTRACTUAL CLAUSES CONTROLLER TO PROCESSOR

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer ofpersonal data to processors established in third countries which do not ensure an adequate level of data protection

Name of the data exporting organisation: CLIENT NAME or any CLIENT NAME Affiliate(in each case as defined in the DPA)

Address: ________________

Tel.: ________________; fax: _________________; e-mail:__________________

Other information needed to identify the organisation

…………………………………………………………… (the data exporter) And

Name of the data importing organisation: Securiti or any Securiti Affiliate (ineach case as defined in the DPA)

Address: PO Box 13039 Coyote CA 95013

Tel.: 408-401-1160; fax: 408-351-0294; e-mail: [email protected]

Other information needed to identify the organisation:

83-2500426

(the data importer)

each a “party”; together “the parties”,

HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduceadequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals forthe transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Background

The data exporter has entered into a data protection addendum (“DPA”) with thedata importer. Pursuant to the terms of the DPA, it is contemplated that services provided by the data importer willinvolve the transfer of personal data to data importer. Data importer is located in a country not ensuring anadequate level of data protection. To ensure compliance with Directive 95/46/EC and applicable data protection law,the controller agrees to the provision of such Services, including the processing of personal data incidentalthereto, subject to the data importer’s execution of, and compliance with, the terms of these Clauses.

Clause 1

Definitions

For the purposes of the Clauses:

1. 'personal data', 'special categories of data', 'process/processing','controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as inDirective 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection ofindividuals with regard to the processing of personal data and on the free movement of such data;
2. 'the data exporter' means the controller who transfers the personal data;
3. 'the data importer' means the processor who agrees to receive from the dataexporter personal data intended for processing on his behalf after the transfer in accordance with hisinstructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequateprotection within the meaning of Article 25(1) of Directive 95/46/EC;
4. 'the subprocessor' means any processor engaged by the data importer or byany other subprocessor of the data importer who agrees to receive from the data importer or from any othersubprocessor of the data importer personal data exclusively intended for processing activities to be carried outon behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clausesand the terms of the written subcontract;
5. 'the applicable data protection law' means the legislation protecting thefundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to theprocessing of personal data applicable to a data controller in the Member State in which the data exporter isestablished;
6. 'technical and organisational security measures' means those measures aimedat protecting personal data against accidental or unlawful destruction or accidental loss, alteration,unauthorised disclosure or access, in particular where the processing involves the transmission of data over anetwork, and against all other unlawful forms of processing;
7. 'DPA' has the meaning given to it in the Background recital above.

Clause 2

Details of the transfer

The details of the transfer and in particular the special categories of personaldata where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3

Third-party beneficiary clause

1. The data subject can enforce against the data exporter this Clause, Clause4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12as third-party beneficiary.
2. The data subject can enforce against the data importer this Clause, Clause5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter hasfactually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legalobligations of the data exporter by contract or by operation of law, as a result of which it takes on the rightsand obligations of the data exporter, in which case the data subject can enforce them against such entity.
3. The data subject can enforce against the subprocessor this Clause, Clause5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporterand the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless anysuccessor entity has assumed the entire legal obligations of the data exporter by contract or by operation oflaw as a result of which it takes on the rights and obligations of the data exporter, in which case the datasubject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited toits own processing operations under the Clauses.
4. The parties do not object to a data subject being represented by anassociation or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4

Obligations of the data exporter

The data exporter agrees and warrants:

