Data Processing Addendum

Customer (“Controller”) has entered into an agreement with Arrows Software, Inc. (“Processor”) (each a “Party” and collectively the “Parties”) under which Processor has agreed to provide the Services in accordance with such agreement (the “Agreement”). This Data Processing Addendum (the “DPA”) is incorporated into and forms part of the Agreement and shall be effective on the effective date of the Agreement.

To the extent that Processor processes any Covered Data (as defined below) on behalf of the Customer in connection with the provision of the Services, the Parties have agreed that it shall do so on the terms of this DPA.

1. DEFINITIONS

1.1. Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalized terms used in this DPA will be defined as follows:

"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time.

"Covered Data" means Personal Data that is: (a) provided by or on behalf of Controller to Processor in connection with the Services; or (b) obtained, developed, produced or otherwise Processed by Processor, or its agents or subcontractors, for purposes of providing the Services, in each case as further described in Schedule 1.

"Data Subject" means a natural person whose Personal Data is Processed.

"EEA" means the European Economic Area including the European Union ("EU").

"GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR" as defined in section 3 of the UK Data Protection Act 2018 or, where applicable, the equivalent provision under Swiss data protection law.

"Member State" means a member state of the EEA, being a member state of the European Union, Iceland, Norway, or Liechtenstein.

"Personal Data" means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data," "personal information," "personally identifiable information," or similarly defined data or information under Applicable Data Protection Laws.

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. "Process", "Processes" and "Processed" will be interpreted accordingly.

"Security Incident" means an actual breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Covered Data.

"Services" means the services to be provided by Processor pursuant to the Agreement.

"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

"Sub-processor" means an entity appointed by Processor to Process Covered Data on its behalf.

"Swiss Data Protection Laws" means the Swiss Federal Act Data Protection of 19 June 1992 and the Swiss Ordinance to the Swiss Federal Act on Data Protection of 14 June 1993, and any new or revised version of these laws that may enter into force for time to time.

"UK" means the United Kingdom.

"US Data Protection Laws" means, to the extent applicable, federal and state laws relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States.

2. INTERACTION WITH THE AGREEMENT

2.1. This DPA is incorporated into and forms an integral part of the Agreement. This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any Processing of Covered Data.

3. ROLE OF THE PARTIES

The Parties acknowledge and agree that:

1. for the purposes of the GDPR, Processor acts as "processor" or “sub-processor” (as each term defined in the GDPR) in the performance of its obligations under the Agreement and this DPA. Processor’s function as processor or sub-processor will be determined by the function of the Controller:
   (i) Where Controller acts as a “controller” (as defined in the GDPR), Processor acts as a processor;
   (ii) Where Controller acts as a processor on behalf of another controller, Processor acts as a sub-processor.
2. for the purposes of the US Data Protection Laws, Processor will act as a "service provider" or "processor" (each as defined in US Data Protection Laws), as applicable, in its performance of its obligations under the Agreement and this DPA.

4. DETAILS OF DATA PROCESSING

4.1. The details of the Processing of Personal Data under the Agreement and this DPA (such as subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.

4.2. Processor will only Process Covered Data on behalf of and under the instructions of Controller and in accordance with Applicable Data Protection Laws. The Agreement and this DPA shall constitute Controller’s instructions for the Processing of Covered Data. Controller may issue further written instructions in accordance with this DPA. Without limiting the foregoing, Processor is prohibited from:

1. selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
2. sharing Covered Data with any third party for cross-context behavioral advertising;
3. retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Applicable Data Protection Laws;
4. retaining, using, or disclosing Covered Data outside of the direct business relationship between the Parties; and
5. except as otherwise permitted by Applicable Data Protection Laws, combining Covered Data with Personal Data that Processor receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.

4.3. Upon Controller’s reasonable request, Processor will provide Controller with information reasonably necessary to demonstrate Processor’s compliance with its obligations as set forth in this DPA and to enable Controller to conduct and document any data protection assessments required under Applicable Data Protection Laws. In addition, Processor will notify Controller promptly if Processor determines that it can no longer meet its obligations under Applicable Data Protection Laws.

