Nutanix Customer Data Processing Addendum

This is an archived version of our Nutanix Customer Data Processing Addendum dated October 23, 2020. View the current version.

This Data Processing Addendum, including its appendices ("DPA") is incorporated into and is subject to, the terms and conditions of the Nutanix License and Services Agreement ("Agreement") between the Nutanix contracting entity identified in the Agreement (“Nutanix”) and the party identified as the customer in the Agreement ("Customer") pursuant to which Nutanix provides certain products and/or services to Customer, as more particularly described in the Agreement ("Products").

All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement. This DPA is supplemental to the Agreement and sets out the roles and obligations that apply when Nutanix processes personal data on behalf of Customer when providing the Products protected by Applicable Privacy Law under the Agreement.

By entering into the Agreement, Customer enters into this DPA, and the Model Clauses (as applicable and as defined below) on behalf of itself and, to the extent required under Applicable Privacy Law, in the name and on behalf of its Affiliates (if any) permitted to use the Products. For the purposes of this DPA only, and except where indicated otherwise, the term "Customer" shall include Customer and such Affiliates.

The parties agree as follows:

Definitions

1.1.   "Applicable Privacy Law" means European Data Protection Law and the CCPA.

1.2.   "CCPA" means Title 1.81.5 California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100–1798.199), as amended, superseded or replaced.

1.3.   ""Customer Data" means any data that is protected as "personal data" or "personal information" under Applicable Privacy Law and processed by Nutanix on behalf of Customer as a service provider or processor (as applicable) in connection with the Products, as more particularly described in Annex A of this DPA.

1.4.   "Europe" means, for the purposes of this DPA, the member states of the European Economic Area ("EEA"), Switzerland and the United Kingdom.  

1.5.   "European Data Protection Law" means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC; (iii) any applicable national implementations of (i) and (ii); (iv) Swiss Federal Data Protection Act of 19 June 1992 and its Ordinance; and (v) in respect of the United Kingdom, means the Data Protection Act 2018 and any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; in each case, as may be amended, superseded or replaced.

1.6.   "Model Clauses" means the standard contractual clauses for processors as approved by the European Commission pursuant to its decision C(2010)593 of 5 February 2010 and sometimes referred to as "Standard Contractual Clauses", in the form set out in Annex C of this DPA; as amended, superseded or replaced from time to time in accordance with this DPA.

1.7.   "Privacy Shield" means the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield self-certification programs operated by the U.S. Department of Commerce and approved by the European Commission pursuant to Decision C(2016)4176 of 12 July 2016 and by the Swiss Federal Council on 11 January 2017 respectively (as amended, superseded or replaced from time to time).

1.8.   "Privacy Shield Principles" means the Privacy Shield Framework Principles (as supplemented by the Supplemental Principles) contained in Annex II to the European Commission Decision of 12 July 2016 (as amended, superseded or replaced from time to time).

1.9.   "Security Incident" means any confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data transmitted, stored or otherwise processed by Nutanix in connection with the provision of the Products. "Security Incident" shall not include unsuccessful attempts or activities that do not compromise the security of personal data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks and other network attacks on firewalls or networked systems.

1.10.  "Sub-processor" means any processor engaged by Nutanix or its Affiliates to assist in fulfilling its obligations with respect to providing the Products pursuant to the Agreement or this DPA. Sub-processors may include third parties or Nutanix Affiliates but shall exclude any Nutanix employee, contractor or consultant. 

1.11.  The terms "personal data", "controller", "processor" and "processing" shall have the meaning given to them in European Data Protection Law and "process", "processes" and "processed" shall be interpreted accordingly. The terms "consumer", "business", "business purpose", "sell", "service provider" and "personal information" shall have the meaning given to them in the CCPA.

Scope and Relationship of the Parties

2.1.   Scope. This DPA applies to the extent Nutanix processes, as a processor or service provider (as applicable), any Customer Data protected by Applicable Privacy Law.

