Snapshot 10603
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT FOR CLOUDBLUE SERVICES
This Data Processing Agreement (hereafter “Data Processing Agreement” or “Agreement”) applies to the
Processing of Personal Data by CloudBlue LLC with registered address at 3351 Michelson Drive, Suite 100,
Irvine, CA 92612-0697, United States of America (hereinafter “CloudBlue”) on behalf of Customer identified
in the CloudBlue Cloud Platform Order Form, as part of CloudBlue’s provision of certain Products and services
described under the CloudBlue Cloud Platform Order Form and CloudBlue Cloud Platform Terms and
Conditions that reference this Data Processing Agreement (collectively, the “Cloud Terms”). Such services
provided under the Cloud Terms include CloudBlue Product and associated professional services such as
managed services and technical support and maintenance services (collectively, the “Cloud Services” or
“Services”).
Hereinafter also referred to individually as a "Party" and collectively as "Parties"
Regarding the Processing of Personal Data by CloudBlue on behalf of Customer the provisions of this Data
Processing Agreement supersede all previous understandings and agreements between the Parties.
By executing a CloudBlue Cloud Platform Order Form that references the CloudBlue Cloud Platform Terms
and Conditions and this Data Processing Agreement, Customer accepts and agrees to this Data Processing
Agreement. If the individual accepting this Data Processing Agreement is accepting on behalf of a company
or other legal entity, such individual represents that such individual has the authority to bind such entity and
its affiliates to this Data Processing Agreement in which case the term “Customer” shall refer to such entity
and its affiliates.
1. DEFINITIONS AND INTERPRETATION
Capitalized terms not defined herein (if any) have the meaning set forth in the Cloud Terms or in the GDPR
(as defined below).
“Attachment” means each annex, exhibits, schedule or attachments to this Data Processing Agreement which
forms part of the Data Processing Agreement.
“Data Subject” means any identified or identifiable person or legal entity (if the case may be under the
applicable legislation) to whom Personal Data relates; an identifiable person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an identification number,
location data, an online identifier or to one or more factors specific to the physical, psychological, genetic,
mental, economic, cultural and/or social identity of that person.
“Data Controller” or “Controller” means the legal person which alone or in conjunction with others,
determines the purposes and means of the Processing of Personal Data, which for this Data Processing
Agreement is the Customer.
“Data Processing Agreement “or “Agreement” means this agreement including its Attachments.
“Data Processor” or “Processor” means the entity which Processes Personal Data on behalf of the Controller,
which for this Data Processing Agreement is CloudBlue.
“Data Protection Laws” means all applicable laws, directives, ordinances, rules, regulations etc. including,
where applicable, but not limited to European or local country laws and regulations governing the processing of
personal data, such as the GDPR, the UK GDPR and the data protection or privacy laws of any country
applicable to the Processing of Personal Data under this Data Processing Agreement and the Cloud Terms.
“Data Security Breach” means any incident involving the accidental, unlawful or unauthorized destruction,
loss, alteration, disclosure of or access to Personal Data, under this Data Processing Agreement.
“Data Transfer” or “Transfer” means any cross-border communication of Personal Data regardless of the
format, any storage of Personal Data on data-bases hosted in different countries, any access to Personal Data
hosted in a different country.
“EEA” means the European Economic Area which consists of all countries of the European Union,
Liechtenstein, Norway and Iceland.
“GDPR” means the EU General Data Protection Regulation 2016/679, of the European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal
CONFIDENTIAL AND PROPRIETARY
Page 1 of 16
data and on the free movement.
“UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland and Northern
Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data
Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019;
“Personal Data” means any information relating to an identified or identifiable natural person or legal entity
(where such information is protected similarly as personal data or personally identifiable information under
applicable Data Protection Laws), received and processed by CloudBlue on behalf of and for Customer or its
clients under this Data Processing Agreement in the course of providing the Services.
“Processing” “Process” or “Data Processing” means any operation or any set of operations concerning
Personal Data, such as the collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, dissemination, disclosure by means of transmission, distribution or otherwise
making available in any other form, merging, linking, as well as restriction, erasure or destruction of data.
“Sub-processor” means any data processor engaged by CloudBlue in the course of providing the Services.
“Supervisory Authority” means an independent public authority established in a particular country
responsible for monitoring the compliance with the Data Protection Laws within such country, in order to
protect the fundamental rights and freedoms of natural persons in relation to processing.
“Standard Contractual Clauses” means the contractual clauses pursuant to the European Commission’s
decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third
countries which do not ensure an adequate level of data protection pursuant to Regulation (EU) 2016/679 of
the European Parliament and of the Council, the full version of which is available at
https://ec.europa.eu/info/system/files/1_en_annexe_acte_autonome_cp_part1_v5_0.pdf;
“UK International Data Transfer Agreement” or “IDTA” means the UK international data transfer
addendum to the European Commission’s standard contractual clauses issued by the Information
Commissioner under Section 119A of the Data Protection Act 2018 and following Parliamentary approval
came into force on 21 March 2022 for making restricted transfers covered by Chapter V of the UK GDPR;
“Third Country(ies)” means a country(ies) outside the EEA or respectively the United Kingdom, which is
not recognized by the European Commission or respectively the UK Government as providing an adequate
level of protection for personal data.
“Third Party” means a natural or legal person, public authority, agency or body other than the Data Subject,
Controller or Customer, CloudBlue, CloudBlue’s affiliates and Sub-processors.
