Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into and forms part of the Subscription Agreement (the “Agreement”) between the entity identified as the customer in the underlying services agreement (“Customer”) and Cayosoft, Inc. (“Vendor”) for the provision of the services described therein. This DPA sets forth the parties’ obligations with respect to the processing of Personal Data in connection with the services provided under the Agreement.

1. Definitions

“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under this DPA, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK General Data Protection Regulation, and the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (“CCPA”), in each case to the extent applicable to the processing activities contemplated by this DPA.

“Controller” means the entity that determines the purposes and means of Processing Personal Data. For purposes of the CCPA, the Controller is the “Business.”

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“Personal Data” means any information relating to a Data Subject that is processed by Vendor on behalf of Customer in connection with the services. For purposes of the CCPA, Personal Data includes “Personal Information” as defined therein.

“Processing” (and its cognates “Process” and “Processed”) means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Processor” means the entity that Processes Personal Data on behalf of the Controller. For purposes of the CCPA, the Processor is a “Service Provider.”

“Sub-processor” means any third party engaged by Vendor to Process Personal Data on behalf of Customer.

“Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise Processed by Vendor or its Sub-processors.

2. Roles and Scope of Processing

2.1. Customer is the Controller and Vendor is the Processor with respect to Personal Data Processed under this DPA. Customer appoints Vendor to Process Personal Data on Customer’s behalf to the extent necessary to provide the services under the  Agreement.

2.2. The subject matter, duration, nature, and purpose of Processing, the categories of Data Subjects, and the types of Personal Data Processed under this DPA are as described in Annex 1 attached hereto.

2.3. Vendor shall Process Personal Data only on behalf of and in accordance with Customer’s documented instructions. The Agreement, including this DPA, constitutes Customer’s initial documented instructions. Customer may issue additional written instructions consistent with the terms of this DPA.

2.4. For purposes of the CCPA, Vendor shall not sell or share Personal Data, retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, or combine Personal Data with personal information received from other sources, except as expressly permitted by the CCPA.

3. Confidentiality

Vendor shall ensure that all personnel authorized to Process Personal Data are subject to appropriate obligations of confidentiality, whether contractual or statutory, with respect to such Personal Data.

4. Security Measures

4.1. Vendor shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

4.2. Such measures shall include, at a minimum: (a) encryption of Personal Data in transit and at rest; (b) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (c) measures to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of Processing.

5. Sub-processing

5.1. Customer provides general authorization for Vendor to engage Sub-processors to Process Personal Data. Vendor shall maintain a current list of Sub-processors, which shall be made available on the Vendor Trust Page located at https://www.cayosoft.com/trust-center/ which Customer may subscribe to receive notifications regarding changes to Sub-processors.).

5.2. Vendor shall notify Customer of any intended addition or replacement of a Sub-processor at least fifteen (15) days in advance, thereby giving Customer the opportunity to object to such changes. If Customer objects on reasonable grounds relating to the protection of Personal Data, the parties shall discuss the objection in good faith. If the parties cannot resolve the objection within a reasonable timeframe, Customer may terminate the applicable schedule, order or agreement that relates to such SaaS Product or services which cannot be provided by Vendor without the use of the objected-to new Sub-processor in accordance with the termination clause in the Agreement.

5.3. Vendor shall impose on each Sub-processor, by way of a written agreement, data protection obligations no less protective than those set forth in this DPA. Vendor shall remain fully liable to Customer for the performance of each Sub-processor’s obligations.

6. Data Subject Rights

6.1. Vendor shall, taking into account the nature of the Processing, assist Customer in fulfilling Customer’s obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws.

6.2. If Vendor receives a request from a Data Subject directly, Vendor shall promptly redirect the Data Subject to Customer and notify Customer of the request, unless otherwise required by applicable law.

7. Security Incident Notification

7.1. Vendor shall notify Customer of any Security Incident without undue delay and in any event in compliance with Applicable Data Protection Laws.

7.2. Such notification shall include, to the extent reasonably available: (a) the nature of the Security Incident, including where possible the categories and approximate number of Data Subjects concerned; (b) the likely consequences of the Security Incident; (c) the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its possible adverse effects; and (d) the name and contact details of Vendor’s point of contact for further information.

7.3. Vendor shall cooperate with Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident.

8. Data Protection Impact Assessments and Prior Consultation

Vendor shall provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with supervisory authorities that Customer is required to carry out under Applicable Data Protection Laws, in each case solely in relation to the Processing of Personal Data under this DPA and taking into account the nature of the Processing and the information available to Vendor.

9. Audits

9.1. Vendor shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer.

9.2. Customer shall provide Vendor with reasonable prior written notice of any audit (not less than thirty (30) days), and such audit shall be conducted during normal business hours, no more than once per two (2) year period (unless required by a supervisory authority or following a Security Incident). Customer shall treat such audit reports as Vendor’s confidential information under the Agreement. Customer shall bear the costs of any audit it initiates.

9.3. Vendor may satisfy its audit obligations under this Section 9 by providing Customer with a copy of a current SOC 2 Type II report (or comparable certification or audit report) issued by a qualified independent auditor, provided such report is no more than twelve (12) months old.