2.2.  Role of the Parties. The parties acknowledge and agree that Customer is a business or a controller (as applicable) with respect to the processing of Customer Data, and Nutanix shall process Customer Data only as a processor or service provider (as applicable) on behalf of Customer, as further described in Annex A of this DPA. Any processing by either party of Customer Data under or in connection with the Agreement shall be performed in accordance with Applicable Privacy Law.

2.3.  Nutanix Processing of Personal Data. As a processor, Nutanix shall process Customer Data only for the purposes described in this DPA and only in accordance with Customer's documented lawful instructions. The parties agree that the Agreement sets out the Customer's complete and final instructions to Nutanix in relation to the processing of Customer Data, and processing outside the scope of these instructions (if any) shall require prior written agreement between Customer and Nutanix. Without prejudice to Section 2.4 (Customer Responsibilities), Nutanix shall notify Customer in writing, unless prohibited from doing so under Applicable Privacy Law, if it becomes aware or believes that any data processing instruction from Customer violates Applicable Privacy Law.

2.4.  Customer Responsibilities. Customer is responsible for the lawfulness of Customer Data processing under or in connection with the Agreement. Customer represents and warrants that (i) it has provided, and will continue to provide, all notice and obtained, and will continue to obtain, all consents, permissions and rights necessary under Applicable Privacy Law for Nutanix to lawfully process Customer Data for the purposes contemplated by the Agreement; (ii) it has complied with Applicable Privacy Law as a controller and/or business of Customer Data for the collection and provision to Nutanix and its Sub-processors of such Customer Data; and (iii) it shall ensure its processing instructions comply with applicable laws (including Applicable Privacy Law) and that the processing of Customer Data by Nutanix in accordance with Customer's instructions will not cause Nutanix to be in breach of Applicable Privacy Law.

2.5.  Aggregate Data. Notwithstanding the foregoing or anything to the contrary in the Agreement, Customer acknowledges that Nutanix and its Affiliates shall have a right to collect and create anonymized, aggregate and/or de-identified information (as defined by Applicable Privacy Law) for its own legitimate business purposes.

Sub-processing

3.1.   Authorized Sub-processors. . Customer acknowledges and agrees that Nutanix may engage Sub-processors to process Customer Data on Customer's behalf. The Sub-processors engaged by Nutanix depend on the Products purchased by Customer. Nutanix shall notify Customer if it changes its Sub-processors at least ten (10) days before any such changes by sending an email to the email address designated by Customer to receive notifications.

Security and Audits

4.1.   Security Measures. Nutanix shall implement and maintain appropriate technical and organizational security measures designed to protect Customer Data from Security Incidents and to preserve the security and confidentiality of Customer Data. Such measures will include, at minimum, those measures described in Schedule 3 of this DPA ("Security Measures"). Nutanix shall ensure that any person who is authorized by Nutanix to process Customer Data shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

4.2.   Updates to Security Measures. Customer acknowledges that the Security Measures are subject to technical progress and development and that Nutanix may update and/or modify the Security Measures from time to time, provided that such updates and/or modifications do not result in the degradation of the overall security of the Products purchased by the Customer.

4.3.   Customer Security Responsibilities. Notwithstanding the above, Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Products, including securing its account authentication credentials, protecting the security of Customer Data when in transit to and from the Products and taking any appropriate steps to securely encrypt or backup any Customer Data processed in connection with the Products. Customer shall implement and maintain appropriate technical and organizational security measures designed to protect personal data from Security Incidents and to preserve the security and confidentiality of personal data while in its dominion and control.

4.4.   Security Incident Response. Upon becoming aware of a Security Incident, Nutanix shall notify Customer without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Customer.