2. GENERAL
2.1 Parties agree to comply with the applicable data protection legislation and privacy laws, including
without limitation where applicable the GDPR. Parties acknowledge and agree that with regard to the
Processing of Personal Data hereunder, Customer is the Data Controller and CloudBlue is the Data Processor.
This Agreement will apply only to Customer and CloudBlue if and to the extent CloudBlue is Processing
Personal Data on behalf of Customer pursuant to the execution of the Cloud Terms.
2.2 The subject-matter of Processing of Personal Data by CloudBlue is the performance of the Services
pursuant to the Cloud Terms.
3. PROCESSING OF PERSONAL DATA
3.1 Attachment 1 contains an overview of categories of Data Subjects, categories of Personal Data and the
purposes of Processing Personal Data, under this Data Processing Agreement.
3.2 CloudBlue will Process Personal Data on behalf of Customer (i) in accordance with Customer’s
documented instructions in relation to the Processing of Personal Data as part of providing the Services under
the Cloud Terms, (ii) in accordance with this Data Processing Agreement and the applicable Data Protection
Laws as it relates to the Processing hereunder and/or (iii) as necessary to comply with the Cloud Terms and
legal obligations to which CloudBlue or its affiliated companies are subject. CloudBlue agrees to use the
Personal Data for the purposes defined herein or under the Cloud Terms and in particular as necessary to (i)
provide the Services, and (ii) exercise its rights or comply with its obligations under this Agreement, the Cloud
Terms or the applicable laws.
CONFIDENTIAL AND PROPRIETARY
Page 2 of 16
Parties agree that this Agreement and the Cloud Terms constitute Customer’s documented instructions
regarding CloudBlue’s Processing on behalf of Customer. Additional instructions outside the scope of the
documented instructions herein may be provided separately in writing by an authorized representative of the
Customer but such change will be subject to CloudBlue’s prior written agreement before entering into force.
For the avoidance of doubt, Customer will ensure that its instructions for the Processing of Personal Data shall
comply with the applicable laws. If, however, at any time during the execution of this Data Processing
Agreement and the Cloud Terms, CloudBlue establishes that Customer’s instructions appear in any way to be
unlawful or non-compliant with the applicable laws, CloudBlue shall notify this to Customer and wait for
further instructions. In such event, if necessary, CloudBlue reserves the right to suspend the Processing until
Customer issues further lawful instructions. For the avoidance of doubt, in such event CloudBlue will not be
considered in breach of its obligations under the Cloud Terms or this Agreement due to any delays or non-
performance of the Services resulting from the suspension of the Processing.
3.3 In the event that a legal requirement prevents CloudBlue from complying with Customer’s instructions
or requires CloudBlue to Process the Personal data for a particular purpose or to disclose the Personal Data to
a third party, CloudBlue shall, to the extent allowed to do so by the applicable laws, inform Customer in writing
of the relevant legal requirement before carrying out the relevant Processing activities and reasonably co-
operate with Customer regarding the manner of such disclosure.
3.4 Customer warrants and represents that it shall not unlawfully provide or Transfer to CloudBlue or to
its Sub-processors any Personal Data and that any such data has been collected and obtained lawfully, using
valid legal grounds and in compliance with the Data Protection Laws, such as, where needed, the Data Subject
has given its consent to the Processing of its Personal Data by CloudBlue and its Sub-processors. Customer
acknowledges and agrees that it has the sole responsibility of obtaining all necessary consents for the
Processing and Transfers of Personal Data under this Data Processing Agreement and thereby warrants and
represents that where such consent is needed, Customer has obtained Data Subject’s consent and upon written
request by the CloudBlue, copies of such consents will be provided to CloudBlue.
3.5 Where required under the applicable Data Protection Laws and taking into account the nature of the
Processing and the information available to the CloudBlue, upon Customer’s request, CloudBlue shall provide
Customer with reasonable cooperation and assistance needed to fulfill Customer’s obligations under the Data
Protection Laws such as to carry out data protection impact assessments or prior consultation with the
Supervisory Authority, if and to the extent Customer does not otherwise have access to the relevant information
and to the extent such information is available to CloudBlue. Customer shall reimburse CloudBlue the
reasonable costs of that cooperation and assistance.
4. INTERNATIONAL CROSS-BORDER DATA TRANSFER
4.1 Customer acknowledges and agrees that CloudBlue may need to Transfer, disclose or otherwise permit
access to the Personal Data to its affiliates or sub-contractors located in different countries for the purposes
described under section 3 here above. Upon signing this Data Processing Agreement, Customer grants
CloudBlue a general authorization to Process in, Transfer, disclose or to otherwise permit access to the
Personal Data, including to its Sub-processors, from different countries including outside the EEA, Switzerland
and the United Kingdom (“UK”) for the purposes described here above. A list of the countries where Personal
Data will be Processed in and/or Transferred to is available at https://www.cloudblue.com/legal/data-
privacy/sub-processors/. Upon signing this Agreement Customer agrees to the Transfer to and Processing of
the Personal Data in the countries listed under Attachment 1 of this Agreement.
Notwithstanding the above CloudBlue reserves the right to amend the Transfer locations and/or Sub-processors
used with a thirty (30) days’ advance written notice to Customer, which notice may be provided by email or
through an automatic online notification. It is expressly agreed by the Parties, that if Customer does not raise
any objections to such changes or does not provide any answer until the expiration of the 30 days' time frame
from the date of the written notice from CloudBlue, such changes shall be deemed accepted by Customer.