10. International Data Transfers

10.1. Vendor shall not transfer Personal Data to a country outside the European Economic Area, the United Kingdom, or Switzerland unless appropriate safeguards are in place as required by Applicable Data Protection Laws. Such safeguards may include: (a) a decision by the European Commission that the recipient country ensures an adequate level of protection; (b) the Standard Contractual Clauses adopted by the European Commission (as supplemented by any necessary transfer impact assessment); or (c) any other valid transfer mechanism under Applicable Data Protection Laws.

10.2. Where the Standard Contractual Clauses apply to transfers of Personal Data under this DPA, they are hereby incorporated by reference. The parties shall complete and execute any necessary annexes to the Standard Contractual Clauses as required.

11. Return and Deletion of Personal Data

11.1. Upon termination or expiration of the Agreement, or upon Customer’s earlier written request, Vendor shall securely delete all Personal Data in its possession or control, including all copies thereof, unless applicable law or retention policies requires continued storage of the Personal Data. The Personal Data will not be used for any other purposes.

11.2. Vendor shall certify in writing to Customer that it has complied with this Section 11 upon Customer’s request.

12. CCPA-Specific Provisions

12.1. To the extent the CCPA applies, Vendor is a Service Provider. Vendor certifies that it understands and will comply with the obligations applicable to Service Providers under the CCPA.

12.2. Vendor shall not sell or share (as those terms are defined in the CCPA) any Personal Data.

12.3. Vendor shall not retain, use, or disclose Personal Data for any commercial purpose other than providing the services specified in the Agreement.

12.4. Vendor shall not retain, use, or disclose Personal Data outside of the direct business relationship between Vendor and Customer, except as permitted by the CCPA.

12.5. Vendor grants Customer the right to take reasonable and appropriate steps to help ensure that Vendor uses Personal Data in a manner consistent with Customer’s obligations under the CCPA. Vendor shall notify Customer if it determines that it can no longer meet its obligations under the CCPA.

13. General Provisions

13.1. This DPA shall take effect on the effective date of the Agreement and shall remain in force until the termination or expiration of the Agreement, provided that Vendor’s obligations with respect to Personal Data in its possession shall survive until all Personal Data has been returned or deleted in accordance with Section 11.

13.2. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

13.3. This DPA shall be governed by the law governing the Agreement, unless Applicable Data Protection Laws require otherwise.

13.4. Any amendments to this DPA must be in writing and signed by both parties.

Schedule 1: Data Processing Details

For the purpose of the DPA and Schedules 2, 3, and 4 to the DPA, the parties set out below a description of the Personal Data being processed by Vendor under the Agreement and further details required pursuant to the Applicable Data Protection Laws.

Data Exporter	Customer name and address: as set forth in the preamble of the Agreement Contact person’s name, position and contact details: as set forth in the Agreement Role: Controller Activities relevant to the data transfer: Data exporter will transfer Personal Data to the data importer as required for the provision of the SaaS Product and related support services by the data importer under the Agreement and as set out in the DPA.
Data Importer	Vendor Name and Address: Cayosoft, Inc. 480 Olde Worthington Rd, Ste. 310, Westerville, OH 43082 Contact person’s name, position and contact details:  as set forth in the Agreement Role: Processor Activities relevant to the data transfer: Data importer will process personal data as required for the provision of the SaaS Product and related support services under the Agreement and as set out in the DPA.
Signature and Date	The Signature and Effective Date of the Agreement.
Subject Matter of the Processing	Vendor’s provision of the SaaS Product and related support services to Customer.
Nature and purpose of Processing	The collection and storage of Personal Data pursuant to providing the SaaS Product and related support services to Customer.
Types of Personal Data	Personal Data that Customer, in its discretion, uploads into the SaaS Product and submits using the support services, consisting of the following types: Name, email, and phone numbers Username, account passwords, old passwords, old password hashes, user display name, one-time passcode for multi-factor authentication and Information made available to Microsoft 365 applications Universal second factor security keys, hashed passwords and Password usage and check out history Device identifiers, including IP address, serial number, UDID, IMEI, MAC address, SIM ICCID number and system generated unique user-IDs Derived credentials User security question/answer User login time history, login geographical location history, login success/failure/failure reason history IP based geolocation and access logs, including timestamps, resources accessed and session duration Session recordings
Sensitive Personal Data and applied restrictions	None
Categories of Data Subject	Data Subjects may include any end users (including without limitation Customer’s employees, contractors, or other personnel) about whom Personal Data is provided to Vendor via the SaaS Product and related support services by, or at the direction of, Customer.
Duration of Processing	For the duration of the Agreement, or until the processing is no longer necessary for the purposes described in this DPA, except that pre-existing backup copies will be purged within Vendor’s standard backup retention cycle.

