Data Protection Addendum

This Data Processing Addendum (this "DPA") is between Customer (as defined in the Terms of Service) (“Controller”), and Shogun Labs, Inc. a Delaware company (the "Processor") (each a "Party" and collectively the "Parties"). This DPA supplements the Terms of Service entered into between the Parties ("Agreement").

1. DEFINITIONS

1.1 Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalized terms used in this DPA will be defined as follows:

• ‍"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time.‍
• "Controller Affiliate" means an affiliate of Controller who is a beneficiary to the Agreement.‍
• "Covered Data" means Personal Data that is: (a) provided by or on behalf of Controller to Processor in connection with the Services; or (b) obtained, developed, produced or otherwise Processed by Processor, or its agents or subcontractors, for purposes of providing the Services.‍
• "Data Subject" means a natural person whose Personal Data is Processed.‍
• "Deidentified Data" means data created using Covered Data that cannot reasonably be linked to such Covered Data, directly or indirectly.‍
• "EEA" means the European Economic Area including the European Union ("EU").‍
• "GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR" as defined under section 3 of the Data Protection Act 2018 or, where applicable, the equivalent provision under Swiss data protection law.‍
• "Member State" means a member state of the EEA, being a member state of the European Union, Iceland, Norway, or Liechtenstein.‍
• "Personal Data" means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data," "personal information," "personally identifiable information," or similarly defined data or information under Applicable Data Protection Laws.‍
• "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. "Process", "Processes" and "Processed" will be interpreted accordingly.‍
• "Security Incident" means a confirmed or reasonably suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to (including unauthorized internal access to), Covered Data.‍
• "Services" means the services to be provided by Processor pursuant to the Agreement.‍
• "Standard Contractual Clauses" or "SCCs" means Module Two (controller to processor) and/or Module Three (processor to processor) of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.‍
• "Sub-processor" means an entity appointed by Processor to Process Covered Data on its behalf.‍
• "UK" means the United Kingdom.‍
• "US Data Protection Laws" means, to the extent applicable, federal and state laws relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States.

2. INTERACTION WITH THE AGREEMENT

1. This DPA is incorporated into and forms an integral part of the Agreement. This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any Processing of Covered Data.
2. Any Processing operation as described in clause 4 (Details of Data Processing) and Schedule 1 to this DPA will be subject to this DPA.
3. Controller Affiliates will be beneficiaries under this DPA and, through Controller (see clauses 2.4 and 2.5), be entitled to enforce all rights in relation to Covered Data provided by the respective Affiliate. Controller will ensure that all obligations under this DPA will be passed on to the respective Controller Affiliate.
4. Controller warrants that it is duly mandated by any Controller Affiliates on whose behalf Processor Processes Covered Data in accordance with this DPA to (a) enforce the terms of this DPA on behalf of Controller Affiliates, and to act on behalf of Controller Affiliates in the administration and conduct of any claims arising in connection with this DPA; and (b) receive and respond to any notices or communications under this DPA on behalf of Controller Affiliates.
5. Controller will be the only point of contact for all communication between Controller Affiliates and Processor.

3. ROLE OF THE PARTIES

The Parties acknowledge and agree that:

1. for the purposes of the GDPR, where applicable, Processor acts as "processor" or "sub-processor" (as defined in the GDPR). Processor's function as processor or sub-processor will be determined by the function of Controller:
   • Where Controller acts as a controller, Processor acts as a processor.
   • Where Controller acts as a processor on behalf of another controller, Processor acts as a sub-processor.
2. for the purposes of the US Data Protection Laws, Processor will act as a "service provider" or "processor" (as defined in US Data Protection Laws), as applicable, in its performance of its obligations pursuant to the Agreement and this DPA.

