Snapshot 10959
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
This Data Processing Addendum, which includes the documents referenced herein, (together the “Addendum”) forms part of the Enterprise Services Agreement,
Subscription Services Agreement or other written or electronic agreement between Liferay and Customer referring to this Addendum for the purchase of certain
services from Liferay (identified either as “Services” or otherwise in the applicable agreement, and hereinafter defined as “Services”) including any applicable
appendices (the “Agreement”) to reflect the parties’ agreement with regard to the Processing of Personal Data. Liferay and Customer enter into this Addendum
acting on its own behalf and as an agent for its respective Affiliates subject to Section 13 of this Addendum. While the Parties acknowledge that the precise Data
Protection Laws that apply to the Processing will depend on the nature of such Processing and Personal Data affected, the Parties agree that, unless otherwise
expressly agreed in this Addendum, this Addendum applies to the Processing irrespective of whether the GDPR, the UK GDPR, LGPD or any other Data Protection
Law applies. Any capitalized terms used but not defined in this Addendum have the meanings ascribed to them in the Agreement. Except as modified below, the
terms of the Agreement shall remain in effect.
1. Definitions
"Applicable Laws" means (i) European Union or Member State laws with respect to any Customer Personal Data in respect of which any Customer Group Member
is subject to EU Data Protection Laws; and (ii) any other applicable law with respect to any Customer Personal Data in respect of which any Customer Group
Member is subject to any other Data Protection Laws, including for example and without limiting the generality of the foregoing, the LGPD and UK GDPR.
"Affiliate" (of Customer or of Liferay or of both as designated in this Addendum) means unless otherwise defined in the Agreement, an entity that owns or controls,
is owned or controlled by or is or under common control or ownership with the designated party (Customer or Liferay), where control is defined as the possession,
directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by
contract or otherwise.
"Customer Group Member" means Customer or any Customer Affiliate.
"Commission" shall have the same meaning as in the GDPR.
"Contracted Processor" means Liferay or a Subprocessor.
"Customer Personal Data" means any Personal Data Processed by a Contracted Processor on behalf of a Customer Group Member pursuant to or in connection
with the Agreement.
"Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country, including for
example and without limiting the generality of the foregoing, the LGPD and UK GDPR.
"Data Subject" means an identified or identifiable natural person who is the subject of Personal Data.
"EEA" means the European Economic Area.
"EU Data Protection Laws" means the GDPR as amended, replaced or superseded from time to time and laws implementing or supplementing the GDPR.
"GDPR" means EU General Data Protection Regulation 2016/679, as amended, superseded, or replaced from time to time.
“LGPD” means the Brazilian General Data Protection Law, Federal Law no. 13,709/2018, as amended, superseded, or replaced from time to time.
"Member State” shall have the same meaning as in the GDPR.
“Data Privacy Framework” means the EU-U.S. and/or Swiss-U.S. Data Privacy Framework Certification Program, and/or the UK Extension to the EU-U.S. Data
Privacy Framework operated by the US Department of Commerce.
“Data Privacy Framework Principles” means the Data Privacy Framework Principles (as supplemented by the Supplemental principles) contained in Schedule II
to the European Commission Decision C(2016)4176 of July 12, 2016 (as may be amended, superseded or replaced from time to time).
"Personal Data” means any information relating to an identified or identifiable natural person, where an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to,
personal data transmitted, stored or otherwise processed.
“Processing" means any operation or set of operations which is performed upon Personal Data or sets of Personal Data, whether or not by automated means, such
as collection, recording, organization, structuring, storage adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure or destruction.
Page 1 of 9
3002310_GL_EN
Data Processing Addendum
"Restricted Transfer" means (i) a transfer of Customer Personal Data from any Customer Group Member to a Contracted Processor; or (ii) an onward transfer of
Customer Personal Data from a Contracted Processor to a Contracted Processor, or between two establishments of a Contracted Processor, in each case (i) and (ii),
where such transfer would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions
of Data Protection Laws) in the absence of the Standard Contractual Clauses for data transfers to be established under section 6.4 (iii) or 12 below; For the
avoidance of doubt, without limitation to the generality of the foregoing, the parties to this Addendum intend that where a transfer of Personal Data is of a type
authorized by Data Protection Laws in the exporting country, such transfer shall not be a Restricted Transfer (for example in the case of transfers from within the
European Union to a country (such as Switzerland) or scheme (such as Data Privacy Framework) which is approved by the Commission as ensuring an adequate
level of protection or any transfer which falls within a permitted derogation).