Customer agrees not to unreasonably and unjustifiably object to CloudBlue’s request. If Customer objects to
a particular Transfer, Customer shall cooperate with CloudBlue in good faith in remedying the situation. For
the avoidance of doubt, in such event CloudBlue will not be considered in breach of its obligations under the
Cloud Terms or this Agreement due to any delays or non-performance of the Services resulting from the
objection of Customer.
4.2 Parties agree that any disclosure, access or Transfer under this Agreement of Customer’s Personal
CONFIDENTIAL AND PROPRIETARY
Page 3 of 16
Data which is subject to the GDPR or respectively the UK GDPR, to Third Countries will be performed in
compliance with the Data Protection Laws and if and to the extent required by the applicable Data Protection
Laws upon implementing an adequate and legally valid data transfer safeguard mechanism as provided by the
GDPR or respectively the UK GDPR, such as by entering into the appropriate module of the Standard
Contractual Clauses, or the appropriate template of the IDTA.
Parties agree that the appropriate module of the Standard Contractual Clauses, the Swiss Addendum and the
appropriate template of the IDTA are incorporated herein by reference under Attachment 3, 4 and Attachment
5 and shall be considered an integral part of this Data Processing Agreement. Therefore, it is agreed that with
the execution or acceptance of the Data Processing Agreement, Parties are also executing the relevant module
of the Standard Contractual Clauses, the Swiss Addendum and the IDTA as indicated below. Parties agree that
the applicable module of the Standard Contractual Clauses, the Swiss Addendum and the IDTA is the module
Controller-to-Processor and it will apply between the Parties only for the Transfers of Personal Data to Third
Countries under the GDPR, the Swiss Federal Data Protection Act (“FDPA”) or respectively the UK GDPR.
Therefore, only the provisions of the Standard Contractual Clauses, the Swiss Addendum or the IDTA
applicable to module Controller-to-Processor are binding on the Parties for the purposes of this Agreement
and are considered incorporated herein by reference.
For the avoidance of doubt and notwithstanding the above, the Standard Contractual Clauses, the Swiss
Addendum and the IDTA will not apply to Transfers to Third Countries of Personal Data subject to the GDPR
and respectively the UK GDPPR or the FDPA, if CloudBlue has adopted an alternative recognized data transfer
safeguard mechanism for lawful Data Transfers. Further, Parties acknowledge that the Standard Contractual
Clauses and IDTA may apply only with regard to Personal Data which is subject to the GDPR and respectively
the UK GDPR and the FDPA.
5. SECURITY OF PERSONAL DATA
5.1 CloudBlue shall maintain all necessary and appropriate technical and organizational security measures
to ensure the security, availability, confidentiality and integrity of its computers, other information systems
and services, and to protect Personal Data under this Data Processing Agreement, against accidental,
unauthorized or unlawful destruction, disclosure, copying, use, loss, alteration, or access or any other form of
unlawful or unauthorized Processing in accordance with the applicable Data Protection Laws. CloudBlue shall
ensure that its technical and organizational measures are in compliance with the applicable Data Protection
Laws and industry standards.
5.2 Taking into account the state of the art, the costs of implementation, the nature, scope, context and
purposes of Processing and the nature of Personal Data as well as the risk and severity for the rights and
freedoms of natural persons, CloudBlue’s will ensure that its security measures ensure a level of security
appropriate to the risks presented by the Processing of Personal Data. CloudBlue shall maintain such security
measures and comply with the Data Protection Laws for as long as it is Processing the Personal Data, and this
Data Processing Agreement and the Cloud Terms are not expired or terminated. The technical and
organizational security measures CloudBlue has implemented are specified in Attachment 2 to this Data
Processing Agreement. Customer agrees that the measures included in Attachment 2 are sufficient to ensure
an appropriate level of security of the Personal Data.
6. AUDITS
6.1 Customer has the right, at its own costs, to audit or have a third-party auditor as Customer may from
time to time designate in writing and subject to CloudBlue’s approval, to perform an audit on its behalf in
order to audit CloudBlue’s compliance with its obligations under the Data Processing Agreement. Any agreed
upon third-party auditor will be subject to a non-disclosure agreement with CloudBlue prior to any audit.
Parties will agree on the scope, duration and time of the audit reasonably in advance. CloudBlue shall provide
Customer, for the purpose of the audit and upon written request, with all information necessary to demonstrate
compliance with CloudBlue’s obligations under this Data Processing Agreement, excluding any confidential
information, business sensitive information, trade or business secrets, third-party confidential information,
information, documents or records relating to the business relations of CloudBlue with any third party or the
documents or records already audited by the Customer during the previous twelve (12) months. CloudBlue
shall ensure reasonable cooperation in the performance of the audit and will grant the auditor reasonable access
to its premises in which CloudBlue is providing the Services to Customer. Customer agrees that onsite audits
will be performed only if and to the extent a documentary audit has been performed already and the result of
CONFIDENTIAL AND PROPRIETARY
Page 4 of 16
such audit shows material violations by CloudBlue. Customer may request such audits no more than once
every calendar year and upon providing to CloudBlue a prior written notice of at least thirty (30) business
days. Customer shall carry out any inspection at mutually agreeable date, during normal working hours and
without interfering with the course of CloudBlue’s business.
6.2 Recommendations and/or required alterations following from the audits will be assessed and applied
by CloudBlue after having consulted Customer.