4. DETAILS OF DATA PROCESSING

1. The details of the Processing of Personal Data under the Agreement and this DPA (such as subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.
2. Covered Data will only be Processed on behalf of and under the instructions of Controller and in accordance with Applicable Data Protection Laws. The Agreement and this DPA will generally constitute instructions for the Processing of Covered Data. Controller may issue further written instructions in accordance with this DPA. Without limiting the foregoing, Processor is prohibited from:
   • selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
   • sharing Covered Data with any third party for cross-context behavioral advertising;
   • retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Applicable Data Protection Laws;
   • retaining, using, or disclosing Covered Data outside of the direct business relationship between the Parties; and
   • except as otherwise permitted by Applicable Data Protection Laws, combining Covered Data with Personal Data that Processor receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.
3. Notwithstanding the foregoing, Processor is permitted to anonymize Covered Data and use such anonymized data for its own business purposes, including for research, development or new products and services, and security purposes.
4. Processor will limit access to Covered Data to personnel who have a business need to have access to such Covered Data, and will ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement.
5. Processor may (without prejudice to clause 12) Process Covered Data anywhere that Processor or its Sub-processors maintain facilities.
6. Processor will provide Controller with information to enable Controller to conduct and document any data protection assessments required under Applicable Data Protection Laws and the Controller will reimburse the Processor for such reasonable costs incurred by the Processor in connection with its assistance. In addition, Processor will notify Controller promptly if Processor determines that it can no longer meet its obligations under Applicable Data Protection Laws.
7. Controller will have the right to take reasonable and appropriate steps to ensure that Processor uses Covered Data in a manner consistent with Controller's obligations under Applicable Data Protection Laws.

5. CONTROLLER WARRANTIES

1. Controller represents and warrants that it has provided all applicable notices to data subjects and, to the extent required, obtained consent from data subjects in each case as required for the lawful Processing of Covered Data in accordance with Agreement and this DPA.

6. SUB-PROCESSORS

1. Controller grants Processor the general authorisation to engage Sub-processors, subject to clause 6.2, as well as Processor's current Sub-processors listed in Schedule 5 as of the effective date of the Agreement (“Effective Date”).
2. Processor will enter into a written agreement with each Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Processor's obligations under this DPA.
3. Processor will provide Controller with at least fifteen (15) days' notice of any proposed changes to the Sub-processors it uses to Process Covered Data. Controller may object to Processor's use of a new Sub-processor (including when exercising its right to object under clause 9(a) of the SCCs if applicable) by providing Processor with written notice of the objection within ten (10) days after Processor has provided notice to Controller of such proposed change (an "Objection"). If Controller does not object to the engagement within the Objection period, consent regarding the engagement will be assumed. In the event Controller objects to Processor's use of a new Sub-processor, Controller and Processor will work together in good faith to find a mutually acceptable resolution to address such Objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, either Party may, as its sole and exclusive remedy, terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to the other Party. During any such Objection period, Processor may suspend the affected portion of the Services.

7. DATA SUBJECT RIGHTS REQUESTS

1. As between the Parties, Controller will have sole discretion and responsibility in responding to the rights asserted by any individual in relation to Covered Data under Applicable Data Protection Laws (each, a "Data Subject Request").
2. Processor will promptly forward to Controller without undue delay any Data Subject Request received by Processor or any Sub-processor and may advise the individual to submit their request directly to Controller.
3. Processor will provide Controller with reasonable assistance as necessary for Controller to fulfil its obligation under Applicable Data Protection Laws to respond to Data Subject Requests, including if applicable, Controller's obligation to respond to requests for exercising the rights set out in Applicable Data Protection Laws.

8. SECURITY AND AUDITS

1. Processor will implement and maintain appropriate technical and organizational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage of or to it. When assessing the appropriate level of security, account will be taken in particular of the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Covered Data.
2. Processor will implement and maintain as a minimum standard the measures set out in Schedule 2.
3. Controller will have the right to audit Processor's compliance with this DPA. The Parties agree that all such audits will be conducted:
   • upon reasonable written notice to Processor;
   • only once per year; and
   • only during Processor's normal business hours.
4. To conduct such audits, Controller may engage a third-party auditor subject to such auditor complying with the requirements under clause 8.3 and provided that such auditor is suitably qualified and independent.
5. To request an audit, Controller must submit a detailed proposed audit plan to Processor at least two weeks in advance of the proposed audit date. Processor will review the proposed audit plan and work cooperatively with Controller to agree on a final audit plan. All such audits must be conducted subject to the agreed final audit plan and Processor's health and safety or other relevant policies.
6. Controller will promptly notify Processor of any non-compliance discovered during an audit.
7. Controller will bear the costs for any audit initiated by Controller, unless the audit reveals material non-compliance with the requirements of this DPA.
8. Upon request, Processor will provide to Controller documentation reasonably evidencing the implementation of the technical and organizational data security measures in accordance with industry standards. Processor may, in its discretion, provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company. If the requested audit scope is addressed in such a certification produced by a qualified third-party auditor within twelve (12) months of Controller's audit request and Processor confirms there are no known material changes in the controls audited, Controller agrees to accept those findings in lieu of requesting an audit of the controls covered by the report
9. Processor will audit its Sub-processors on a regular basis and will, upon Controller's request, confirm their compliance with Applicable Data Protection Laws and the Sub-processors' contractual obligations.