"Services" means the services to be supplied to or carried out by or on behalf of Liferay for Customer Group Members pursuant to the Agreement.
" Standard Contractual Clauses " means (a) for purposes of Restricted Transfers subject to Chapter V GDPR, the contractual clauses, relevant module, published
by the European Commission, reference 2021/914 (“EU SCC”); and/or (b) for purposes of Restricted Transfers subject to Chapter V of UK GDPR, International Data
Transfer Addendum to the EU Commission Standard Contractual Clauses VERSION B1.0, in force as of 21 March 2022, published by the Information Commissioner’s
Office (“UK Amendment”), for purposes of Restricted Transfers from Customer to Liferay both (a) and/or (b), as applicable, implemented as set forth in Section 12.3.
"Subprocessor" means any person (including any third party and any Liferay Affiliate but excluding an employee of Liferay or any of its sub-contractors) appointed
by or on behalf of Liferay or any Liferay Affiliate to Process Personal Data on behalf of any Customer Group Member in connection with the Agreement.
"Supervisory Authority" shall have the same meaning as in the GDPR or as defined in the applicable Data Protection Law.
“UK” means the United Kingdom.
“UK GDPR” means GDPR as amended and incorporated into UK law under the European Union (Withdrawal) Act 2018, as amended, superseded, or replaced from
time to time.
2. Authority
Liferay represents and warrants that before any Liferay Affiliate Processes any Customer Personal Data on behalf of any Customer Group Member, Liferay's entry
into this Addendum as an agent for and on behalf of that Liferay Affiliate will have been duly and effectively authorized (or subsequently ratified) by that Liferay
Affiliate.
3. Processing of Customer Personal Data
3.1 Liferay and each Liferay Affiliate shall (i) comply with all applicable Data Protection Laws in the Processing of Customer Personal Data; and (ii) not Process
Customer Personal Data other than on the relevant Customer Group Member’s documented instructions unless Processing is required by Union or Member State or
other Applicable Laws to which the relevant Contracted Processor is subject, in which case Liferay or the relevant Liferay Affiliate shall, to the extent permitted by
Applicable Laws, inform the relevant Customer Group Member of that legal requirement before the relevant Processing of that Personal Data, unless that law
prohibits such information on important grounds of public interest.
3.2 Each Customer Group Member (i) instructs Liferay and each applicable Liferay Affiliate (and authorizes Liferay and each such Liferay Affiliate to instruct each
Subprocessor) to Process Customer Personal Data; and in particular, transfer Customer Personal Data to any country or territory, as reasonably necessary for the
provision of the Services and consistent with the Agreement; (ii) warrants and represents that it is and will at all relevant times remain duly and effectively
authorized to give the instruction set out in Section 3.2 (i) on behalf of each relevant Customer Affiliate and (iii) shall have sole responsibility for the accuracy,
quality, and legality of Personal Data and the means by which Customer Group Member acquired Personal Data.
3.3 Schedule 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Customer Personal Data as required by article
28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Customer may make reasonable amendments to Schedule 1 by written
notice to Liferay from time to time as Customer reasonably considers necessary to meet those requirements. Nothing in Schedule 1 (including as amended
pursuant to this Section 3.3) confers any right or imposes any obligation on any party to this Addendum.
4. Liferay and Liferay Affiliate Personnel
Liferay and each Liferay Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may
have access to the Customer Personal Data, ensuring in each case that access is limited to those individuals who need to know and/or need to access the relevant
Customer Personal Data, as necessary for the purposes of the Agreement and to comply with Applicable Laws in the context of that individual's duties to the
Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality and
that Personal Data is not Processed except on instructions from the Customer, unless he or she is required to do so by Applicable Law.