4.5.   Security Audits. On written request from Customer, Nutanix shall provide written responses (which may include, audit report summaries/extracts) to all reasonable requests for information made by Customer related to its processing of Customer Data  necessary to confirm Nutanix's compliance with this DPA, provided that Customer shall not exercise this right more than once in any 12 month rolling period. Notwithstanding the foregoing, Customer may also exercise such audit right in the event Customer is expressly requested or required to provide this information to a data protection authority, or Nutanix has experienced a Security Incident, or on another reasonably similar basis. Nothing herein shall be construed to require Nutanix to provide: (i) trade secrets or any proprietary information; (ii) any information that would violate Nutanix’s confidentiality obligations, contractual obligations, or applicable law; or (iii) any information, the disclosure of which could threaten, compromise, or otherwise put at risk the security, confidentiality, or integrity of Nutanix’s infrastructure, networks, systems, or data.

 International Transfers

5.1.   Processing Locations. Customer acknowledges and agrees that Nutanix may transfer and process Customer Data to and in the United States and anywhere else in the world where Nutanix, its Affiliates or its Sub-processors maintain data processing operations. Nutanix shall at all times ensure such transfers are made in compliance with the requirements of Applicable Privacy Law and this DPA.

Deletion of Customer Data

6.1.   Deletion. Upon termination or expiry of the Agreement, on Customer's request Nutanix shall delete all Customer Data (including copies) in its possession or control in accordance with the Agreement, save that this requirement shall not apply to the extent Nutanix is required by applicable law to retain some or all of the Customer Data, or to Customer Data it has archived on back-up systems, which data Nutanix shall securely isolate and protect from any further processing and delete in accordance with its deletion practices, except to the extent required by applicable law. 

 Rights of Individuals and Cooperation

7.1.   Data Subject Requests. To the extent Customer is unable to independently access the relevant Customer Data within the Products, Nutanix shall, at Customer's expense and taking into account the nature of the processing, provide reasonable cooperation to assist Customer to respond to any requests from individuals or applicable data protection authorities relating to the processing of Customer Data under the Agreement. In the event that any such request is made to Nutanix directly, Nutanix shall not respond to such communication directly without Customer's prior authorization, unless legally compelled to do so. If Nutanix is required to respond to such a request, Nutanix shall promptly notify Customer and provide it with a copy of the request unless legally prohibited from doing so.

 Jurisdiction Specific Terms

8.1.   Europe. To the extent Customer Data is subject to European Data Protection Law, the following terms shall apply in addition to the terms in the remainder of this DPA:

A. Sub-processor Obligations. Nutanix shall: (i) enter into a written agreement with each Sub-processor imposing data protection terms that require Sub-processor to protect Customer Data to the standard required by applicable European Data Protection Law and this DPA; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Nutanix to breach any of its obligations under this DPA.

B.  Objections to Sub-processors. Customer may object in writing to Nutanix’s appointment of a new Sub-processor on reasonable grounds relating to data protection (e.g., if making Customer Data available to the Sub-processor may violate European Data Protection Law or weaken the protections for such Customer Data) by notifying Nutanix promptly in writing within five (5) calendar days of receipt of Nutanix’s notice in accordance with Section 3.1 above. Such notice shall explain the reasonable grounds for the objection and the parties shall discuss such concerns in good faith with a view to achieving commercially reasonable resolution. If no such resolution can be reached, Nutanix will, at its sole discretion, either not appoint the Sub-processor, or permit Customer to suspend or terminate the affected Product in accordance with the termination provisions in the Agreement without liability to either party (but without prejudice to any fees incurred by Customer before suspension or termination).

C.     Transfers of European Data: To the extent Nutanix is a recipient of and processes Customer Data protected by European Data Protection Law ("European Data") in a country that does not ensure an adequate level of protection (within the meaning of applicable European Data Protection Law), the parties agree to the following:

i. Although Nutanix does not rely on the Privacy Shield as a legal basis for transfers of European Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for so long as Nutanix is self-certified to the Privacy Shield it shall continue to process European Data in compliance with the Privacy Shield Principles and agrees to notify Customer if it makes a determination that it can no longer meet its obligation to provide the level of protection as is required by the Privacy Shield Principles.

ii.  Nutanix agrees to abide by and process European Data in accordance with the Model Clauses, which are incorporated into and form a part of this DPA. The parties agree that (i) purely for the purposes of the descriptions in the Model Clauses, Nutanix is the "data importer" and Customer is "data exporter" (notwithstanding that Customer may itself be located outside Europe and/or is acting as a processor on behalf of third party controllers); and (ii) neither party intends to contradict or restrict any of the provisions set forth in the Model Clauses and, accordingly, if and to the extent the Model Clauses conflict with any provision of the Agreement the Model Clauses shall prevail.