9. SECURITY INCIDENTS

Processor will notify Controller in writing without undue delay after becoming aware of any Security Incident, and reasonably cooperate in any obligation of Controller under Applicable Data Protection Laws to make any notifications, such as to individuals or supervisory authorities. Processor will take reasonable steps to contain, investigate, and mitigate any Security Incident, and will send Controller timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Processor's notification of or response to a Security Incident under this clause 9 will not be construed as an acknowledgement by Processor of any fault or liability with respect to the Security Incident.

Processor will provide reasonable assistance with Controller's investigation of the possible Security Incident and any notification obligation of Controller under Applicable Data Protection Laws, such as in relation to individuals or supervisory authorities.

10. DELETION AND RETURN

Processor will, within thirty (30) days of the date of termination or expiry of the Agreement (a) if requested to do so by Controller within that period, return a copy of all Covered Data or provide a self-service functionality allowing Controller to do the same; and (b) delete all other copies of Covered Data Processed by Processor or any Sub-processors.

11. CONTRACT PERIOD

This DPA will commence on the Effective Date and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Processor's deletion of all Covered Data as described in this DPA.

12. STANDARD CONTRACTUAL CLAUSES

1. The Parties agree that the terms of the Standard Contractual Clauses Module Two (Controller to Processor) and Module Three (Processor to Processor), as further specified in Schedule 3 of this DPA, are hereby incorporated by reference and will be deemed to have been executed by the Parties and apply to any transfers of Covered Data falling within the scope of the GDPR from Controller (as data exporter) to Processor (as data importer).
2. To the extent applicable, the jurisdiction-specific addenda to the Standard Contractual Clauses set out in Schedule 3 are also incorporated herein by reference and will be deemed to have been executed by the Parties and apply to any transfers of Covered Data falling within the scope of Applicable Data Protection Laws in the listed jurisdiction(s) from Controller (as data exporter) to Processor (as data importer).
3. Processor will provide Controller reasonable support to enable Controller's compliance with the requirements imposed on international transfers of Covered Data. Processor will, upon Controller's request, provide information to Controller which is reasonably necessary for Controller to complete a transfer impact assessment ("TIA") under Applicable Data Protection Laws.
4. Processor further agrees to implement the supplementary measures agreed upon and set forth in Schedule 4 of this DPA in order to enable Controller's compliance with requirements imposed on international transfers of Covered Data under Applicable Data Protection Laws.

13. DEIDENTIFIED DATA

If Processor receives Deidentified Data from or on behalf of Controller, then Processor will:

1. take reasonable measures to ensure the information cannot be associated with a Data Subject.
2. publicly commit to Process the Deidentified Data solely in deidentified form and not to attempt to reidentify the information.
3. contractually obligate any recipients of the Deidentified Data to comply with the foregoing requirements and Applicable Data Protection Laws.

14. GENERAL

1. The Parties hereby certify that they understand the requirements in this DPA and will comply with them.
2. The Parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.
3. This DPA and the Agreement set forth the entire agreement between the Parties with respect to the subject matter hereof.

IN WITNESS WHEREOF, the Parties hereto have executed this DPA as of the Effective Date.

Schedule 1

DETAILS OF PROCESSING

A. List of Parties

The Parties are set out in the preamble to this DPA. With regard to any transfers of Covered Data falling within the scope of the GDPR from Controller to Processor, additional information regarding the data exporter and data importer is set out below.

1. ‍Data Exporter‍
   • The data exporter is: each of the Controller and/or Controller Affiliates operating in the countries which comprise the European Economic Area, UK and/or Switzerland and/or – to the extent agreed by the Parties – Controller and/or Controller Affiliates in any other country to the extent the GDPR applies.
   • The data exporter's contact person's name, position and contact details as well as (if appointed) the data protection officer's name and contact details and (if relevant) the representative's contact details are included in the Agreement or will be disclosed to Processor upon request.
   • The activities relevant to the data transfer under these Clauses are defined by the Agreement and the data exporter who decides on the scope of the Processing of Personal Data in connection with the Services further described in section B of this Schedule 1.‍
2. ‍Data Importer‍
   • The data importer is: the Processor.
   • The data importer's contact person and contact details are included in the Agreement or will be disclosed to Controller upon request.
   • The data importer's activities relevant to the data transfer under these Clauses are as follows: the data importer Processes Personal Data provided by the data exporter on behalf of the data exporter in connection with providing the Services to the data exporter as further described in section B of this Schedule 1 and in the Agreement.