6.3 To the extent allowed to do so by the applicable laws, in case of an investigation by any competent
authority CloudBlue will ensure all reasonable cooperation, inform Customer of the investigation and shall not
disclose any Personal Data without a prior written notification to Customer. Subject to the above, Parties shall
consult with each other on how to act regarding the investigation.
7. SECURITY BREACHES AND NOTIFICATION
7.1 If CloudBlue becomes aware of any incident involving the accidental, unlawful or unauthorized
destruction, loss, alteration, disclosure of or access to Customer’s Personal Data, CloudBlue shall notify
Customer without undue delay and as soon as reasonably possible about the Data Security Breach or security
incident related to the Processing of Personal Data under this Data Processing Agreement and the Cloud Terms.
CloudBlue shall investigate and provide the Customer with sufficient information related to the Data Security
Breach to the extent such information is already available to it, in order to allow Customer to meet any legal
obligation if applicable to notify the Data Subjects or the Supervisory Authority of the Data Security Breach
under the applicable Data Protection Laws.
7.2 In case of a security incident CloudBlue will promptly take adequate measures to mitigate the
consequences of the incident and to prevent future incidents and will ensure reasonable cooperation with
Customer.
8. DATA SUBJECTS REQUESTS
CloudBlue shall promptly notify Customer if it receives a request from a Data Subject to exercise its rights or
any other Data Subject request, under the applicable Data Protection Laws. CloudBlue will not respond to any
such Data Subject request without Customer’s prior written consent and will only do so in accordance with
Customer’s instructions, except as necessary to confirm that the request relates to Customer. CloudBlue shall
provide Customer with all reasonable cooperation and assistance in order to enable Customer to comply with
its legal obligations in relation to the handling of Data Subject requests within the statutory time limits, to the
extent that CloudBlue is legally permitted to do so and provided that such Data Subject Requests are exercised
in accordance with the applicable Data Protection Laws.
9. SUB-PROCESSOR
9.1 Upon signing this Data Processing Agreement, Customer grants CloudBlue a general authorization to
sub-contract the Processing of Personal Data to Sub-processors located in different countries for the purposes
agreed under this Agreement. A full list of the Sub-processors used is available at
https://www.cloudblue.com/legal/data-privacy/sub-processors/. Upon signing this Agreement Customer
agrees to the Sub-processors listed under Attachment 1 of this Agreement. CloudBlue reserves the right to add,
remove, or change the Sub-processors used with a thirty (30) day advance written notice to Customer, which
notice may be provided by email or through an automatic online notification. It is expressly agreed by the
Parties, that if Customer does not raise any objection to such changes or does not provide any answer to the
request until the expiration of the 30 days' time frame from the date of the written notice from CloudBlue, such
changes shall be deemed accepted by Customer. Customer agrees not to unreasonably and unjustifiably object
to CloudBlue’s request. If Customer objects to the appointment or replacement of a Sub-processor Customer
shall cooperate with CloudBlue in good faith in remedying the situation. For the avoidance of doubt, in such
event CloudBlue will not be considered in breach of its obligations under the Cloud Terms or this Agreement
due to any delays or non-performance of the Services resulting from the objection of Customer to the use of
the relevant Sub-processors.
9.2 CloudBlue shall only subcontract its Processing operations regarding the Personal Data by way of a
written agreement between CloudBlue and the Sub-processor which is in accordance with the obligations and
restrictions imposed on CloudBlue by the applicable Data Protection Laws and the principles and standards
set forth in this Data Processing Agreement.
CONFIDENTIAL AND PROPRIETARY
Page 5 of 16
10. RELIABILITY OF STAFF
CloudBlue shall ensure that its personnel engaged in the Processing of Personal Data under this Data
Processing Agreement and the Cloud Terms, have received appropriate training on their responsibilities,
necessary to comply with the terms of this Data Processing Agreement and are under an appropriate obligation
of confidentiality. CloudBlue shall ensure that the access to Personal Data is limited to those personnel who
requires such access to perform the Services under this Data Processing Agreement and the Cloud Terms.
11. RETURN AND DELETION OF CUSTOMER DATA
11.1 CloudBlue will retain the Personal Data for a duration as instructed by the Customer, and consistent
with the retention periods in Attachment 1. Upon Customer’s request, CloudBlue shall promptly and in any
event within ninety (90) days of the date of cessation of any Services and the termination or expiration of the
Cloud Terms, return to Customer or, to the extent allowed by the applicable laws, delete all copies of
Customer’s Personal Data Processed on its behalf that might be in CloudBlue’s possession. Subject to the
above, the return of Customer’s Personal data and all its copies in CloudBlue’s possession shall be completed
by secure file transfer in such format as is reasonably requested by Customer to CloudBlue. The Parties agree
that the Customer will bear all reasonable costs of CloudBlue related to the return or the deletion of the Personal
Data.
11.2 CloudBlue may retain Customer’s Personal Data to the extent required by the applicable laws and for
such period as required by the applicable laws. Notwithstanding the above, when retaining Customer’s
Personal CloudBlue shall ensure the confidentiality of all such Personal Data and shall ensure that such
Personal Data is Processed only as necessary for the purpose(s) specified in the applicable laws requiring its
storage and for no other purpose.
12. INDEMNIFICATION
12.1 Subject to section 13 here below to this Agreement, either Party (“Indemnifying Party”) shall
indemnify and hold the other Party (“Indemnified Party”) harmless from any liability, losses, claims,
penalties, damages, costs and expenses of whatever nature, including administrative fines imposed by the
Supervisory Authority on the Indemnified Party and arising out of any third-party claims, actions, proceedings
or settlements, resulting from the breach or non-compliance of the Indemnifying Party with the terms and
conditions of this Data Processing Agreement and/or with either Party’s respective obligations under the
applicable Data Protection Laws as it relates to the Processing hereunder.