4.4. Processor will promptly inform Controller if, in its opinion, an instruction from Controller or Controller’s controller infringes Applicable Data Protection Laws.

5. CONFIDENTIALITY AND DISCLOSURE

5.1. Processor shall:

1. limit access to Covered Data to personnel who have a business need to have access to such Covered Data; and
2. will ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement, including duties of confidentiality with respect to any Covered Data to which they have access.

6. SUB-PROCESSORS

6.1. Processor may Process Covered Data anywhere that Processor or its Sub-processors maintain facilities, subject to the remainder of this clause 6.

6.2. Controller grants Processor the general authorization to engage Sub-processors, subject to clause 6.3, as well as Processor's current Sub-processors listed in Schedule 5 as of the Effective Date.

6.3. Processor will enter into a written agreement with each Sub-processor imposing data protection obligations that are no less protective of Covered Data than Processor's obligations under this DPA.

6.4. Processor will provide Controller with at least ten (10) days' notice of any proposed changes to the Sub-processors it uses to Process Covered Data. Processor will provide such notice by publishing changes to its Trust Center. Controller may subscribe to receive email notifications of these changes by opting in on it's Trust Center. Controller may object to Processor's use of a new Sub-processor (including, where applicable, when exercising its right to object under clause 9(a) of the SCCs) by providing Processor with written notice of the objection within ten (10) days after Processor has provided notice to Controller of such proposed change (an "Objection"). If Controller does not object to the engagement within the Objection period, consent regarding the engagement will be assumed. In the event Controller objects to Processor's use of a new Sub-processor, Controller and Processor will work together in good faith to find a mutually acceptable resolution to address such Objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, either Party may, as its sole and exclusive remedy, terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to the other Party. During any such Objection period, Processor may suspend the affected portion of the Services.

7. DATA SUBJECT RIGHTS REQUESTS

7.1. As between the Parties, Controller will have sole discretion and responsibility in responding to the rights asserted by any individual in relation to Covered Data under Applicable Data Protection Laws (each, a "Data Subject Request").

7.2. Processor will promptly forward to Controller without undue delay any Data Subject Request received by Processor or any Sub-processor and may advise the individual to submit their request directly to Controller.

7.3. Processor will provide Controller with reasonable assistance as necessary for Controller to fulfill its obligation under Applicable Data Protection Laws to respond to Data Subject Requests.

8. SECURITY

8.1. Processor will implement and maintain appropriate technical and organizational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage of or to it. When assessing the appropriate level of security, account will be taken in particular of the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Covered Data.

8.2. Processor will implement and maintain as a minimum standard the measures set out in Schedule 2.

9. INFORMATION AND AUDITS

9.1. Controller will have the right to audit Processor's compliance with this DPA. The Parties agree that all such audits will be conducted:

1. upon reasonable written notice to Processor;
2. only once per year; and
3. only during Processor's normal business hours.

9.2. To conduct such audits, Controller may engage a third-party auditor subject to such auditor complying with the requirements under clause 9.1 and provided that such auditor is suitably qualified and independent.

9.3. To request an audit, Controller must submit a detailed proposed audit plan to Processor at least two weeks in advance of the proposed audit date. Processor will review the proposed audit plan and work cooperatively with Controller to agree on a final audit plan. All such audits must be conducted subject to the agreed final audit plan and Processor's health and safety or other relevant policies.

9.4. Controller will promptly notify Processor of any non-compliance discovered during an audit.

9.5. Controller will bear the costs for any audit initiated by Controller, unless the audit reveals material non-compliance with the requirements of this DPA.

9.6. Upon request, Processor will provide to Controller documentation reasonably evidencing the implementation of the technical and organizational data security measures in accordance with industry standards. Processor may, in its discretion, provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company. If the requested audit scope is addressed in such a certification produced by a qualified third-party auditor within twelve (12) months of Controller's audit request and Processor confirms there are no known material changes in the controls audited, Controller agrees to accept those findings in lieu of requesting an audit of the controls covered by the report.