B. Description of Processing

1. Categories of Data Subjects‍
   • The categories of Data Subjects whose Personal Data are Processed: Unless provided otherwise by the Data Exporter, transferred GDPR Personal Data relates to the following categories of data subjects: customer end user data.‍
2. ‍Categories of Personal Data‍
   • The Processed categories of Personal Data are: The Controller determines the categories of data entered onto the Services. The transferred Personal Data typically relates to the following categories of data: e.g., name, phone numbers, email address, address data where accessed for the limited purpose of providing customer service and in form submission.‍
3. Special categories of Personal Data (if applicable)‍
   • The Processed Personal Data includes the following special categories of data: None.‍
4. ‍Frequency of the Processing‍
   • The Processing is performed continuously.‍
5. Subject matter and nature of the Processing‍
   • The subject matter of the Processing is: to allow the Processor to provide the Services to the Controller.‍
6. Purpose(s) of the data transfer and further Processing‍
   • The purpose/s of the data transfer and further Processing is:
     • use of Personal Data to set up, operate, monitor and provide the Services (including operational and technical support)
     • provision of consulting services
     • communication to authorized users
     • storage of Personal Data in dedicated data centers
     • upload any fixes or upgrades to the Services
     • back up of Personal Data
     • computer processing of Personal Data, including data transmission, data retrieval, data access
     • network access to allow Personal Data transfer
     • execution of instructions of the Controller in accordance with the Agreement‍
7. Storage Limitation‍
   • The period during which the Personal Data will be Processed, or, if that is not possible, the criteria used to determine that period: for the duration of the Agreement.‍
8. Sub-processor (if applicable)‍
   • For Processing by sub-processors, specify subject matter, nature, and duration of the Processing: as detailed in Schedule 5.‍

C. Competent Supervisory Authority

Identify the competent supervisory authority/ies in accordance with clause 13 of the SCCs

Where the data exporter is established in an EU Member State: The supervisory authority of the country in which the data exporter established is the competent authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR: The competent supervisory authority is the one of the Member State in which the representative is established.

‍Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without, however, having to appoint a representative pursuant to Article 27(2) of the GDPR: The competent supervisory authority is the supervisory authority of Ireland.

Schedule 2

TECHNICAL AND ORGANIZATIONAL MEASURES

Processor has implemented the following technical and organizational measures (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, as well as the risks for the rights and freedoms of natural persons:

Processor maintains internal policies and procedures, and procures that its Subprocessors also maintain internal policies and procedures, which are designed to:

• secure any Covered Data Processed by Processor against accidental or unlawful loss, access, or disclosure;
• identify reasonably foreseeable and internal risks to security and unauthorized access to any Covered Data Processed by Processor; and
• minimize security risks, including through risk assessment and regular testing.

Processor will, and will also procure that its Subprocessors will, conduct periodic reviews to:

• evaluate the security of its network and associated services and the adequacy of its information security program, as measured against industry security standards, Processor’s policies and procedures, and all applicable information security requirements in the Agreement; and
• determine whether additional or different security measures are required (i) for Processor’s continued compliance with industry standards, its policies and procedures, and all applicable information security requirements in the Agreement, and (ii) to respond to new security risks or findings generated by the period reviews.  

Without limiting the generality of the foregoing provisions of this Schedule 2, Processor will implement and maintain (for so long as Processor continues to Process any Covered Data) all applicable information security requirements in the Agreement. In the event of a conflict between the provisions of the Information Security Requirements and a provision of this Data Processing Agreement, the provision that is more stringent will control.