D.  Alternative Transfer Arrangement. If, and to the extent Nutanix adopts an alternative data export solution (including adopting Binding Corporate Rules or any new version of or successor to the Model Clauses or Privacy Shield adopted pursuant to applicable European Data Protection Law) for the transfer of Customer Data as prescribed by applicable European Data Protection Laws ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with applicable European Data Protection Law and extends to the territories to which European Data is transferred) and Customer agrees to execute such other and further documents and take such other and further actions as may be reasonably necessary to give legal effect such Alternative Transfer Mechanism. In addition, if and to the extent that a court of competent jurisdiction or a supervisory authority with binding authority orders (for whatever reason) that the measures described in this DPA cannot be relied on to lawfully transfer European Data to a country that does not ensure an adequate level of protection (within the meaning of applicable European Data Protection Law), the parties shall reasonably cooperate to agree and take any actions that may be reasonably required to implement any additional measures or safeguards not described in this DPA or alternative transfer mechanisms ("Alternative Transfer Arrangements") to enable the lawful transfer of such European Data.

E.  Transfers to the United Kingdom. For the avoidance of doubt, when European Union law ceases to apply to the United Kingdom upon the United Kingdom's withdrawal from the European Union, and until such time as the United Kingdom is deemed to provide adequate level of protection for personal data, then to the extent Nutanix processes (or causes to be processed) any Customer Data protected by European Data Protection Law applicable to the EEA and Switzerland in the United Kingdom, Nutanix shall process such Customer Data in compliance with the Model Clauses or any applicable Alternative Transfer Mechanism or Alternative Transfer Arrangements (as applicable) implemented in accordance with Sections 8.1 (c) and 8.1 (d) above.

F.  Data Protection Impact Assessment. To the extent Nutanix is required under applicable European Data Protection Law, Nutanix shall provide reasonably requested information regarding Nutanix processing of Customer Data under the Agreement to enable the Customer to carry out data protection impact assessments or prior consultations with supervisory authorities as required by law.

8.2.   California.  To the extent the Customer Data is subject to the CCPA, the parties agrees that Customer is a business and that it appoints Nutanix as its service provider to process Customer Data as permitted under the Agreement and the CCPA, or for purposes otherwise agreed in writing ("Permitted Purposes"). Customer and Nutanix agree that: (i) Nutanix shall not retain, use or disclose personal information for any purpose other than the Permitted Purposes; (ii) Customer Data was not sold to Nutanix and Nutanix shall not sell personal information; (iii) Nutanix shall not retain, use or disclose personal information outside of the direct business relationship between Customer and Nutanix; and (iv) Nutanix may de-identify or aggregate personal information in the course of providing the Products. Nutanix certifies that it understands the restrictions set out in this Section 8.2 and will comply with them.

Miscellaneous

9.1.   Disclosures. Customer acknowledges that Nutanix may disclose this DPA (including the Model Clauses) and any relevant privacy provisions in the Agreement to the U.S. Department of Commerce, the Federal Trade Commission, a European data protection authority or any other U.S. or European judicial or regulatory body upon their request.