5. Security
5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying
likelihood and severity for the rights and freedoms of natural persons, Liferay and each Liferay Affiliate shall in relation to the Customer Personal Data implement
appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in
Article 32(1) of the GDPR and the Technical Organizational Measures set forth in Schedule 2 (or, for any Services not explicitly mentioned in this Schedule, in the
document outlining the agreed scope of the Services). Customer acknowledges that the Technical Organizational Measures are subject to technical progress and
Page 2 of 9
3002310_GL_EN
Data Processing Addendum
development and that Liferay may update or modify the Technical Organizational Measures from time to time provided that such updates and modifications do
not result in the degradation of the overall security of the Service provided to Customer and Customer authorizes any such update or modification.
5.2 In assessing the appropriate level of security, Liferay and each Liferay Affiliate shall account for, in particular, the risks that are presented by Processing, in
particular from a Personal Data Breach.
5.3 Customer acknowledges and agrees that (i) Liferay is not in a position to comprehensively assess the appropriateness of measures relative to the Customer’s
Personal Data as such data is Processed for Customer’s and not Liferay’s business, (ii) Customer has assessed these specifically agreed measures and (iii) as
between Customer and Liferay, Customer is responsible to data subjects and supervisory authorities if the agreed measures do not meet the legally required
standard of appropriateness with respect to the Customer Data.
5.4 Notwithstanding the above, Customer agrees that except as provided by this Addendum or the Agreement, Customer is responsible for its secure use of the
Services, including securing its account authentication credentials, protecting the security of Customer Personal Data when in transit to and from the Services and
taking any appropriate steps to securely encrypt or backup any Customer Personal Data uploaded to the Services.
6. Subprocessing
6.1 Each Customer Group Member authorizes Liferay and each Liferay Affiliate to appoint (and permit each Subprocessor appointed in accordance with this Section 6
to appoint) Subprocessors in accordance with this Section 6 and subject to any restrictions in the Agreement.
6.2 Liferay and each Liferay Affiliate may continue to use a Subprocessor already engaged by Liferay or any Liferay Affiliate as at the effective date of this Addendum,
subject to Liferay and each Liferay Affiliate meeting the obligations set out in Section 6.4 as soon as practicable. Liferay makes available a list of all Subprocessors
used for the Processing of Personal Data under this Addendum at https://www.liferay.com/legal/cloud-services-data (or, for any Services not explicitly listed under
this link, in the document outlining the agreed scope of the Services) and also available upon request to dataprotection@liferay.com. Liferay shall update the list
on its website of any Subprocessor to be appointed at least twenty (20) days prior to the date on which the Subprocessor shall commence Processing Personal
Data and will notify Customer of such change specifying the location of the Subprocessor and type of Processing of Customer Personal Data conducted by such
Subprocessor via email notification to the email address associated with the applicable Customer account.
6.3 Liferay shall give Customer prior notice of the appointment of any new Subprocessor as described in Section 6.2. If, within ten (10) calendar days of receipt of that
notice, Customer notifies Liferay in writing of any objections (on reasonable grounds) to the proposed appointment neither Liferay nor any Liferay Affiliate shall
appoint (or disclose any Customer Personal Data to) that proposed Subprocessor until reasonable steps have been taken to address the objections raised by any
Customer Group Member and Customer has been provided with a reasonable written explanation of the steps taken. Where Liferay cannot address the objections
in a commercially reasonable manner within a thirty (30) days from Liferay's receipt of Customer's notice, notwithstanding anything in the Agreement, Customer
may either (i) decide to use the Services as proposed by Liferay or (ii) by written notice to Liferay with immediate effect terminate the Agreement to the extent that
it relates to the Services which require the use of the proposed Subprocessor and receive a prorated refund of any prepaid Fees for unused Services as of the
effective date of such termination.
6.4 With respect to each Subprocessor, Liferay or the relevant Liferay Affiliate shall:
(i) before the Subprocessor first Processes Customer Personal Data (or, where relevant, in accordance with Section 6.2), carry out adequate due diligence to
ensure that the Subprocessor is capable of providing the level of protection for Customer Personal Data required by the Agreement;
(ii) undertake that the arrangement between, on the one hand, (a) Liferay, or (b) the relevant Liferay Affiliate, or (c) the relevant intermediate Subprocessor; and
on the other hand, the Subprocessor, is governed by a written contract including terms which offer at least substantially the same level of protection for
Customer Personal Data as those set out in this Addendum and meet the requirements of article 28(3) of the GDPR;
(iii) intentionally omitted.