Schedule 3

STANDARD CONTRACTUAL CLAUSES

1. EU SCCS

The Standard Contractual Clauses will apply to any Processing of Covered Data that is subject to the GDPR. For the purposes of the Standard Contractual Clauses:

1. Module Two will apply in the case of the Processing under clause 3(a)(i) of the DPA and Module Three will apply in the case of Processing under clause 3(a)(ii) of the DPA.
2. Clause 7 of the Standard Contractual Clauses (Docking Clause) does not apply.
3. Clause 9(a) option 2 (General written authorization) is selected, and the time period to be specified is determined in clause 6.3 of the DPA.
4. The option in Clause 11(a) of the Standard Contractual Clauses (Independent dispute resolution body) does not apply.
5. With regard to Clause 17 of the Standard Contractual Clauses (Governing law), the Parties agree that, option 1 will apply and the governing law will be the law of the Republic of Ireland.
6. In Clause 18 of the Standard Contractual Clauses (Choice of forum and jurisdiction), the Parties submit themselves to the jurisdiction of the courts of the Republic of Ireland.
7. For the Purpose of Annex I of the Standard Contractual Clauses, Schedule 1 of the DPA contains the specifications regarding the parties, the description of transfer, and the competent supervisory authority.
8. For the Purpose of Annex II of the Standard Contractual Clauses, Schedule 2 of the DPA contains the technical and organizational measures.
9. The specifications for Annex III of the Standard Contractual Clauses, are determined by clause 6.1 of the DPA. The Sub-processor's contact person's name, position and contact details will be provided by Processor upon request.‍

2. UK ADDENDUM

This UK Addendum will apply to any Processing of Covered Data that is subject to the UK GDPR or to both the UK GDPR and the GDPR.

1. As used in this UK Addendum:
   • "Approved Addendum" means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, as it may be revised according to Section 18 of the Mandatory Clauses.
   • "Mandatory Clauses" means "Part 2: Mandatory Clauses" of the Approved Addendum.
2. With respect to any transfers of Covered Data falling within the scope of the UK GDPR from Controller (as data exporter) to Processor (as data importer):
   • the Approved Addendum as further specified in this Schedule 5 will form part of this DPA, and the Standard Contractual Clauses will be read and interpreted in light of the provisions of the Approved Addendum, to the extent necessary according to Clause 12 of the Mandatory Clauses;
   • In deviation to Table 1 of the Approved Addendum and in accordance with Clause 17 of the Mandatory Clauses, the parties are further specified in Schedule 1A. of this DPA.
   • The selected Modules and Clauses to be determined according to Table 2 of the Approved Addendum are further specified in this Schedule as amended by the Mandatory Clauses.
   • Annex 1 A and B of Table 3 to the Approved Addendum are specified by Schedule 1 of this DPA, Annex II of the Approved Addendum is further specified by Schedule 2 of this DPA, and Annex III of the Approved Addendum is further specified by Schedule 5 of this DPA.
   • Processor (as data importer) may end this DPA, to the extent the Approved Addendum applies, in accordance with clause ‎19 of the Mandatory Clauses;
   • Clause 16 of the Mandatory Clauses will not apply.

3. SWISS ADDENDUM

This Swiss Addendum will apply to any Processing of Covered Data that is subject to Swiss Data Protection Laws (as defined below) or to both Swiss Data Protection Laws and the GDPR.

3.1. Interpretation of this Addendum‍

1. Where this Addendum uses terms that are defined in the Standard Contractual Clauses, those terms will have the same meaning as in the Standard Contractual Clauses. In addition, the following terms have the following meanings:

2. This Addendum will be read and interpreted in the light of the provisions of Swiss Data Protection Laws, and so that if fulfils the Parties’ obligations under Article 16(2)(d) of the FADP.
3. This Addendum will not be interpreted in a way that conflicts with rights and obligations provided for in Swiss Data Protection Laws.
4. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

3.2. Hierarchy

In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions which provide the most protection to Data Subjects will prevail.