9.7. Processor will audit its Sub-processors on a regular basis and will, upon Controller's request, confirm their compliance with Applicable Data Protection Laws and the Sub-processors' contractual obligations.

9.8. Controller may take reasonable and appropriate steps to: (a) ensure that Processor uses Covered Data in a manner consistent with Controller’s obligations under Applicable Data Protection Laws; and (b) upon reasonable notice, stop and remediate the unauthorized use of Covered Data.

10. SECURITY INCIDENTS

Processor will notify Controller without undue delay after becoming aware of any Security Incident, and reasonably cooperate in any obligation of Controller under Applicable Data Protection Laws to make any notifications, such as to Data Subjects or supervisory authorities. Processor will take reasonable steps to contain, investigate, and mitigate any Security Incident, and will send Controller timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Processor's notification of or response to a Security Incident under this clause 10 will not be construed as an acknowledgement by Processor of any fault or liability with respect to the Security Incident.

Processor will provide reasonable assistance with Controller's investigation of the possible Security Incident and any required notification obligation of Controller under Applicable Data Protection Laws, such as in relation to individuals or supervisory authorities.

11. DELETION AND RETURN

Processor will, within thirty (30) days of the date of termination or expiry of the Agreement (a) if requested to do so by Controller within that period, return a copy of all Covered Data via a commercially reasonable format as determined by Processor or provide a self-service functionality allowing Controller to do the same; and (b) delete all other copies of Covered Data Processed by Processor.

12. CONTRACT PERIOD

This DPA will commence on the Effective Date and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Processor's deletion of all Covered Data as described in this DPA.

13. STANDARD CONTRACTUAL CLAUSES

13.1. The Standard Contractual Clauses shall, as further set out in Schedule 3, apply to the transfer of any Covered Data from Controller to Processor, and form part of this DPA, to the extent that:

1. the GDPR or Swiss Data Protection Law applies to the Controller when making that transfer; or
2. the Applicable Data Protection Laws that apply to the Controller when making that transfer (the "Exporter Data Protection Laws") prohibit the transfer of Covered Data to the Processor under this DPA in the absence of a transfer mechanism implementing adequate safeguards in respect of the Processing of that Covered Data, and any one or more of the following applies:
   (i) the relevant authority with jurisdiction over the Controller's transfer of Covered Data under this DPA has not formally adopted standard data protection clauses or another transfer mechanism under the Exporter Data Protection Laws; or
   (ii) such authority has issued guidance that entering into standard contractual clauses approved by the European Commission would satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
   (iii) established market practice in relation to transfers subject to the Exporter Data Protection Laws is to enter into standard contractual clauses approved by the European Commission to satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
3. the transfer is an "onward transfer" (as defined in the applicable module of the SCCs).

13.2. The Parties agree that execution of the Agreement shall have the same effect as signing the SCCs.

13.3. Processor shall provide Controller reasonable support to enable Controller's compliance with the requirements imposed on international transfers of Covered Data. Processor shall:

1. upon Controller's request, provide such information to Controller as reasonably necessary for Controller to complete a transfer impact assessment ("TIA") under Applicable Data Protection Laws;
2. implement the supplementary measures agreed upon and set forth in Schedule 4 of this DPA in order to enable Controller's compliance with requirements imposed on international transfers of Covered Data under Applicable Data Protection Laws.

14. GENERAL

14.1. The Parties hereby certify that they understand the requirements in this DPA and will comply with them.

14.2. The Parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.

14.3. If any court or competent authority decides that any term of this DPA is held to be invalid, unlawful, or unenforceable to any extent, such term will, to that extent only, be severed from the remaining terms, which will continue to be valid to the fullest extent permitted by law.

14.4. This DPA and the Agreement set forth the entire agreement between the Parties with respect to the subject matter hereof.

SCHEDULE 1

DETAILS OF PROCESSING

A. List of Parties

‍

B. Description of Processing

1. Categories of Data Subjects

The categories of Data Subjects whose Personal Data are Processed: Controller’s customers, employees, contractors, and/or other third parties whose Personal Data is included within User Content submitted by Controller’s to Arrows for Processing as part of the Services.