12.2 The Party seeking indemnification agrees to give the Indemnifying Party: (i) prompt written notice of
such claim; (ii) authority to control and direct the defense and/or settlement of such claim; and (iii) such
information and assistance as the Indemnifying Party may reasonably request, at Indemnifying Party’s
expense, in connection with such defense and/or settlement. Notwithstanding the foregoing, the Indemnifying
Party will not settle any third-party claim against the Indemnified Party unless the Indemnified Party provides
its prior written consent to such settlement. In any action that Indemnifying Party provides defense on behalf
of Indemnified Party, Indemnified Party may participate in such defense at its own expense by counsel of its
choice.
13. LIMITATION OF LIABILITY
13.1 In no event will either Party be liable for consequential, exemplary, indirect, special, punitive or
incidental damages arising out of or relating to this Agreement (including liability under any warranty or
remedy in this Agreement).
13.2 In no event will either Party’s liability arising out of or relating to this Agreement, regardless of form
of action, whether in contract, tort, negligence or otherwise, exceed the Fees paid (or in the case of Customer,
payable) by Customer for the Products and/or professional services giving rise to such claim during the twelve
(12) month period prior to the date on which the claim arises.
14. TERMINATION
The Data Processing Agreement will be effective as of the Effective Date of the Cloud Terms which
incorporates by reference this Agreement and shall remain in force during the term of the Cloud Terms. This
Data Processing Agreement will terminate automatically with the termination or expiry of the Cloud Terms.
CONFIDENTIAL AND PROPRIETARY
Page 6 of 16
15. MISCELLANEOUS
15.1 Except as expressly stated otherwise herein, in the event of changes in the Services or applicable Data
Protection Laws which will affect the Processing of the Personal Data and requires the amendment of the Data
Processing Agreement in order for the Parties to be able to address the requirements and comply with the
applicable laws, the Parties will consult with each other in good faith in order to amend the Data Processing
Agreement. Any amendments to this Data Processing Agreement can solely be made in writing by duly
authorized representatives of the Parties.
15.2 If any provision of this Data Processing Agreement is found by any court or administrative body of
competent jurisdiction to be void, invalid, illegal or otherwise unenforceable, all other terms and provisions of
this Data Processing Agreement shall nevertheless remain in full force and effect, and the invalidity or
unenforceability of such provision will not adversely affect the enforceability of any other provision of this
Data Processing Agreement.
15.3 Unless expressly stated otherwise, this version of the Data Processing Agreement is incorporated into
and is subject to the Cloud Terms. In the event of any conflict between the Cloud Terms, including any policies
or schedules referenced therein, and this Data Processing Agreement, the relevant terms of this Data Processing
Agreement shall take precedence.
16. APPLICABLE LAW AND JURISDICTION
16.1 This Data Processing Agreement shall exclusively be governed by and construed in accordance with
the laws governing the Cloud Terms.
16.2 Any dispute, controversy or claim arising out of or in connection with this Data Processing Agreement
or the breach, termination or invalidity thereof shall be settled and submitted to the competent courts as
provided in the Cloud Terms.
CONFIDENTIAL AND PROPRIETARY
Page 7 of 16
Attachment 1
A. Categories of Data Subjects
CloudBlue will process Personal Data regarding the following categories of Data Subjects:
1. Employees of the Customer who have accounts in the Products
2. Representatives of Customer’s resellers, sub-resellers, vendors, distributors or other business partners
who have accounts in the Products
3. End-customers of the Customer, of its resellers and their sub-resellers, who have accounts in the
Products
B. Categories of Personal Data
Personal Data processed by CloudBlue will include:
First Name, Last Name, Address (State / Province, Zip / Postal Code, Country, Street Address), E-Mail,
Phone Number, Fax Number, Username, Tax Identification Number
Where support services are provided: IP addresses, log files, screenshots of errors etc., to the extent any of
the above is considered as Personal Data under the Data Protection Laws or contains Personal Data.
C. Purposes of Processing Personal Data
Personal Data will in any event be processed for the following purposes:
1. To provide the Services under the Cloud Terms, such as provision of the Products, or if applicable
professional services such as managed services, support and maintenance services, growth services etc.
2. To exercise CloudBlue’s rights or to comply with its obligations under this Agreement, the Cloud Terms
or the applicable laws;
D. Cross-Border Data Transfer and Data Processing locations
The Personal Data will be processed in and transferred to the countries listed at
https://www.cloudblue.com/legal/data-privacy/sub-processors/
E. Sub-processors
CloudBlue has contracted the Sub-processors listed at https://www.cloudblue.com/legal/data-privacy/sub-
processors/
F. Retention Period
As necessary for the performance of the Services during the term of the Cloud Terms and as required by
the applicable laws.
G. Contact details
The contact person regarding this Data Processing Agreement is:
CloudBlue:
Name: Ingram Micro Data Protection Team
E-mail address: privacy@ingrammicro.com
CONFIDENTIAL AND PROPRIETARY
Page 8 of 16
Attachment 2
Description of the organizational and technical security measures of CloudBlue in order to protect
Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access and all other forms of unlawful Processing in accordance with applicable Data
Protection Laws.