(iv) where that arrangement involves a Restricted Transfer from the EEA or UK, ensure that the relevant SCC are incorporated into the agreement between, on the
one hand, (a) Liferay or (b) the relevant Liferay Affiliate, or (c) the relevant intermediate Subprocessor entering into the SCCas a “data exporter(s)” and, on the
other hand, the Subprocessor as “data importer(s)” as set forth in section 12.3 below; and
(v) upon request by Customer, provide to Customer information about any Subprocessor in form of a summary or copy of the applicable contractual terms with
such Subprocessor (which may be redacted to remove confidential commercial information not relevant to the requirements of this Addendum), if required by
Applicable Laws.
6.5 Liferay and each Liferay Affiliate ensures that each Subprocessor performs the obligations under sections 3.1, 4, 5, 7.1, 8.2, 9 and 11.1, as they apply to Processing
of Customer Personal Data carried out by that Subprocessor, as if it were party to this Addendum in place of Liferay. Liferay and the relevant Affiliate shall be liable
for the acts and omissions of its Subprocessors to the same extent Liferay or the relevant Liferay Affiliate would be liable if performing the Services of each
Subprocessor directly under the terms of this Addendum, save as otherwise set forth in the Agreement.
7. Data Subject Rights
7.1 Taking into account the nature of the Processing, Liferay and each Liferay Affiliate shall assist each Customer Group Member by implementing appropriate
technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer Group Members' obligations, as reasonably understood by
Customer, to respond to requests from Data Subjects exercising their rights under the Applicable Laws. Additionally, to the extent the Customer Group Member, in
its use of the Services, does not have the ability to address a Data Subject request, Liferay and each applicable Liferay Affiliate shall, upon Customer Group
Member’s written request, assist the Customer Group Member, within commercially reasonable means, to respond to such Data Subject request, to the extent
Page 3 of 9
3002310_GL_EN
Data Processing Addendum
Liferay or the Liferay Affiliate are legally permitted to do so and the response to such Data Subject request is required under Applicable Laws. To the extent legally
permitted, Customer Group Member shall be responsible for any costs arising from Liferay’s or Liferay Affiliate’s provision of such assistance.
7.2 Liferay shall (i) promptly notify Customer if any Contracted Processor receives a request from a Data Subject pursuant to Applicable Laws in respect of Customer
Personal Data; and (ii) ensure that the Contracted Processor does not respond to that request except (i) on the documented instructions of Customer or the
relevant Customer Affiliate or (ii) as required by Applicable Laws to which the Contracted Processor is subject, in which case Liferay shall to the extent permitted by
Applicable Laws inform Customer of that legal requirement before the Contracted Processor responds to the request.
8. Personal Data Breach
8.1 Liferay shall notify Customer without undue delay upon Liferay becoming aware of a Personal Data Breach affecting Customer Personal Data Processed by Liferay
or any Subprocessor, via an email to the email address identified by the Customer for purposes of security notifications or, if no such contact has been identified by
the Customer, to the email address associated with the applicable Designated Contacts, providing Customer with sufficient information to allow each Customer
Group Member to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws. Such notification shall as a
minimum (i) describe the nature of the Personal Data Breach, the categories and numbers of Data Subjects concerned, and the categories and numbers of Personal
Data records concerned; (ii) communicate the name and contact details of Liferay's data protection officer or other relevant contact from whom more information
may be obtained; (iii) describe the likely consequences of the Personal Data Breach; and (iv) describe the measures taken or proposed to be taken to address the
Personal Data Breach.
8.2 Liferay shall co-operate with Customer and each Customer Group Member and take such commercially reasonable steps as are directed by Customer to assist in
the investigation, mitigation and remediation of each Personal Data Breach subject to this Section 8.