3.3. Incorporation of the Clauses

1. In relation to any Processing of Personal Data subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the GDPR, this Addendum amends the DPA the Standard Contractual Clauses to the extent necessary so they operate:
   • for transfers made by the data exporter to the data importer, to the extent that Swiss Data Protection Laws or Swiss Data Protection Laws and the GDPR apply to the data exporter's Processing when making that transfer; and
   • as standard data protection clauses approved, issued or recognized by the FDPIC for the purposes of Article 16(2)(d) of the FADP.
2. To the extent that any Processing of Personal Data is exclusively subject to Swiss Data Protection Laws, the amendments to the DPA including the SCCs, as further specified in this Schedule and as required by clause 3.1 of this Swiss Addendum, include (without limitation):
   • References to the "Clauses" or the "SCCs" mean this Swiss Addendum as it amends the SCCs.
   • Clause 6 Description of the transfer(s) is replaced with:
     • "The details of the transfer(s), and in particular the categories of Personal Data that are transferred and the purpose(s) for which they are transferred, are those specified in Schedule 1 of this DPA where Swiss Data Protection Laws apply to the data exporter's Processing when making that transfer."
   • References to "Regulation (EU) 2016/679" or "that Regulation" or "GDPR" are replaced by "Swiss Data Protection Laws" and references to specific Article(s) of "Regulation (EU) 2016/679" or "GDPR" are replaced with the equivalent Article or Section of Swiss Data Protection Laws extent applicable.
   • References to Regulation (EU) 2018/1725 are removed.
   • References to the "European Union", "Union", "EU" and "EU Member State" are all replaced with "Switzerland".
   • Clause 13(a) and Part C of Annex I are not used; the "competent supervisory authority" is the Federal Data Protection and Information Commissioner (the "FDPIC") insofar as the transfers are governed by Swiss Data Protection Laws;
   • Clause 17 is replaced to state:
     • "These Clauses are governed by the laws of Switzerland insofar as the transfers are governed by Swiss Data Protection Laws".
   • Clause 18 is replaced to state:
     • "Any dispute arising from these Clauses relating to Swiss Data Protection Laws will be resolved by the courts of Switzerland. A Data Subject may also bring legal proceedings against the data exporter and/or data importer before the courts of Switzerland in which he/she has his/her habitual residence. The Parties agree to submit themselves to the jurisdiction of such courts."

3.4. To the extent that any Processing of Personal Data is subject to both Swiss Data Protection Laws and the GDPR, the DPA including the Clauses as further specified in this Schedule will apply (i) as is and (ii) additionally, to the extent that a transfer is subject to Swiss Data Protection Laws, as amended by clauses 3.1 and 3.3 of this Swiss Addendum, with the sole exception that Clause 17 of the SCCs will not be replaced as stipulated under clause 3.3(b)(vii) of this Swiss Addendum.

3.5. Controller warrants that it and/or Controller Affiliates have made any notifications to the FDPIC which are required under Swiss Data Protection Laws.

Schedule 4

ADDITIONAL SUPPLEMENTARY MEASURES

Processor further commits to implementing supplementary measures based on guidance provided by EU supervisory authorities in order to enhance the protection of Covered Data in relation to the Processing in a third country, as described in this Schedule 4.