9.2.  Necessary Modifications. Notwithstanding anything to the contrary in the Agreement, Nutanix may modify the terms of this DPA where necessary to (i) comply with a request or order by a supervisory authority or other government or regulatory entity; (ii) comply with Applicable Privacy Law; or (iii) implement or adhere to standard contractual clauses, approved codes of conduct or certifications, binding corporate rules, or other compliance mechanisms, which may be permitted under Applicable Privacy Law. Supplemental terms may be added as an Annex to this DPA where such terms only apply to the processing of Customer Data under the Applicable Privacy Law of specific countries or jurisdictions. Nutanix shall provide notice of such changes to Customer, and the modified DPA shall become effective in accordance with the terms of the Agreement or, if not specified in the Agreement, as otherwise provided on Nutanix's website.

9.3.  Conflicts. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.

9.4.  Severability. If any provision or part-provision of this DPA is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of the DPA.

9.6.  Governing Law. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by European Data Protection Law. 

 

Annex A

Data Processing Description

This Annex A forms part of the Agreement and describes the processing that the processor will perform on behalf of the controller.

Duration

The duration of the data processing under this DPA is until the termination of the Agreement in accordance with its terms plus the period from the expiry of the Agreement until deletion of personal data by Nutanix in accordance with the terms of the Agreement.

Categories of data

The personal data to be processed concern the following categories of data (please specify):

  • Customer Data uploaded to the Products.

Special categories of data (if appropriate)

The special categories of data to be processed are the following:

  • The special categories of data contained in the Customer Data uploaded to the Products, where applicable.

Data subjects

The personal data to be processed concern the following categories of data subjects (please specify):

  • The data subjects will depend on the Customer Data uploaded to the Products and may include Customer's customers, employees, suppliers and end-users.

Processing operations

The personal data will be subject to the following basic processing activities (please specify):

  • processing to provide the Products in accordance with the Agreement
  • processing to perform any steps necessary for the performance of the Agreement
  • processing initiated by Customer in its use of the Products
  • processing to comply with other reasonable instructions provided by Customer (e.g., via email or support tickets) that are consistent with the terms of the Agreement.

Annex B

Security Measures

Nutanix implements the following technical and organizational security measures to protect personal data and relevant operational processes.

Introduction

1.1.  Nutanix may obtain Customer data in many ways, including, through a support ticket, services engagements, order fulfilment processing or cluster performance monitoring services or the use of a Nutanix SaaS offering. All files submitted by our customers, regardless of how acquired, is categorized as either Confidential or Highly Confidential.

1.2.   Nutanix follows the ISO 27001, Information Security Management Systems, and relevant National Institute of Standards and Technology (NIST) Standards to design, implement, monitor, and refine security and data handling controls. The following Sections detail our major security and data handling practices.

Protecting Customer Data

2.1.  Privacy Polices and Certifications. Nutanix implements processes designed to help the company comply with applicable data privacy and security laws, including breach notification laws, state and federal privacy-related legislation, and national laws. Nutanix maintains several internal Privacy policies, and, international security certifications can be viewed on Nutanix’s trust website at: www.nutanix.com/trust.  

2.2.  Physical Security. Nutanix maintains and administers the following physical access controls:

  1. Employees and contractors are subject to background checks prior to being offered employment or given access to Nutanix facilities and systems.
  2. All facilities require access control for employees and contractors and intrusion detection alarms at ingress and egress points.
  3. All data centers where customer data is processed or stored are further protected by 24x7x365 security guards and monitoring cameras (e.g., CCTVs).

2.3.    Access Management. Access management procedures define the request, approval, access provisioning and de-provisioning processes. The logical access procedures restrict user access (local or remote) based on user job function for applications and databases (role/profile based appropriate access) for applications, databases and systems to ensure segregation of duties and are reviewed, administered, and documented based on onboarding, resource re-assignment or separation. User access reviews are performed to ensure access is appropriate throughout the year.

2.4   Authorized Usernames, Passwords and Authentication. Nutanix monitors access rights to ensure access adheres to the least privilege principle commensurate with a user’s job responsibilities, logs all access and security events, and uses software that enables rapid analysis of user activities. Nutanix passwords are administered in the following manner

  1. Passwords are not shared
  2. Enterprise password management software is used to store passwords and secrets
  3. Initial password change is required
  4. Passwords must have minimum length and complexity and must be changed on a regular interval without reuse of recent previous passwords
  5. Nutanix passwords are encrypted and controlled via secure management and authentication practices including secure reset procedures.