 

 

Schedule 2: UK Addendum 

For the purposes of the UK Approved Addendum,

1. the information required for Table 1 is contained in Schedule 1 of this DPA and the start date shall be deemed dated the same date as the EU Clauses;
2. in relation to Table 2, the version of the EU Clauses to which the UK Approved Addendum applies is Module Two for Controller to Processor;
3. in relation to Table 3, the list of parties and description of the transfer are as set out in Schedule 1 of this DPA, Vendor’s technical and organizational measures are set in Annex II of Schedule 4 of this DPA, and the list of Vendor’s sub-processors shall be provided pursuant to Clause 5 of this DPA; and
4. in relation to Table 4, neither party will be entitled to terminate the UK Approved Addendum in accordance with clause 19 of the UK Mandatory Clauses.

 

Schedule 3: Swiss Addendum

This Swiss Addendum applies only to transfers of Personal Data that are subject to the Swiss Data Protection Law (“Swiss Transfers”). For Swiss Transfers, the EU Clauses shall apply with the following modifications, which shall prevail to the extent of any conflict:

1. references in the EU Clauses to the “EU GDPR” (and related defined terms) shall be read as references to the Swiss Data Protection Law insofar as the data transfer is subject to Swiss Data Protection Law, and references to “Member State law” shall be read as references to Swiss law;
2. the competent supervisory authority for Swiss Transfers shall be the Federal Data Protection Commissioner (FDPC);
3. Clause 18 (Choice of forum and jurisdiction) of the EU Clauses shall be read to permit data subjects in Switzerland to bring claims before the competent courts of Switzerland in relation to Swiss Transfers in accordance with clause 18c of the EU Clauses;
4. Clause 17 (Governing law) of the EU Clauses shall be read as specifying Swiss law as the governing law for Swiss Transfers; and
5. the Annexes to the EU Clauses for Swiss Transfers are as set out in Schedule 4 which apply equally to Swiss Transfers.

 

Schedule 4: EU Clauses

1. For the purposes of this Schedule 4, the EU Clauses (Module II), available at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN , shall be incorporated by reference to this Schedule 4 and the DPA and shall be considered an integral part thereof, and the parties’ signatures in the  Agreement (to which this DPA is attached as an Exhibit) shall be construed as the parties’ signatures to the EU Clauses. In the event of an inconsistency between the DPA and the EU Clauses, the latter will prevail.
2. For the purposes of the EU Clauses, the following shall apply:
   • • Customer is the exporter and Vendor is the importer. Each party agrees to be bound by and comply with its obligations in its role as exporter and importer respectively as set out in the EU Clauses.
     • Clause 7 (Docking clause) shall be deemed as included.
     • Clause 9 (Use of sub-processors): OPTION 2 – GENERAL WRITTEN AUTHORISATION shall apply. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors as set out in Clause 5 of the DPA.
     • Clause 11 (Redress): optional clause (optional redress mechanism before an independent dispute resolution body) shall be deemed as not included.
     • Clause 13 (a) (Supervision).

Competent Supervisory Authority

Where Customer is established in an EU Member State, the supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer shall act as competent supervisory authority.

Where Customer is not established in an EU Member State but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679, the supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established shall act as competent supervisory authority.

Where Customer is not established in an EU Member State but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679, the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behavior is monitored, are located, shall act as competent supervisory authority.

1. • • Clause 17 (Governing law): These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The parties agree that this shall be the law of Ireland.
     • Clause 18 (b) (Choice of forum and jurisdiction): The parties agree that any dispute between them arising from the EU Clauses shall be resolved by the courts of Ireland.

1. Any provision in the EU Clauses relating to liability of the parties with respect to each other shall be subject to the limitations and exclusions of the Agreement.
2. Any provision in the EU Clauses relating to the right to audit shall be interpreted in accordance with Clause 9 of the DPA and the Agreement.

Annex I to Schedule 4

The required information for Annex I is contained in Schedule 1.

Annex II to Schedule 4: Security Measures

Vendor will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risks. Such measures will include reasonable administrative, physical, and technical security controls (including those required by applicable Data Protection Laws) that prevent the unauthorized collection, use, disclosure, or access to Personal Data, including maintaining a comprehensive information security program that safeguards Personal Data.

Such Security Measures will include: (a) strict logical or physical separation between (i) Personal Data (ii) Vendor data and data of Customer; (b) implementation and maintenance of administrative, physical or technical controls proportional to the nature and sensitivity of the Personal Data processed by Vendor, including, by way of example, encryption; (c) maintaining industry standard perimeter protection for Vendor’s network and devices connected thereto; (d) applying, as soon as practicable, patches or other controls to relevant systems that effectively address actual or potential security vulnerabilities; (e) employing commercially reasonable efforts to ensure that relevant systems remain free of security vulnerabilities, viruses, malware, and other harmful code; (f) employing commercially reasonable efforts to practice safe coding standards and practices which address application security vulnerabilities; (g) providing appropriate education and training to Vendor personnel regarding these Security Measures and ensuring that those individuals are bound by confidentiality obligations; (h) accessing or transferring Personal Data only in a secure and confidential manner; and (i) limiting employee/agent/subcontractor access to Vendor’s network, systems, devices and facilities to those with a need for such access, and whose access privileges are revoked promptly upon their termination.

Annex III to Schedule 4: Sub-Processors

Find sub-processors listed here: https://www.cayosoft.com/trust-center/