Data Processing Addendum

Customer and Enhancio agree that, as between the Parties, Customer is a Controller and Enhancio is a Processor of Customer Personal Data and that each Party is solely responsible for its compliance with Data Protection Laws applicable to it and for fulfilling any of its related obligations to third parties, including Data Subjects and Supervisory Authorities.

Enhancio will implement and maintain technical, physical, and organizational measures and controls designed to protect and secure Customer Content (including the return and deletion thereof) in accordance with the Agreement.

Customer acknowledges that, through its Users, Customer:

Customer authorizes Enhancio to use any Subprocessors subject to the terms and conditions of this Section 4.

Enhancio will carry out appropriate due diligence on each Subprocessor and have a written agreement with each Subprocessor that includes provisions for Processing Customer Personal Data that are substantially as protective as those set out in this DPA.

Enhancio is responsible for Subprocessors’ acts and omissions, including a Subprocessor’s appointment of another Subprocessor.

Enhancio will provide Customer access to end-user’s Personal Data via the Demand Automation Platform to allow Customer to respond to Data Subject requests relating to Customer Personal Data.

Enhancio will notify Customer in writing without undue delay of any requests Enhancio receives directly from a Data Subject relating to Customer Personal Data:

At Customer’s written request and to the extent Customer is unable to access Customer Personal Data on its own, Enhancio will provide reasonable assistance to Customer in accessing Customer Personal Data for Customer to respond to such Data Subject requests.

Enhancio will notify Customer in writing without undue delay upon Enhancio becoming aware of a Data Breach.

Enhancio will investigate and, as necessary, mitigate or remediate a Data Breach in accordance with Enhancio’s security incident policies and procedures (“Breach Management”).

Subject to Enhancio’s legal obligations, Enhancio will provide Customer with information available to Enhancio as a result of its Breach Management, including the nature of the incident, specific information disclosed (if known), and any relevant mitigation efforts or remediation measures (“Breach Information”), for Customer to comply with its obligations under Data Protection Laws as a result of a Data Breach.

If Customer requires information relating to a Data Breach in addition to the Breach Information, at Customer’s sole expense and written request and to the extent Customer is unable to access the additional information on its own, Enhancio will reasonably cooperate with Customer as requested by Customer to attempt to collect and provide such additional information.

Enhancio will use external auditors to annually audit and verify the adequacy of its security measures and controls (“Audit”). The Audit will:

 If Customer requires information for its compliance with Data Protection Laws in addition to the Reports, at Customer’s sole expense and written request and to the extent Customer is unable to access the additional information on its own, Enhancio will allow for and cooperate with a Customer mandated audit by a third-party auditor in relation to the Enhancio’s Processing of Customer Personal Data (“Customer Audit”), provided that:

The Parties acknowledge and agree that the Processing of Customer Personal Data by Enhancio may involve an international transfer of Customer Personal Data from Customer to Enhancio (“International Transfer”).

Enhancio will ensure that there are adequate safeguards in place to protect Customers personal data and that will comply with legal obligations if at all data is transferred out of EU area. These adequate safeguards might comprise a data transfer agreement with the recipient based on standard contractual clauses approved by the European Commission for transfers of personal data to countries outside EU.

Amendment; Waiver. Unless otherwise expressly stated herein, this DPA may be modified only by a written agreement executed by an authorized representative of each Party.  The waiver of any breach of this DPA will be effective only if in writing, and no such waiver will operate or be construed as a waiver of any subsequent breach.

Severance. If any provision of this DPA is held to be unenforceable, then that provision is to be construed either by modifying it to the minimum extent necessary to make it enforceable (if permitted by law) or disregarding it (if not permitted by law), and the rest of this DPA is to remain in effect as written. Notwithstanding the foregoing, if modifying or disregarding the unenforceable provision would result in failure of an essential purpose of this DPA, the entire DPA will be considered null and void.

Order of Precedence. Regarding the subject matter of this DPA, in the event of any conflict between this DPA and any other written agreement between the Parties (including the Agreement), this DPA will govern and control. Any data processing agreements that may already exist between Parties are superseded and replaced by this DPA in their entirety.

Notices. Unless otherwise expressly stated herein, the parties will provide notices under this DPA in accordance with the Agreement, provided that all such notices may be sent via email.

Governing Law and Jurisdiction. Unless prohibited by Data Protection Laws, this DPA is governed by the laws stipulated in the Terms of Service and the Parties to this DPA hereby submit to the choice of jurisdiction and venue stipulated in the Terms of Service, if any, with respect to any dispute arising under this DPA.

Enforcement. Regardless of whether Customer or its affiliate(s) or a third-party is a Controller of Customer Personal Data, unless otherwise required by law:

Liability. As between the Parties to this DPA, each Party’s liability and remedies under this DPA are subject to the aggregate liability limitations and damages exclusions set forth in the Agreement.

Variations in Data Protection Laws. If any variation is required to this DPA as a result of a change in or subsequently applicable Data Protection Law, then either Party may provide written notice to the other Party of that change in law. The Parties will then discuss and negotiate in good faith any variations to this DPA necessary to address such changes, with a view to agreeing and implementing those or alternative variations as soon as practicable, provided that such variations are reasonable with regard to the functionality and performance of the Services and Enhancio’s business operations.

Reservation of Rights. Notwithstanding anything to the contrary in this DPA:

Enhancio as Controller. Enhancio may collect Personal Data directly from Data Subjects (which may be duplicative of Customer Personal Data) in accordance with Enhancio’s internal policies and publicly posted Privacy Policy, and nothing in this DPA will prohibit Enhancio from Processing such Personal Data as a Controller under Data Protection Laws, provided that Enhancio conspicuously notifies such Data Subjects that such information will be handled in accordance with Enhancio’s Privacy Policy.