I. Organization of Information Security.
1) Security Ownership.
CloudBlue has appointed one or more security personnel responsible for coordinating and monitoring
the security rules and procedures.
2) Security Roles and Responsibilities.
CloudBlue personnel with access to Personal Data are subject to confidentiality obligations.
II. Asset Management.
1) Information Assets.
CloudBlue maintains an inventory of Company assets (including Company networks) which are provided
for business use and defines acceptable use for data and assets.
2) Asset Handling.
A. CloudBlue classifies Personal Data to help identify it and to allow for access to be
appropriately restricted (e.g., through encryption).
B. CloudBlue personnel must obtain Customer authorization prior to storing Personal Data on portable
devices or CloudBlue facilities. This includes removing media (e.g., USB sticks and disks)
III. Human Resources Security.
1) Security Training.
CloudBlue provides all personnel with assigned cybersecurity and privacy training to be completed by the
required deadline.
IV. Physical and Environmental Security.
1) Physical Access to Facilities.
CloudBlue limits access to facilities where information systems data are located to identified
authorized individuals for those with justifiable reason to access the controlled area.
2) Protection from Disruptions.
CloudBlue uses a variety of industry standard systems to protect against loss of data due to power
supply failure or line interference.
3) Component Disposal.
CloudBlue uses industry standard processes to delete Personal Data when it is no longer needed.
V. Communications and Operations Management.
1) Operational Policy.
CloudBlue maintains security documents describing its security measures and the relevant procedures
and responsibilities of its personnel who have access to Personal Data.
2) Data Recovery Procedures.
A. CloudBlue stores copies of Personal Data and data recovery procedures in a different place from
where the primary computer equipment processing the Personal Data is located.
B. CloudBlue has specific procedures in place governing access to copies of Personal Data.
C. CloudBlue reviews data recovery procedures at least annually or when there is a significant change
in the infrastructure.
3) Data Beyond Boundaries.
CONFIDENTIAL AND PROPRIETARY
Page 9 of 16
A. CloudBlue encrypts Personal Data that is transmitted over public networks.
4) Event Logging
A. CloudBlue logs the use of data-processing systems.
B. CloudBlue logs access and use of information systems containing Personal Data.
VI. Access Control.
1) Access Authorization.
A. CloudBlue follows a formal authorization and procedure for access to systems and resources.
B. CloudBlue maintains and updates a record of personnel authorized to access CloudBlue systems
that contain Personal Data.
C. CloudBlue deactivates authentication credentials that have not been used for a period of time.
D. CloudBlue ensures that where more than one individual has access to systems containing Personal
Data, the individuals have separate identifiers/log-ins.
2) Least Privilege.
CloudBlue restricts access to Personal Data to only those individuals who require such access to
perform their job function.
3) Integrity and Confidentiality.
A. CloudBlue instructs CloudBlue personnel to disable administrative sessions when leaving premises
CloudBlue controls.
B. CloudBlue stores passwords in a way that makes them unintelligible while they are in force.
4) Authentication.
A. CloudBlue uses industry standard practices to identify and authenticate users who attempt to access
information systems.
B. CloudBlue uses industry standard password protection practices, including practices designed to
maintain the confidentiality and integrity of passwords when they are assigned and distributed, and stored.
C. Where authentication mechanisms are based on passwords, CloudBlue requires that the passwords
management practice follow industry standards.
D. CloudBlue monitors repeated attempts to gain access to the information system using an invalid
password.
E. CloudBlue maintains industry standard procedures to deactivate passwords that have been
corrupted or inadvertently disclosed.
5) Network Design.
CloudBlue has controls to avoid individuals assuming access rights they have not been assigned to
gain access to Personal Data they are not authorized to access.
VII. Information Security Incident Management.
1) Incident Response Process.
A. CloudBlue has an established process for security incident response and a trained team.
B. CloudBlue has established communication protocols which are embedded in the incident response
plan.
VIII. Business Continuity Management.
1) CloudBlue’s redundant storage and its procedures for recovering data are designed to attempt to
reconstruct Personal Data in its original state from before the time it was lost or destroyed.
CONFIDENTIAL AND PROPRIETARY
Page 10 of 16
Attachment 3:
STANDARD CONTRACTUAL CLAUSES
1. Applicable Module: Parties hereby agree that the applicable module of the Standard Contractual Clauses
is the module Controller-Processor.
2. Mandatory provisions under module Controller-Processor of the Standard Contractual Clauses:
Only the mandatory provisions under this module of the Standard Contractual Clauses, as available in the
European Commission’s decision, are binding on the Parties and are considered incorporated herein by
reference.
3. Definitions: Any capitalized terms used herein have the meaning provided to them in the Standard
Contractual Clauses or under the Data Processing Agreement which the Standard Contractual Clauses are
incorporated in by reference.
4. Specific choice of the Parties and optional provisions under the module Controller-Processor of the
Standard Contractual Clauses:
4.1 Clause 7 “Docking clause”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, the optional clause 7 “Docking clause” of the Standard Contractual Clauses
will not be used.
4.2 Clause 9 “Use of sub-processors”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, the applicable option under clause 9 a) of module Controller-Processor of
the Standard Contractual Clauses will be option 2 “General Written Authorization” with at least 30 (thirty)
days advance notice. In such event, clause 9 a) will read as follows:
“a) The data importer has the data exporter’s general authorisation for the engagement of sub-
processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing
of any intended changes to that list through the addition or replacement of sub-processors at least 30
(thirty) days in advance, thereby giving the data exporter sufficient time to be able to object to such
changes prior to the engagement of the sub-processor(s). The data importer shall provide the data
exporter with the information necessary to enable the data exporter to exercise its right to object.”