9. Data Protection Impact Assessment and Prior Consultation
Liferay and each Liferay Affiliate shall provide reasonable assistance to each Customer Group Member with any data protection impact assessments, and prior
consultations with Supervising Authorities or other competent data privacy authorities, which Customer reasonably considers to be required of any Customer
Group Member by Article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Customer
Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.
10. Deletion or return of Customer Personal Data
10.1 Subject to sections 10.2, 10.3 and 10.4 and upon the termination or expiration of Customer’s access to and use of any Services involving the Processing of Customer
Personal Data (the "Cessation Date"), Liferay will permit Customer to export its Personal Data, at its expense, in accordance with the capabilities of the Services as
specified in the Agreement. Following such period Liferay and each Liferay Affiliate shall promptly delete and procure the deletion of all copies of those Customer
Personal Data.
10.2 Subject to section 10.4, Customer may in its absolute discretion by written notice to Liferay within fourteen (14) days of the Cessation Date require Liferay and each
Liferay Affiliate to (i) return a complete copy of all Customer Personal Data to Customer by secure file transfer in such format as is reasonably notified by Customer
to Liferay, provided that if the Services allow Customer to export the Customer Personal Data Liferay may refer Customer to such functionality in order to meet its
obligations under this Subsection (i) ; and (ii) delete and procure the deletion of all other copies of Customer Personal Data Processed by any Contracted Processor.
Liferay and each Liferay Affiliate shall promptly comply with any such written request.
10. 3 Subject to section 10.4, to the extent a Services offering that involves Processing of Customer Personal Data by Liferay does not include any storage of Customer
Personal Data in any systems usually accessible to the Customer (such as for example professional services or managed services), within thirty (30) days of
termination of such Services, and/or of Customer’s written request, Liferay will delete Customer Personal Data provided by the Customer to Liferay for purposes of
such Services.
10.4 Each Contracted Processor may retain Customer Personal Data to the extent required by Applicable Laws and only to the extent and for such period as required by
Applicable Laws and always provided that Liferay and each Liferay Affiliate shall ensure the confidentiality of all such Customer Personal Data and shall ensure that
such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the Applicable Laws requiring its storage and for no other purpose.
10.5 Upon Customer’s request, Liferay shall promptly provide written certification to Customer that it and each Liferay Affiliate has fully complied with this Section 10.
11. Audit rights
11.1 Subject to Sections 11.2 to 11.4, Liferay and each Liferay Affiliate shall make available to a Customer Group Member, upon written request, all information
necessary to demonstrate compliance with this Addendum, including Contracted Processor’s records of Processing of Customer Personal Data conducted on
behalf of the Customer, and shall allow for and contribute to audits, including inspections, by any Customer Group Member or an auditor mandated by any
Customer Group Member in relation to the Processing of the Customer Personal Data by the Contracted Processors.
11.2 Information and audit rights of the Customer Group Members only arise under section 11.1 to the extent that the Agreement does not otherwise give them
information and audit rights meeting the relevant requirements of Data Protection Law (including, where applicable, Article 28(3)(h) of the GDPR).
Page 4 of 9
3002310_GL_EN
Data Processing Addendum
11.3 Customer or the relevant Customer Affiliate undertaking an audit shall give Liferay and the relevant Liferay Affiliate(s) reasonable notice of any audit or inspection
to be conducted under section 11.1 and shall make (and ensure that each of its mandated auditors makes) reasonable endeavors to avoid causing (or, if it cannot
avoid, to minimize) any damage, injury or disruption to the Contracted Processors' premises, equipment, personnel and business while its personnel are on those
premises in the course of such an audit or inspection. A Contracted Processor need not give access to its premises for the purposes of such an audit or inspection:
(i) to any individual unless he or she produces reasonable evidence of identity and authority;
(ii) outside normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis and Customer or the relevant
Customer Affiliate undertaking an audit has given notice to Liferay or the relevant Liferay Affiliate that this is the case before attendance outside those hours
begins; or
(iii) for the purposes of more than one audit or inspection, in respect of each Contracted Processor, in any 12-month period, except for any additional audits or
inspections which (a) Customer or the relevant Customer Affiliate undertaking an audit reasonably considers necessary because of genuine concerns as to
Liferay's or the relevant Liferay Affiliate’s compliance with this Addendum; or (b) A Customer Group Member is required or requested to carry out by Data
Protection Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Laws in any country or territory,
in both cases (a) and (b) where Customer or the relevant Customer Affiliate undertaking an audit has identified its concerns or the relevant requirement or
request in its notice to Liferay or the relevant Liferay Affiliate of the audit or inspection.