2. Categories of Personal Data

The Processed categories of Personal Data are: Any Personal Data contained in the User Content that Controller’s submits of uploads to the Services. The Personal Data that Controller’s may submit to the Services is determined and controlled by Controller’s in its sole discretion, and may include name, email address, and phone number of Controller’s end users.

3. Special categories of Personal Data (if applicable)

The Processed Personal Data includes the following special categories of data:  Arrows does not intentionally or knowingly collect or process special categories of data (as defined under European Data Protection Laws) in connection with the provision of the Services. Submission of sensitive data is a violation of Arrows’ Agreement.

4. Frequency of the Processing

The Processing is performed continuously.

5. Subject matter and nature of the Processing

The subject matter of the Processing is: Arrows Processes Covered Data to provide, maintain, and improve the Services and fulfill contractual obligations towards Controller, as described in the Agreement. These Services include the Processing of User Content that may contain Personal Data.

6. Purpose(s) of the data transfer and further Processing

The purpose/s of the data transfer and further Processing is: The provision of the Services by the Processor to the Controller.

7. Retention Period

The period during which the Personal Data will be Processed, or, if that is not possible, the criteria used to determine that period: For the duration of the Agreement (unless otherwise required by applicable law, in which case Arrows will retain Personal Data until it is no longer required by applicable law).  

8. Sub-processor (if applicable)

For Processing by sub-processors, specify subject matter, nature, and duration of the Processing: Per Controller’s instructions.

C. Competent Supervisory Authority

Identify the competent supervisory authority/ies in accordance with clause 13 of the SCCs

Where the data exporter is established in an EU Member State: The supervisory authority of the country in which the data exporter established is the competent authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR: The competent supervisory authority is the one of the Member State in which the representative is established.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without, however, having to appoint a representative pursuant to Article 27(2) of the GDPR: The competent supervisory authority is the supervisory authority of Ireland

SCHEDULE 2

TECHNICAL AND ORGANIZATIONAL MEASURES

Processor has implemented the following technical and organizational measures (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, as well as the risks for the rights and freedoms of natural persons:

1. Organizational management and dedicated staff responsible for the development, implementation, and maintenance of Processor's information security program.

2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Processor's organization, monitoring and maintaining compliance with Processor's policies and procedures, and reporting the condition of its information security and compliance to internal senior management.

3. Utilization of commercially available and industry standard encryption technologies for Covered Data that is:

1. being transmitted by Processor over public networks (i.e., the Internet) or when transmitted wirelessly; or
2. at rest or stored on portable or removable media (i.e., laptop computers, CD/DVD, USB drives, back-up tapes).

4. Data security controls which include at a minimum, but may not be limited to, logical segregation of data, logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g., granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review, and revoking/changing access promptly when employment terminates or changes in job functions occur).

5. Password controls designed to manage and control password strength and usage including prohibiting users from sharing passwords and, where feasible, requiring that Processor's passwords that are assigned to its employees: (i) be at least eight (8) characters in length with at least one number, (ii) not be stored in readable format on Processor's computer systems; (iii) must have defined complexity; and (iv) newly issued passwords must be changed after first use.

6. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Processor's possession.

7. Change management procedures and tracking mechanisms designed to test, approve, and monitor all changes to Processor's technology and information assets.

8. Incident / problem management procedures design to allow Processor to investigate, respond to, mitigate, and notify of events related to Processor's technology and information assets.

9. Network security controls that provide for the use of firewall systems, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.

10. Vulnerability assessment, patch management and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code.

11. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disasters.

SCHEDULE 3

STANDARD CONTRACTUAL CLAUSES

1. EU SCCS

With respect to any transfers referred to in clause 13, the Standard Contractual Clauses shall be completed as follows:

1.1. Module Two will apply in the case of the Processing under clause 3(a)(i) of the DPA and Module Three will apply in the case of Processing under clause 3(a)(ii) of the DPA.

1.2. Clause 7 of the Standard Contractual Clauses (Docking Clause) does not apply.

1.3. Clause 9(a) option 2 (General written authorization) shall apply, and the time period to be specified is determined in clause 6.4 of the DPA.