1. that the processing, including the transfer itself, of the personal data hasbeen and will continue to be carried out in accordance with the relevant provisions of the applicable dataprotection law (and, where applicable, has been notified to the relevant authorities of the Member State wherethe data exporter is established) and does not violate the relevant provisions of that State;
2. that it has instructed and throughout the duration of the personal dataprocessing services will instruct the data importer to process the personal data transferred only on the dataexporter's behalf and in accordance with the applicable data protection law and the Clauses;
3. that the data importer will provide sufficient guarantees in respect of thetechnical and organisational security measures specified in Appendix 2 to this contract;
4. that after assessment of the requirements of the applicable data protectionlaw, the security measures are appropriate to protect personal data against accidental or unlawful destructionor accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involvesthe transmission of data over a network, and against all other unlawful forms of processing, and that thesemeasures ensure a level of security appropriate to the risks presented by the processing and the nature of thedata to be protected having regard to the state of the art and the cost of their implementation;
5. that it will ensure compliance with the security measures;
6. that, if the transfer involves special categories of data, the data subjecthas been informed or will be informed before, or as soon as possible after, the transfer that its data could betransmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
7. to forward any notification received from the data importer or anysubprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the dataexporter decides to continue the transfer or to lift the suspension;
8. to make available to the data subjects upon request a copy of the Clauses,with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of anycontract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses orthe contract contain commercial information, in which case it may remove such commercial information;
9. that, in the event of subprocessing, the processing activity is carried outin accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personaldata and the rights of data subject as the data importer under the Clauses; and
10. that it will ensure compliance with Clause 4(a) to (i).

Clause 5

Obligations of the data importer

The data importer agrees and warrants:

1. to process the personal data only on behalf of the data exporter and incompliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, itagrees to inform promptly the data exporter of its inability to comply, in which case the data exporter isentitled to suspend the transfer of data and/or terminate the contract;
2. that it has no reason to believe that the legislation applicable to itprevents it from fulfilling the instructions received from the data exporter and its obligations under thecontract and that in the event of a change in this legislation which is likely to have a substantial adverseeffect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the dataexporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of dataand/or terminate the contract;
3. that it has implemented the technical and organisational security measuresspecified in Appendix 2 before processing the personal data transferred;
4. that it will promptly notify the data exporter about:
   1. 'any legally binding request for disclosure of the personal data bya law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law topreserve the confidentiality of a law enforcement investigation,
   2. any accidental or unauthorised access, and
   3. any request received directly from the data subjects withoutresponding to that request, unless it has been otherwise authorised to do so;
5. to deal promptly and properly with all inquiries from the data exporterrelating to its processing of the personal data subject to the transfer and to abide by the advice of thesupervisory authority with regard to the processing of the data transferred;
6. at the request of the data exporter to submit its data processing facilitiesfor audit of the processing activities covered by the Clauses which shall be carried out by the data exporter oran inspection body composed of independent members and in possession of the required professional qualificationsbound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with thesupervisory authority;
7. to make available to the data subject upon request a copy of the Clauses, orany existing contract for subprocessing, unless the Clauses or contract contain commercial information, in whichcase it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by asummary description of the security measures in those cases where the data subject is unable to obtain a copyfrom the data exporter;
8. that, in the event of subprocessing, it has previously informed the dataexporter and obtained its prior written consent;
9. that the processing services by the subprocessor will be carried out inaccordance with Clause 11;
10. to send promptly a copy of any subprocessor agreement it concludes under theClauses to the data exporter.

Clause 6

Liability

1. The parties agree that any data subject, who has suffered damage as a resultof any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor isentitled to receive compensation from the data exporter for the damage suffered.
2. If a data subject is not able to bring a claim for compensation inaccordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or hissubprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter hasfactually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the datasubject may issue a claim against the data importer as if it were the data exporter, unless any successor entityhas assumed the entire legal obligations of the data exporter by contract of by operation of law, in which casethe data subject can enforce its rights against such entity.The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its ownliabilities.
3. If a data subject is not able to bring a claim against the data exporter orthe data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of theirobligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer havefactually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the datasubject may issue a claim against the data subprocessor with regard to its own processing operations under theClauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entirelegal obligations of the data exporter or data importer by contract or by operation of law, in which case thedata subject can enforce its rights against such entity. The liability of the subprocessor shall be limited toits own processing operations under the Clauses.

Clause 7

Mediation and jurisdiction

1. The data importer agrees that if the data subject invokes against itthird-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer willaccept the decision of the data subject:
   1. to refer the dispute to mediation, by an independent person or,where applicable, by the supervisory authority;
   2. to refer the dispute to the courts in the Member State in which thedata exporter is established.
2. The parties agree that the choice made by the data subject will notprejudice its substantive or procedural rights to seek remedies in accordance with other provisions of nationalor international law.