1. Additional Technical Measures
2. Encryption‍
   • The Personal Data is transmitted (between the Parties and by Processor between data centers as well as to a sub-processor and back) using strong encryption.
     • Hereby, it is ensured that the encryption protocols employed are state-of-the-art and provide effective protection against active and passive attacks with resources known to be available to the public authorities of this third country, the parties involved in the communication agree on a trustworthy public-key certification authority or infrastructure, specific protective and state-of-the-art measures are used against active and passive attacks on the sending and receiving systems providing transport encryption, including tests for software vulnerabilities and possible backdoors, in case the transport encryption does not provide appropriate security by itself due to experience with vulnerabilities of the infrastructure or the software used, Personal Data is also encrypted end-to-end on the application layer using state-of-the-art encryption methods, the encryption algorithm and its parameterization (e.g., key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities when data is transiting to this third country taking into account the resources and technical capabilities (e.g., computing power for brute-force attacks) available to them , the strength of the encryption takes into account the specific time period during which the confidentiality of the encrypted Personal Data must be preserved, the encryption algorithm is implemented correctly and by properly maintained software without known vulnerabilities the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification, the keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of the intended recipient, and revoked), by Controller or by an entity trusted by Controller under a jurisdiction offering an essentially equivalent level of protection.
   • In accordance with the requirements outlined in the previous paragraph, the Parties agree to implement strong end-to-end content encryption (between the Parties and by Processor between data centers as well as to a sub-processor and back).
   • The Personal Data at rest is stored by Processor using strong encryption.‍
     • The encryption algorithm and its parameterization (e.g., key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities in the recipient country taking into account the resources and technical capabilities (e.g., computing power for brute-force attacks) available to them. The strength of the encryption and key length takes into account the specific time period during which the confidentiality of the encrypted Personal Data must be preserved. The encryption algorithm is implemented correctly and by properly maintained software without known vulnerabilities the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification. The keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of an intended recipient, and revoked).‍
3. Additional Organizational Measures‍
   1. Internal policies for governance of transfers especially with groups of enterprises
      • Adoption of adequate internal policies with clear allocation of responsibilities for data transfers, reporting channels and standard operating procedures for cases of formal or informal requests from public authorities to access the data.‍
        • Especially in case of transfers among groups of enterprises, these policies may include, among others, the appointment of a specific team, composed of experts on IT, data protection and privacy laws, to deal with requests that involve Personal Data transferred from the EEA; the notification to the senior legal and corporate management and to Controller upon receipt of such requests; the procedural steps to challenge disproportionate or unlawful requests and the provision of transparent information to Data Subjects.‍
      • Development of specific training procedures for personnel in charge of managing requests for access to Personal Data from public authorities, which should be periodically updated to reflect new legislative and jurisprudential developments in the third country and in the EEA.‍
        • The training procedures should include the requirements of EU law as to access by public authorities to Personal Data, in particular as following from Article 52(1) of the Charter of Fundamental Rights. Awareness of personnel should be raised in particular by means of assessment of practical examples of public authorities' data access requests and by applying the standard following from Article 52(1) of the Charter of Fundamental Rights to such practical examples. Such training should take into account the particular situation of the Processor, e.g. legislation and regulations of the third country to which Processor is subject to, and should be developed where possible in cooperation with Controller.‍
   2. Transparency and accountability measures‍
      • Regular publication of transparency reports or summaries regarding governmental requests for access to data and the kind of reply provided, insofar publication is allowed by local law.‍
   3. Organizational methods and data minimization measures‍
      • Already existing organizational requirements under the accountability principle, such as the adoption of strict and granular data access and confidentiality policies and best practices, based on a strict need-to-know principle, monitored with regular audits and enforced through disciplinary measures. Data minimization should be considered in this regard, in order to limit the exposure of Personal Data to unauthorized access. For example, in some cases it might not be necessary to transfer certain data (e.g. in case of remote access to EEA data, such as in support cases, when restricted access is granted instead of full access; or when the provision of a service only requires the transfer of a limited set of data, and not an entire database). In the case at hand, the Parties will implement this as follows:
      • Development and implementation of best practices by both Parties to appropriately and timely involve and provide access of information to their respective data protection officers, if existent, and to their legal and internal auditing services on matters related to international transfers of Personal Data transfers.‍
   4. Others‍
      • Adoption and regular review by Processor of internal policies to assess the suitability of the implemented complementary measures and identify and implement additional or alternative solutions when necessary, to ensure that an essentially equivalent level of protection to that guaranteed within the EEA of the Personal Data transferred is maintained.‍
4. ‍Additional Contractual Measures
   1. Transparency obligations‍
      • Processer outlines the measures which it has taken to prevent the access from and/or disclosure to a public authority in its jurisdiction as to the transferred data:
      • Processer declares that (1) it has not purposefully created back doors or similar programming that could be used to access the system and/or Personal Data, (2) it has not purposefully created or changed its business processes in a manner that facilitates access to Personal Data or systems, and (3) that national law or government policy does not require Processor to create or maintain back doors or to facilitate access to Personal Data or systems or for Processor to be in possession or to hand over the encryption key.
      • Processor will verify the validity of the information provided for the TIA questionnaire on a regular basis and provide notice to Controller in case of any changes without delay. Clause 14(e) SCC will remain unaffected.‍
   2. Obligations to take specific actions‍
      • In case of any order to disclose or to grant access to the Personal Data, Processor commits to inform the requesting public authority of the incompatibility of the order with the safeguards contained in the Article 46 GDPR transfer tool and the resulting conflict of obligations for Processor.
   3. ‍Empowering Data Subjects to exercise their rights‍
      • The Parties commit to reasonably assist the Data Subject in exercising his/her rights in the third country jurisdiction through ad hoc redress mechanisms and legal counselling.
      • The Parties commit to reasonably assist the Data Subject to seek information and an effective redress in the EU (e.g., by lodging a claim with a competent supervisory authority and/or judicial authority in the EU).
      • Processor commits to fairly compensate the Data Subject for any material and non-material damage suffered because of the disclosure of his/her Personal Data transferred under the chosen transfer tool in violation of the commitments it contains.

Schedule 1

SUBPROCESSORS