1.4. The option in Clause 11(a) of the Standard Contractual Clauses (Independent dispute resolution body) does not apply.

1.5. With regard to Clause 17 of the Standard Contractual Clauses (Governing law), the Parties agree that option 1 will apply and the governing law will be the law of the Republic of Ireland.

1.6. In Clause 18 of the Standard Contractual Clauses (Choice of forum and jurisdiction), the Parties submit themselves to the jurisdiction of the courts of the Republic of Ireland.

1.7. For the Purpose of Annex I of the Standard Contractual Clauses, Schedule 1 of the DPA contains the specifications regarding the parties, the description of transfer, and the competent supervisory authority.

1.8. For the Purpose of Annex II of the Standard Contractual Clauses, Schedule 2 of the DPA contains the technical and organizational measures.

1.9. The specifications for Annex III of the Standard Contractual Clauses, are determined by clause 6.2 of the DPA. The Sub-processor's contact person's name, position and contact details will be provided by Processor upon request.

2. UK ADDENDUM

2.1. This paragraph 2 (UK Addendum) shall apply to any transfer of Covered Data from Controller (as data exporter) to Processor (as data importer), to the extent that:

1. the UK Data Protection Laws apply to Controller when making that transfer; or
2. the transfer is an "onward transfer" as defined in the Approved Addendum.

2.2. As used in this paragraph 2:

"Approved Addendum" means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, as it may be revised according to Section 18 of the Approved Addendum.

"UK Data Protection Laws" means all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.

2.3. The Approved Addendum will form part of this DPA with respect to any transfers referred to in paragraph 2.1, and execution of this DPA shall have the same effect as signing the Approved Addendum.

2.4. The Approved Addendum shall be deemed completed as follows:

1. the "Addendum EU SCCs" shall refer to the SCCs as they are incorporated into this Agreement in accordance with clause 13 and this Schedule 3;
2. Table 1 of the Approved Addendum shall be completed with the details in paragraph A of Schedule 1;
3. the "Appendix Information" shall refer to the information set out in Schedule 1 and Schedule 2
4. for the purposes of Table 4 of the Approved Addendum, Processor (as data importer) may end this DPA, to the extent the Approved Addendum applies, in accordance with Section ‎19 of the Approved Addendum; and
5. Section 16 of the Approved Addendum does not apply.

1. Where this Addendum uses terms that are defined in the Standard Contractual Clauses, those terms will have the same meaning as in the Standard Contractual Clauses. In addition, the following terms have the following meanings:
   
   "Addendum" means this addendum to the Clauses;
   
   "Clauses" means the Standard Contractual Clauses as incorporated into this DPA in accordance with clause 13 and as further specified in this Schedule 3; and
   
   "FDPIC" means the Federal Data Protection and Information Commissioner.
2. This Addendum shall be read and interpreted in a manner that is consistent with Swiss Data Protection Laws, and so that it fulfils the Parties' obligation to provide appropriate safeguards as required by Article 46 GDPR and/or Article 6(2)(a) of the Swiss Data Protection Laws, as the case may be.
3. This Addendum will not be interpreted in a way that conflicts with rights and obligations provided for in Swiss Data Protection Laws.
4. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Swiss Addendum has been entered into.
5. In relation to any Processing of Personal Data subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the GDPR, this Addendum amends and supplements the Clauses to the extent necessary so they operate:

3. SWISS ADDENDUM

3.1. This Swiss Addendum will apply to any Processing of Covered Data that is subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the EU GDPR.

3.2. Interpretation of this Addendum

(i) for transfers made by the data exporter to the data importer, to the extent that Swiss Data Protection Laws apply to the data exporter’s Processing when making that transfer; and

(ii) to provide appropriate safeguards for the transfers in accordance with Article 6(2)(a) of the Swiss Data Protection Laws, as the case may be.

3.3. Hierarchy

In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions which provide the most protection to Data Subjects will prevail.