Clause 8

Cooperation with supervisory authorities

1. The data exporter agrees to deposit a copy of this contract with thesupervisory authority if it so requests or if such deposit is required under the applicable data protection law.
2. The parties agree that the supervisory authority has the right to conduct anaudit of the data importer, and of any subprocessor, which has the same scope and is subject to the sameconditions as would apply to an audit of the data exporter under the applicable data protection law.
3. The data importer shall promptly inform the data exporter about theexistence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the dataimporter, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled totake the measures foreseen in Clause 5 (b).

Clause 9

Governing Law

The Clauses shall be governed by the law of the Member State in which the dataexporter is established.

Clause 10

Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not precludethe parties from adding clauses on business related issues where required as long as they do not contradict theClause.

Clause 11

Subprocessing

1. The data importer shall not subcontract any of its processing operationsperformed on behalf of the data exporter under the Clauses without the prior written consent of the dataexporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the dataexporter, it shall do so only by way of a written agreement with the subprocessor which imposes the sameobligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessorfails to fulfil its data protection obligations under such written agreement the data importer shall remainfully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.
2. The prior written contract between the data importer and the subprocessorshall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the datasubject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the dataexporter or the data importer because they have factually disappeared or have ceased to exist in law or havebecome insolvent and no successor entity has assumed the entire legal obligations of the data exporter or dataimporter by contract or by operation of law. Such third-party liability of the subprocessor shall be limited toits own processing operations under the Clauses.
3. The provisions relating to data protection aspects for subprocessing of thecontract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporteris established.
4. The data exporter shall keep a list of subprocessing agreements concludedunder the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at leastonce a year. The list shall be available to the data exporter's data protection supervisory authority.

Clause 12

Obligation after the termination of personal data processing services

1. The parties agree that on the termination of the provision of dataprocessing services, the data importer and the subprocessor shall, at the choice of the data exporter, returnall the personal data transferred and the copies thereof to the data exporter or shall destroy all the personaldata and certify to the data exporter that it has done so, unless legislation imposed upon the data importerprevents it from returning or destroying all or part of the personal data transferred. In that case, the dataimporter warrants that it will guarantee the confidentiality of the personal data transferred and will notactively process the personal data transferred anymore.
2. The data importer and the subprocessor warrant that upon request of the dataexporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of themeasures referred to in paragraph 1.

On behalf of the data exporter:

Name (written out in full):

Position:

Address:

Other information necessary in order for the contract to be binding (if any):

Signature……………………………………….

On behalf of the data importer:

Name (written out in full): James Stoddard

Position: Controller

Address: PO Box 13039 Coyote CA 95013

Other information necessary in order for the contract to be binding (if any):

Signature……………………………………….

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by theParties

The Member States may complete or specify, according to their national procedures,any additional necessary information to be contained in this Appendix.

Data exporter

The data exporter is:

A [Client to complete] which, as between the Parties, acts as data controller withrespect to personal data pertaining to its clients, business partners and staff as well as the clients, businesspartners and staff of other CLIENT NAME Affiliates located in the European Economic Area.

Data importer

The data importer is the developer of PRIVACI.ai, the PrivacyOps platform withmultiple modules to assist with compliance for privacy regulations.

Data subjects

The personal data transferred concern the following categories of data subjects:

See Schedule 1 of the DPA

Categories of data

The personal data transferred concern the following categories of data:

See Schedule 1 of the DPA

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data:

See Schedule 1 of the DPA

Processing operations

The personal data transferred will be subject to the following basic processingactivities:

See Schedule 1 of the DPA

DATA EXPORTER

Name:………………………………

Authorized Signature ……………………

DATA IMPORTER

Name: James Stoddard

Authorized Signature ……………………

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by theParties.

Description of the technical and organisational security measures implemented bythe data importer in accordance with Clauses 4(d) and 5(c):

See section 6 of the DPA.