4.3 Clause 11 “Redress”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, the optional provisions under clause 11 a) will not apply between the Parties
and clause 11 a) will then read as follows:
“a) The data importer shall inform data subjects in a transparent and easily accessible format, through
individual notice or on its website, of a contact point authorised to handle complaints. It shall deal
promptly with any complaints it receives from a data subject.”
4.4 Clause 13 “Supervision”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, the option under clause 13 a) which is applicable between the Parties will
vary depending on the Customer case. Customer will inform CloudBlue separately in writing of the
applicable option.
4.5 Clause 17 “Governing Law”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, the applicable option under clause 17 is Option 1. In such event clause 17
will read as follows:
“These Clauses shall be governed by the law of one of the EU Member States, provided such law allows
for third- party beneficiary rights. The Parties agree that this shall be the law of the Netherlands.”
CONFIDENTIAL AND PROPRIETARY
Page 11 of 16
4.6 Clause 18 “Choice of forum and jurisdiction”:
Parties hereby agree that for the purpose of the Standard Clause Clauses incorporated by reference in this
Data Processing Agreement, clause 18 b) will read as follows:
“b) The Parties agree that those shall be the courts of Amsterdam, the Netherlands.”
5. Appendix Information:
The Appendix Information means the information which must be provided in the relevant Annexes of the
Standard Contractual Clauses incorporated by reference under this Data Processing Agreement.
5.1 Annex 1A “List of Parties”:
Parties agree that the information under Annex 1A “List of Parties” of the Standard Contractual Clauses
incorporated by reference under this Data Processing Agreement will read as follows:
“Data exporter(s):
Name: Customer identified under the CloudBlue Cloud Platform Order Form
Address: Customer address identified under the CloudBlue Cloud Platform Order Form
Contact person’s name, position and contact details: As provided under the Cloud Terms
Activities relevant to the data transferred under these Clauses: For the provision of the Services provided
by Processor to Controller pursuant to the Cloud Terms as defined under the Data Processing Agreement
which these Clauses are attached to
Role (controller/processor): Controller
Data importer(s):
Name: CloudBlue LLC
Address: 3351 Michelson Drive, Suite 100, Irvine, CA 92612, United States of America
Contact person’s name, position and contact details: Ingram Micro Data Protection team at
privacy@ingrammicro.com
Activities relevant to the data transferred under these Clauses: For the provision of the Services provided
by Processor to Controller pursuant to the Cloud Terms as defined under the Data Processing Agreement
which these Clauses are attached to
Role (controller/processor): Processor
5.2 Annex 1B “Description of Transfer”:
Parties agree that the information under Annex 1B “Description of Transfer” of the Standard Contractual
Clauses incorporated by reference under this Data Processing Agreement will read as follows:
“1. Categories of data subjects whose personal data is transferred: The data subjects are those
identified under section A “Categories of Data Subjects” of the Attachment 1 of the Data Processing
Agreement which these Clauses are incorporated into by reference.”
2. Categories of personal data transferred: The personal data transferred is the data identified under
section B “Categories of Personal Data” of the Attachment 1 of the Data Processing Agreement which
these Clauses are incorporated into by reference.
3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose limitation,
access restrictions (including access only for staff having followed specialised training), keeping a record
of access to the data, restrictions for onward transfers or additional security measures.: Not applicable,
unless explicitly advised and instructed thereto by Customer
4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):
Continuous basis as required in connection with the provision and receipt of the Services as defined under
the Data Processing Agreement which these Clauses are incorporated into by reference.
CONFIDENTIAL AND PROPRIETARY
Page 12 of 16
5. Nature of the processing: The personal data transferred will be subject to the processing activities
identified in the Cloud Terms and the Data Processing Agreement, which these Clauses are attached to,
in particular collection, storage, recording, hosting, use, deletion, disclosure by transmission,
dissemination or otherwise making it available and such other processing as is strictly necessary for the
purposes identified in the Data Processing Agreement which these Clauses are attached to, in particular
to provide the Services in accordance with applicable data protection laws;
6. Purpose(s) of the data transfer and further processing: The purposes of the data transfer are identified
under section C “Purposes of Processing of the Personal Data” of Attachment 1 of the Data Processing
Agreement which these Clauses are incorporated into by reference.
7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to
determine that period: As provided under section F “Retention Period” of Attachment 1 of the Data
Processing Agreement which these Clauses are incorporated into by reference.
8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:
As provided under section 5, 6 and 7 of Annex 1B.”
5.3 Annex 1C “Competent Supervisory Authority”:
Parties agree that the information required under Annex 1C “Competent Supervisory Authority” of the
Standard Contractual Clauses incorporated by reference into the Data Processing Agreement will be
provided by Customer to CloudBlue in accordance with Clause 13.
5.4 Annex II “Technical and organisational measures including technical and organizational measures
to ensure the security of the data”:
Parties agree that the information required under Annex II of the Standard Contractual Clauses
incorporated by reference into the Data Processing Agreement will read as follows:
“The technical and organizational measures are provided under Attachment 2 of the Data Processing
Agreement which these Clauses are incorporated into by reference.”