11.4 If the requested audit scope is addressed in a SOC 2 Type I or similar certification or report performed by a qualified third party auditor within the prior twelve
months of such certification and Liferay or Liferay Affiliate, as applicable, confirms that there are no known material changes in the controls audited, Customer or
Customer Affiliates agrees to accept those findings in lieu of requesting an audit of the controls covered by the report to the extent it can reasonably do so under
Applicable Law.
12. International Transfers
12.1 Customer acknowledges that Liferay and its Subprocessors may maintain data processing operations in countries that are outside the EEA, UK and Switzerland. As
such, Liferay and Subprocessors may process Personal Data in non-EEA, non-UK and non-Swiss countries. This will apply even where Customer and Liferay have
agreed to host Personal Data in the EEA, if such non-EEA processing is necessary to provide support-related or other services requested by Customer.
12.2 Data Privacy Framework
Where a Customer Group Member is self-certified to the Data Privacy Framework and transfers Personal Data from the EEA, UK or Switzerland to Liferay or a Liferay
Affiliate, Customer or respectively the Customer Group Member is obliged under the terms of the Data Privacy Framework to flow down the following requirements
and Liferay or Liferay Affiliate, as applicable, hereby agrees: (i) to provide at least the same level of protection to such Personal Data as is required by the Data
Privacy Framework Principles; (ii) to notify Customer if it makes a determination that it no longer can meet its obligation to provide the same level of protection to
such Personal Data as is required by the Data Privacy Framework Principles; and (iii) upon notice, including under 12.2(ii), to work with Customer to take
reasonable and appropriate steps to stop and remediate any unauthorized Processing of the Personal Data.
12. 3 Restricted Transfers from Customer to Liferay
12.3.1 Subject to section 12.3.2, if applicable, before commencing a Restricted Transfer to Liferay, Customer shall (as "data exporter") fill in, execute and provide to
Liferay the SCC available for download at www.liferay.com/legal, as applicable to the relevant Restricted Transfer or a series of Restricted Transfers, and
Liferay will execute (as "data importer") and return a fully executed copy or fully executed copies, as applicable, to the Customer. .
12.3.2 Section 12.3 shall not apply to a Restricted Transfer unless its effect, together with other reasonably practicable compliance steps (which, for the avoidance of
doubt, do not include obtaining consents from Data Subjects), is to allow the relevant Restricted Transfer to take place without breach of applicable Data
Protection Law.
12.3.3 The Parties understand and agree that any SCC eventually established between the Parties in accordance with Sec. 12.3.1 above shall terminate if and as soon
as a Restricted Transfer ceases to qualify as a Restricted Transfer due to an authorization under the Data Protection Laws in the exporting country.
12.4 Restricted (Onward) Transfers from the EEA and UK
12.4.1 Liferay represents and warrants that, before the commencement of any Restricted Transfer from the EEA or UK, for the purposes of each Restricted Transfer,
Liferay and, if and where applicable, each Liferay Affiliate (acting as “data exporter”) will enter into the SCC with each concerned Subprocessor (acting as “data
importer”).
12.4.2 Liferay will furthermore ensure that, before the commencement of any Restricted Transfer from the EEAby a Subprocessor (“acting as §data exporter”), for the
purposes of each Restricted Transfer, each Subprocessor will enter into the EU SCCwith any of its concerned Subprocessors (acting as “data importers”).
12.4.3 Parties understand and agree that entering into the SCC shall not require the parties to physically sign a copy of the SCC. The parties may enter into the SCC by
way of incorporation or a reference in any agreement(s) between the parties relating to the Processing.
12.4.4 For clarification, the SCC will be implemented in accordance with the agreements as between the Parties in this Addendum. For example, where this
Addendum further specifies audit or certification provisions or Customer authorizes use of Subprocessor subject to specific rules, such specifications will be
applied in relation to the SCC.