3.4. Changes to the Clauses for transfers exclusively subject to Swiss Data Protection Laws

To the extent that the data exporter's Processing of Personal Data is exclusively subject to Swiss Data Protection Laws, or the transfer of Personal Data from a data exporter to a data importer under the Clauses is an "onward transfer" (as defined in the Clauses, as amended by the remainder of this paragraph 3.3(a)) the following amendments are made to the Clauses:

1. References to the "Clauses" or the "SCCs" mean this Swiss Addendum as it amends the SCCs.
2. Clause 6 Description of the transfer(s) is replaced with:
   "The details of the transfer(s), and in particular the categories of Personal Data that are transferred and the purpose(s) for which they are transferred, are those specified in Schedule 1 of this DPA where Swiss Data Protection Laws apply to the data exporter’s Processing when making that transfer."
3. References to "Regulation (EU) 2016/679" or "that Regulation" or ""GDPR" are replaced by "Swiss Data Protection Laws" and references to specific Article(s) of "Regulation (EU) 2016/679" or "GDPR" are replaced with the equivalent Article or Section of Swiss Data Protection Laws extent applicable.
4. References to Regulation (EU) 2018/1725 are removed.
5. References to the "European Union", "Union", "EU" and "EU Member State" are all replaced with "Switzerland".
6. Clause 13(a) and Part C of Annex I are not used; the "competent supervisory authority" is the FDPIC;
7. Clause 17 is replaced to state
8. "These Clauses are governed by the laws of Switzerland".
9. Clause 18 is replaced to state:
   "Any dispute arising from these Clauses relating to Swiss Data Protection Laws will be resolved by the courts of Switzerland. A Data Subject may also bring legal proceedings against the data exporter and/or data importer before the courts of Switzerland in which he/she has his/her habitual residence. The Parties agree to submit themselves to the jurisdiction of such courts."
10. Until the entry into force of the revised Swiss Data Protection Laws, the Clauses will also protect Personal Data of legal entities and legal entities will receive the same protection under the Clauses as natural persons.

3.5. Supplementary provisions for transfers of Personal data subject to both the GDPR and Swiss Data Protection Laws

(a) To the extent that the data exporter's Processing of Personal Data is subject to both Swiss Data Protection Laws and the GDPR, or the transfer of Personal Data from a data exporter to a data importer under the Clauses is an "onward transfer" under both the Clauses and the Clauses as amended by paragraph 3.3(c) of this Addendum:

(i) for the purposes of Clause 13(a) and Part C of Annex I:

(A) the FDPIC shall act as competent supervisory authority with respect to any transfers of Personal Data to the extent Swiss Data Protection Laws apply to the data exporter's Processing when making that transfer, or such transfer is an "onward transfer" as defined in the Clauses (as amended by paragraph 3.3 of this Addendum; and

(B) subject to the provisions of paragraph 2 of this Schedule 3 (UK Addendum), the supervisory authority identified in Schedule 1 shall act as competent supervisory authority with respect to any transfers of Personal Data to the extent the GDPR applies to the data exporter's processing, or such transfer is an "onward transfer" as defined in the Clauses.

(b) the terms "European Union", "Union", "EU", and "EU Member State" shall not be interpreted in a way that excludes the ability of Data Subjects in Switzerland bringing a claim in their place of habitual residence in accordance with Clause 18(c) of the Clauses; and

(c) Until the entry into force of the revised Swiss Data Protection Laws, the Clauses will also protect Personal Data of legal entities and legal entities will receive the same protection under the Clauses as natural persons.

4. Transfers under the laws of other jurisdictions

4.1. With respect to any transfers of Personal Data referred to in clause 13.1(b) (each a "Global Transfer"), the SCCs shall not be interpreted in a way that conflicts with rights and obligations provided for in the Exporter Data Protection Laws.

4.2. For the purposes of any Global Transfers, the SCCs shall be deemed to be amended to the extent necessary so that they operate:

1. for transfers made by the applicable data exporter to the data importer, to the extent the Exporter Data Protection Laws apply to that data exporter's Processing when making that transfer; and
2. to provide appropriate safeguards for the transfers in accordance with the Exporter Data Protection Laws.