5.5 Annex III “List of Sub processors”:
Parties agree that the information required under Annex III “List of Sub processors” of the Standard
Contractual Clauses incorporated by reference under the Data Processing Agreement will read as follows:
“Authorized sub-processors are provided under Attachment 1 of the Data Processing Agreement which
these Clauses are incorporated into by reference. Upon signing these Clauses, data exporter provides its
approval to the use of the sub-processors listed under Attachment 1 of the Data Processing Agreement
which these Clauses are incorporated into by reference.”
CONFIDENTIAL AND PROPRIETARY
Page 13 of 16
Attachment 4 –
UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data
Protection Act 2018
VERSION B1.0, in force 21 March 2022
This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers.
The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers
when it is entered into as a legally binding contract.
Part 1: Tables
Table 1: Parties
Start date The effective date of the Data Processing Agreement which this Addendum and
the Addendum EU SCCs are appended to.
Exporter (who sends the Restricted Importer (who receives the
The Parties
Transfer) Restricted Transfer)
Parties’ details Full legal name: Customer identified Full legal name: CloudBlue LLC
under the CloudBlue Cloud Platform
Trading name (if different):
Order Form
Main address (if a company registered
Trading name (if different):
address): 3351 Michelson Drive, Suite
Main address (if a company registered 100, Irvine, CA 92612, United States of
address): Customer address identified America
under the CloudBlue Cloud Platform
Official registration number (if any)
Order Form
(company number or similar identifier):
Official registration number (if any) 201911510281
(company number or similar identifier):
Key Contact Full Name (optional): As provided Full Name (optional):
under the Cloud Terms
Job Title: Ingram Micro Data
Job Title: Protection team
Contact details including email: As Contact details including email:
provided under the Cloud Terms privacy@ingrammicro.com
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs The version of the Approved EU SCCs which this Addendum is appended to,
detailed below, including the Appendix Information:
Date: Effective date of the Addendum EU SCCs listed under Attachment 3 of the
Data Processing Agreement which this Addendum and the Addendum EU SCCs
are appended to.
Reference (if any): The Addendum EU SCCs including the Appendix Information
are available under Attachment 3 to the Data Processing Agreement which they
and this Addendum are appended to. For clarity the applicable module of the
Addendum EU SCCs is Controller-Processor.
Other identifier (if any):
CONFIDENTIAL AND PROPRIETARY
Page 14 of 16
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out
in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out
in:
Annex 1A: List of Parties: The parties are described under Annex 1A of the Addendum EU SCCs which are
available as Attachment 3 of the Data Processing Agreement which the Addendum EU SCCs and this
Addendum are attached to. For the avoidance of doubt, Customer acting as Exporter under this Addendum and
the Addendum EU SCCs is Controller of the personal data, where CloudBlue LLC acting as importer under
this Addendum and the Addendum EU SCCs is Processor of Customer.
Annex 1B: Description of Transfer: The relevant information is provided under Annex 1B of the Addendum
EU SCCs which are available as Attachment 3 of the Data Processing Agreement which the Addendum EU
SCCs and this Addendum are attached to.
Annex II: Technical and organisational measures including technical and organisational measures to ensure
the security of the data: The technical and organizational measures are provided under Annex 2 of the
Addendum EU SCCs which are available as Attachment 3 of the Data Processing Agreement which the
Addendum EU SCCs and this Addendum are attached to.
Annex III: List of Sub processors (Modules 2 and 3 only): Authorized sub-processors are provided under
Annex 3 of the Addendum EU SCCs which are available as Attachment 3 of the Data Processing Agreement
which the Addendum EU SCCs and this Addendum are attached to.
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Which Parties may end this Addendum as set out in Section 19:
Addendum when
Importer
the Approved
Addendum Exporter
changes neither Party
Part 2: Mandatory Clauses
Mandatory Clauses Part 2: Mandatory Clauses of the Approved Addendum, being the template
Addendum B.1.0 issued by the ICO and laid before Parliament in accordance
with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised
under Section 18 of those Mandatory Clauses.
CONFIDENTIAL AND PROPRIETARY
Page 15 of 16
Attachment 5
Swiss Addendum
This Swiss Addendum forms part of and is incorporated into the Standard Contractual Clauses and the Data
Processing Agreement which it is attached to.
Capitalized terms not defined herein (if any) have the meanings ascribed to them in the Data Processing
Agreement which this Swiss Addendum is appended to.
Where a Data Transfer affects Personal Data originating from Switzerland and to which the FADP applies,
Parties agree that the Standard Contractual Clauses shall be deemed to be amended to the extent necessary to
operate to provide appropriate safeguards for such transfers in accordance with the FADP, including without
limitation the following:
(i) the term “personal data” shall be deemed to include the data of legal entities to the extent such data is
protected under the FADP, and terms used in the Standard Contractual Clauses as defined in the GDPR
will be construed to include the terms as construed under the FDPA;
(ii) references to the term “member state” will be construed to include Switzerland;
(iii) references to the law of the European Union are construed to include a reference to the laws of Switzerland
and the Swiss Federal Data Protection Act (FDPA);
(iv) the Federal Data Protection and Information Commissioner will be “competent supervisory authority”
with regards to Personal Data subject to the FDPA in parallel to the competent authority in the EEA for
transfers subject to the GDPR;
(v) where a Data Transfer is subject to the FPDA only, the Standard Contractual Clauses will be governed by
Swiss law, the courts of Zurich will be considered competent courts under Clauses 17 and 18 of the
Standard Contractual Clauses.
CONFIDENTIAL AND PROPRIETARY
Page 16 of 16