Page 5 of 9
3002310_GL_EN
Data Processing Addendum
13. Affiliates
13.1 Liferay and Customer enter into this Agreement acting on its own behalf and as an agent for its respective Affiliates if and to the extent that (i) such Affiliates are not
the party to an Order Form under the Agreement and therefore not “Liferay” or “Customer” as defined under the Agreement and (ii) the Affiliate of Liferay is an
obliged party under the Agreement and (iii) the Affiliate of Customer is permitted to use the Services pursuant to the Agreement between Customer and Liferay
Processes Personal Data for which such Affiliates qualify as the Controller
13.2 If and to the extent that Affiliates become party to this Addendum the parties hereby establish a separate Addendum between each Liferay Affiliate and each
Customer Affiliate subject to the provisions of the Agreement and this Section 13 and for the purposes of such Addendum such Affiliates shall be deemed
“Customer” and “Liferay” respectively. Each Affiliate agrees to be bound by the obligations under this Addendum and, to the extent applicable, the Agreement. For
the avoidance of doubt, an Affiliate is only a party to this Addendum and is not and does not become a party to the Agreement other than for the purposes of the
Processing of Personal Data according to this Addendum. All access to and use of the Services by Customer Affiliates must comply with the terms and conditions of
the Agreement, and any violation of the terms and conditions of the Agreement by a Customer Affiliate shall be deemed a violation by Customer.
13.3 Where a Customer Affiliate becomes a party to this Addendum, it shall to the extent required under Applicable Laws be entitled to exercise the rights and seek
remedies under this Addendum, subject to the following:
13.3.1 Except where Applicable Laws require the Customer Affiliate to exercise a right or seek any remedy under this Addendum against Liferay or a Liferay Affiliate
directly by itself, the parties agree that (i) solely the Customer that is the contracting party to the Agreement (including any Order Form) shall exercise any such
right or seek any such remedy on behalf of the Customer Affiliate, and (ii) the Customer that is the contracting party to the Agreement (including any Order
Form) shall exercise any such rights under this Addendum not separately for each Customer Affiliate individually but in a combined manner for all of its
Customer Affiliates together (as set forth, for example, in Section 13.3.2 below).
13.3.2 The Customer that is the contracting party to the Agreement shall, when carrying out an on-site audit of the procedures relevant to the protection of Personal
Data, take all reasonable measures to limit any impact on Liferay and its Subprocessors by combining, to the extent reasonably possible, several audit requests
carried out on behalf of different Customer Affiliates in one single audit.
13.4 The Customer that is the contracting party to the Agreement (including any Order Form) shall remain responsible for coordinating all communication under this
Addendum with Liferay or the applicable Liferay Affiliate that is the contracting party to the Agreement (including any Order Form) and shall be entitled to make
and receive any communication in relation to this Addendum on behalf of its Customer Affiliates.
13.5 Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this Addendum, and all Addendi between Customer Affiliates
and Liferay Affiliates, whether in contract, tort or under any other theory of liability, is subject to the limitation of liability provisions of the Agreement, and any
reference in such clause to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all Addendi together.
For the avoidance of doubt, Liferay’s and its Affiliates’ total liability for all claims from the Customer and all of its Customer Affiliates arising out of or related to the
Agreement and each Addendum shall apply in the aggregate for all claims under both the Agreement and all Addendi established under this Agreement, including
by Customer and all Customer Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Customer Affiliate
that is a contractual party to any such Addendum. For the avoidance of doubt, in no event shall any party limit its liability with respect to any Data Subject rights.
14. General Terms
14.1 Governing law and jurisdiction
Without prejudice to clauses 7 (Mediation and Jurisdiction) and 9 (Governing Law) of the Standard Contractual Clauses (i) the parties to this Addendum hereby
submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes
regarding its existence, validity or termination or the consequences of its nullity; and (ii) this Addendum and all non-contractual or other obligations arising out of
or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Agreement.