4.3. The amendments referred to in clause paragraph 4.2 include (without limitation) the following:

1. references to the "GDPR" and to specific Articles of the GDPR are replaced with the equivalent provisions under the Exporter Data Protection Laws;
2. reference to the "Union", "EU" and "EU Member State" are all replaced with reference to the jurisdiction in which the Exporter Data Protection Laws were issued (the "Exporter Jurisdiction");
3. the "competent supervisory authority" shall be the applicable supervisory in the Exporter Jurisdiction; and
4. Clauses 17 and 18 of the SCCs shall refer to the laws and courts of the Exporter Jurisdiction respectively.

4.4. Where, at any time during the Processor’s Processing of Covered Data under this DPA, a transfer mechanism other than the SCCs is approved under the Exporter Data Protection Laws with respect to transfers of Covered Data by Controller to Processor, the Parties shall promptly enter into a supplementary agreement that:

1. incorporates any standard data protection clauses or another transfer mechanism formally adopted by the relevant authority in the Exporter Jurisdiction;
2. incorporates the details of Processing set out in Schedule 1;
3. shall, with respect to the transfer of Personal Data subject to the Exporter Data Protection Laws, take precedence over this DPA in the event of any conflict.

4.5. Where required under the Exporter Data Protection Laws, the relevant data exporter shall file a copy of the agreement entered into in accordance with paragraph 4.4 with the relevant national authority.

SCHEDULE 4

ADDITIONAL SUPPLEMENTARY MEASURES

Processor further commits to implementing supplementary measures based on guidance provided by EU supervisory authorities in order to enhance the protection of Covered Data in relation to the Processing in a third country, as described in this Schedule 4.

1. Additional Technical Measures

2. Encryption

The Personal Data is transmitted (between the Parties and by Processor between data centers as well as to a sub-processor and back) using strong encryption.

In accordance with the requirements outlined in the previous paragraph, the Parties agree to implement strong end-to-end content encryption (between the Parties and by Processor between data centers as well as to a sub-processor and back).

The Personal Data at rest is stored by Processor using strong encryption.

3.3. Organizational methods and dataminimization measures

Development and implementation of best practices by both Parties to appropriately and timely involve and provide access of information to their respective data protection officers, if existent, and to their legal and internal auditing services on matters related to international transfers of Personal Data transfers.

2.1. Others

Adoption and regular review by Processor of internal policies to assess the suitability of the implemented complementary measures and identify and implement additional or alternative solutions when necessary, to ensure that an essentially equivalent level of protection to that guaranteed within the EEA of the Personal Data transferred is maintained.

3. Additional Contractual Measures

3.1. Transparency obligations

Processor declares that (1) it has not purposefully created back doors or similar programming that could be used to access the system and/or Personal Data, (2) it has not purposefully created or changed its business processes in a manner that facilitates access to Personal Data or systems, and (3) that national law or government policy does not require Processor to create or maintain back doors or to facilitate access to Personal Data or systems or for Processor to be in possession or to hand over the encryption key.

Processor will verify the validity of the information provided for the TIA questionnaire on a regular basis and provide notice to Controller in case of any changes without delay. Clause 14(e) SCC will remain unaffected.

3.2. Obligations to take specific actions

In case of any order to disclose or to grant access to the Personal Data, Processor commits to inform the requesting public authority of the incompatibility of the order with the safeguards contained in the Article 46 GDPR transfer tool and the resulting conflict of obligations for Processor.

3.3. Empowering Data Subjects to exercise their rights

Processor commits to fairly compensate the Data Subject for any material and non-material damage suffered because of the disclosure of his/her Personal Data transferred under the chosen transfer tool in violation of the commitments it contains. Notwithstanding the foregoing, Processor shall have no obligation to indemnify the data subject to the extent the data subject has already received compensation for the same damage. Compensation is limited to material and non-material damages as provided in the GDPR and excludes consequential damages and all other damages not resulting from Processor’s infringement of the GDPR.

SCHEDULE 5

SUB-PROCESSORS

Please view a list of our sub-processors at https://arrows.to/subprocessors