2.5.  Remote Access Administration. The following remote access settings are applicable:

2.6. Third Party Remote Access. Dependent third-party service provider (i.e., subcontractor) remote access adheres to the same or similar controls, and any subcontractor remote access has valid business justification.

2.7.  Network Controls. Nutanix utilizes firewalls for access control between Nutanix’s networks and the Internet. Firewall access is restricted to a small set of administrators with appropriate authority. Firewalls are established with minimum rights necessary to accomplish tasks by role and access is authorized on a “deny by default” policy. Regular network vulnerability assessments are performed, and any critical vulnerabilities identified are promptly remediated. In addition, penetration tests are also performed by security professionals, both Nutanix employees and third parties.

2.8  Network Security Policy. Defined Access Control Lists (ACLs) to restrict traffic on routers and/or firewalls are reviewed and approved by network administrators. IP addresses in the ACLs are specific and anonymous connections are prohibited.

2.9  Secure Data Transfer. Customer data is encrypted while in transit over any public network or wireless network via Transport Layer Security (TLS), Internet Protocol Security (IPSEC), and Secure File Transfer Protocol (SFTP). Nutanix utilizes an information protection and control solution that is designed and administered to minimize the accidental, negligent and malicious misuse of data through email and other communications aimed outside of Nutanix’s firewalls.

2.10  Secure Development Lifecycle Management Program. Nutanix maintains Secure Software Development Lifecycle policies, principles, and procedures to ensure security is built-in to our products and software. Secure development procedures require product classification based on risk rankings determined by use cases, application of static code analysis tools, and penetration testing.

2.11  Removable Media. Removable media is not in use for the delivery of Nutanix products and SaaS offerings.

2.12  Security Orchestration and Automation. Nutanix’s develops and maintains incident response playbooks to automate the identification and response to information security threats and incidents while containing and restoring normal service operations as quickly and effectively as possible.

2.13  Incident Response Plan. Nutanix maintains a detailed incident response plan and Crisis Notification procedure designed to identify, categorize, remove, and remediate security incidents. Incident Response is reviewed at least quarterly and tested at least annually.

 

Annex C

STANDARD CONTRACTUAL CLAUSES (PROCESSORS)

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, Customer (as data exporter) and Nutanix (as data importer), each a “party” and together “the parties”, have agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Clause 1

Definitions

For the purposes of the Clauses:

  1. 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ;
  2. 'the data exporter' means the controller who transfers the personal data;
  3. 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
  4. 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
  5. 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
  6. 'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2

Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3

Third-party beneficiary clause

  1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
  2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
  3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
  4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4

Obligations of the data exporter

The data exporter agrees and warrants:

  1. that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
  2. that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
  3. 'that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
  4. that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
  5. 'that it will ensure compliance with the security measures;.
  6. that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
  7. to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
  8. o make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
  9. that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
  10. that it will ensure compliance with Clause 4(a) to (i).

Clause 5

Obligations of the data importer 2

The data importer agrees and warrants:

  1. to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  2. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  3. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  4. that it will promptly notify the data exporter about:
    1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
    2. any accidental or unauthorised access, and
    3. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
  5. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
  6. at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
  7. to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
  8. that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
  9. that the processing services by the subprocessor will be carried out in accordance with Clause 11;
  10. to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6

Liability

  1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
  2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.c
    The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
  3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7

Mediation and jurisdiction

  1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
    1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
    2. to refer the dispute to the courts in the Member State in which the data exporter is established.
  2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8

Cooperation with supervisory authorities

  1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
  2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
  3. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9

Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10

Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11

Subprocessing

  1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses . Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.
  2. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses
  3. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
  4. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

Clause 12

Obligation after the termination of personal data processing services

  1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
  2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES

See Annex A of the DPA – Data Processing Description

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses.
Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):
See Annex B of the DPA – Security Measures

APPENDIX 3 TO THE STANDARD CONTRACTUAL CLAUSES

The Parties acknowledge that Clause 10 of the Clauses permits them to include additional business-related terms provided they do not contradict with the Clauses. Accordingly, this Appendix sets out the Parties' interpretation of their respective obligations under specific Clauses identified below.