14.2 Order of precedence
14.2.1 Nothing in this Addendum reduces Liferay's or any Liferay Affiliate’s obligations under the Agreement in relation to the protection of Personal Data or permits
Liferay or any Liferay Affiliate to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Agreement. In the event of any
conflict or inconsistency between this Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
14.2.2 Subject to section 14.2.1, with regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and any
other agreements between the parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the
parties) agreements entered into or purported to be entered into after the date of this Addendum, the provisions of this Addendum shall prevail with respect to
Processing.
14.3 Changes in Data Protection Laws, etc.
14.3.1 Customer may (i) by at least 30 (thirty) calendar days' written notice to Liferay from time to time make any variations to the standard contractual clauses
(including any Standard Contractual Clauses entered into in accordance with section 12.3), as they apply to Restricted Transfers which are subject to a
particular Data Protection Law, which are required, as a result of any change in, or decision of a competent authority under, that Data Protection Law, to allow
those Restricted Transfers to be made (or continue to be made) without breach of that Data Protection Law; and (ii) propose any other variations to this
Addendum which Customer reasonably considers to be necessary to address the requirements of any Data Protection Law.
14.3.2 If Customer gives notice under section 14.3.1(i) then (i) Liferay and, if required, each applicable Liferay Affiliate shall promptly cooperate (and ensure that any
affected Subprocessors promptly cooperate to ensure that equivalent variations are made to any agreement put in place under Section 6.4; and (ii) Customer
Page 6 of 9
3002310_GL_EN
Data Processing Addendum
shall not unreasonably withhold or delay agreement to any consequential variations to this Addendum proposed by Liferay to protect the Contracted
Processors against additional risks associated with the variations made under section 14.3.1.
14.3.3 If Customer gives notice under section 14.3.1 (ii), the parties shall promptly discuss the proposed variations and negotiate in good faith with a view to agreeing
and implementing those or alternative variations designed to address the requirements identified in Customer's notice as soon as is reasonably practicable.
14.3.4 Neither Customer nor Liferay shall require the consent or approval of any Customer Affiliate or Liferay Affiliate to amend this Addendum pursuant to this
section 14.3 or otherwise.
14.4 Severance
If any provision or provisions of this Addendum shall be held to be invalid, illegal or unenforceable in whole or in part by any court of competent jurisdiction or
other competent authority, this Addendum will continue to be valid and enforceable as to the other provisions and/or the remainder of the affected provision(s).
The affected provision(s) will be deemed amended to the minimum extent necessary to render it valid and enforceable in conformity with applicable law and
parties’ intent as expressed in this Addendum or the Agreement.
Page 7 of 9
3002310_GL_EN
Data Processing Addendum
SCHEDULE 1: DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA
This Schedule 1 includes certain details of the Processing of Customer Personal Data as required by Article 28(3) GDPR.
Subject matter and duration of the Processing:
The subject matter of the Processing is the Customer Personal Data and duration of the processing is the term of the Services, both as set forth in the Agreement.
The nature and purpose of the Processing of Customer Personal Data:
Liferay will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement including any Order Form, as further specified in the
Documentation, and as further instructed by Customer Group Member in its use of the Services and Processing to comply with other reasonable instructions
provided by Customer Group Member (e.g., via email) where such instructions are consistent with the terms of the Agreement including any Order Form.
The types of Customer Personal Data (and any special categories of data, if applicable) to be Processed and the categories of Data Subjects to whom the
Customer Personal Data relates:
The categories of Customer Personal Data and Data Subjects are identified at https://www.liferay.com/legal/cloud-services-data.
The obligations and rights of Customer and Customer Affiliates:
The obligations and rights of Customer and Customer Affiliates are set forth in the Agreement and this Addendum.
Subprocessors:
The Subprocessors utilized for purposes of the Services are identified at https://www.liferay.com/legal/cloud-services-data (or for any Services not explicitly listed
under this link, in the document outlining the agreed scope of the Services)
Page 8 of 9
3002310_GL_EN
Data Processing Addendum
SCHEDULE 2: TECHNICAL AND ORGANIZATIONAL MEASURES
Liferay makes available a description of the technical and organizational security measures it implements for Services Processing Personal Data at
https://www.liferay.com/legal/cloud-services-data (or, for any Services not explicitly mentioned under this link, in the document outlining the agreed scope of the
Services).
Page 9 of 9
3002310_GL_EN