For the purposes of this Appendix, "DPA" means the Data Processing Addendum in place between data importer and data exporter and to which these Clauses are incorporated and "Agreement" shall have the meaning given to it in the DPA.

Clauses 4(h) and 8: Disclosure of these Clauses

  1. Data exporter agrees that these Clauses constitute data importer's Confidential Information (as that term is defined in the Agreement) and may not be disclosed by data exporter to any third party without data importer's prior written consent unless permitted pursuant to Agreement. This shall not prevent disclosure of these Clauses to a data subject pursuant to Clause 4(h) or a supervisory authority pursuant to Clause 8.

Clauses 5(a) and (b): Suspension of data transfers and termination

  1. The parties acknowledge that for the purposes of Clause 5(a), data importer may process the personal data only on behalf of the data exporter and in compliance with its documented instructions as set out in the DPA and that pursuant to the DPA, these instructions shall the data exporters complete and final instructions
  2. The parties acknowledge that if data importer cannot provide compliance in accordance with Clause 5(a) and/or Clause 5(b), the data importer agrees to promptly inform the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the affected parts of the Services in accordance with the terms of the Agreement.
  3. If the data exporter intends to suspend the transfer of personal data and/or terminate the affected parts of the Services, it shall first provide notice to the data importer and provide data importer with a reasonable period of time to cure the non-compliance (“Cure Period”).
  4. In addition, the data exporter and data importer shall reasonably cooperate with each other during the Cure Period to agree what additional safeguards or other measures, if any, may be reasonably required to ensure the data importer's compliance with the Clauses and applicable data protection law.
  5. If, after the Cure Period, the data importer has not or cannot cure the non-compliance in accordance with paragraphs 4 and 5 above, then the data exporter may suspend and/or terminate the affected part of the Services in accordance with the provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by the data exporter prior to suspension or termination).

Clause 5(f): Audit

  1. Data exporter acknowledges and agrees that it exercises its audit right under Clause 5(f) by instructing data importer to comply with the audit measures described in Section 4.5 of the DPA.

Clause 5(j): Disclosure of Sub-processor agreements

  1. The parties acknowledge the obligation of the data importer to send promptly a copy of any onward Sub-processor agreement it concludes under the Clauses to the data exporter.
  2. The parties further acknowledge that, pursuant to Sub-processor confidentiality restrictions, data importer may be restricted from disclosing onward Sub-processor agreements to data exporter. Notwithstanding this, data importer shall use reasonable efforts to require any Sub-processor it appoints to permit it to disclose the Sub-processor agreement to data exporter.
  3. Even where data importer cannot disclose a Sub-processor agreement to data exporter, the parties agree that, upon the request of data exporter, data importer shall (on a confidential basis) provide all information it reasonably in connection with such sub-processing agreement to data exporter.

Clause 6: Liability

  1. Any claims brought under the Clauses shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement. In no event shall any party limit its liability with respect to any data subject rights under these Clauses.

Clause 11: Onward Sub-processing

  1. The parties acknowledge that, pursuant to FAQ II.1 in Article 29 Working Party Paper WP 176 entitled "FAQs in order to address some issues raised by the entry into force of the EU Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC" the data exporter may provide a general consent to onward sub-processing by the data importer.
  2. Accordingly, data exporter provides a general consent to data importer, pursuant to Clause 11 of these Clauses, to engage onward Sub-processors. Such consent is conditional on data importer’s compliance with Sections 3.1 and 8.1 (a) and (b) of the DPA.