Snapshot 154365
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
PROGRESS SOFTWARE CORPORATION DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) is entered into to ensure adequate safeguards with respect to
the privacy and security of Personal Data passed from Customer to Progress for Processing on the
Customer’s behalf, as authorized by Customer in accordance with the requirements of the Data Protection
Laws and Regulations.
This DPA is intended to set forth the data protection roles of the parties. This DPA is an addendum to each
end user license agreement, master agreement, professional services agreement or other agreement
between Customer and Progress pertaining to the licensing of products and/or the delivery of Services by
Progress (each an “Agreement” and collectively the “Agreement(s)”). Each Agreement, as defined in the
preceding sentence, includes all orders, schedules, exhibits, statements of work, addenda or other
documents attached to, incorporated therein by reference or subsequently executed by the parties in
accordance with the terms thereof.
By signing the DPA, Customer enters into the DPA on behalf of itself and, to the extent required under
applicable Data Protection Laws and Regulations, in the name and on behalf of its Authorized Affiliates.
During its performance of Services under the Agreement(s), Progress may Process Personal Data on behalf
of Customer. This DPA specifies the parties’ respective rights and obligations regarding the Processing by
Progress of Personal Data supplied by Customer, and the parties agree to comply with the following
provisions with respect to any such Personal Data, each acting reasonably and in good faith.
HOW TO EXECUTE THIS DPA
This DPA consists of two parts: the main body of the DPA and Appendix 1 (including Annexes 1 to 4).
The DPA and Standard Contractual Clauses in Appendix 1 have been pre-signed by Progress Software
Corporation and each Progress Group member.
To complete this DPA, Customer must:
a) Complete the information in the “Customer” signature section and sign.
b) Complete the information regarding the data exporter in Annex 1 and sign.
c) Submit the completed and signed DPA to Progress via privacy@progress.com providing a return email
address.
SCOPE AND APPLICATION OF THIS DPA
This DPA will apply to all Products and Services provided by Progress on behalf of Customer pursuant to
the Agreement(s). For purposes of this DPA, Progress may act either as Controller or as the Processor (as
defined below) and Customer is Controller or Processor (as defined below). The scope of this DPA applies
to:
All Personal Data sent by or on behalf of the Controller to the Processor for performance or
operation of the Services to the extent the Personal Data processing is necessary to the
provision of such a Service. All Personal Data otherwise received by Progress as Processor,
and its Affiliates, in connection with the Services.
1
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
The DPA does not apply on scenarios when Progress does not process Personal Data on
Customer`s behalf except for the scenarios where Progress acts as an independent Controller for
the operations related to its own customer relationship management and other similar purposes.
This DPA will be effective beginning on the day it is executed by Customer and will continue as long as any
Agreement remains in effect. This DPA shall not replace any comparable or additional rights relating to
Processing of Customer Data contained in Customer’s Agreement. However, this DPA supersedes any
existing Data Processing Addendum to the Agreement. Where the Customer makes any deletions or other
revisions to this DPA, such changes are not effective unless accepted in writing by both parties.
1. DPA DEFINITIONS
All capitalized terms not defined herein will have the meaning set forth in the applicable Agreement.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common
control with a party hereto. “Control,” for purposes of this definition, means direct or indirect ownership
or control of more than 50% of the voting interests of the subject entity.
“Authorized Affiliate” means any of Customer's Affiliate(s) which (a) is subject to the Data Protection Laws
and Regulations and (b) is permitted to use or benefit from the Services pursuant to the Agreement(s)
between Customer and Progress but has not signed its own order with Progress and is not the Customer.
“Controller” means the entity which determines the purposes and means of the Processing of Personal
Data.
“Consumer” shall have the same meaning as determined by the applicable Data Protection Laws and
Regulations.
“Customer” means the customer entity that executes this document.
“Customer Data” means all electronic data processed by or on behalf of Customer, or an Authorized
Affiliate, utilizing a product or Service provided by Progress under the Agreement.
“Data Protection Laws and Regulations” means all laws and regulations applicable to the collection,
recording, organization, storage, adaptation or alteration, retrieval, consultation or other use of Personal
Data, including without limitation (i) the laws and regulations of the European Union, the European
Economic Area and their member states (including without limitation the GDPR as well as any delegated
acts and implementing acts), Switzerland and the United Kingdom; (ii) all state laws in effect in the United
States of America that are applicable to the processing of Personal Data under this DPA, including, but not
limited to the California Consumer Privacy Act of 2018, sections 1798.100 through 1798.199 of the
California Civil Code (“CCPA”) as subsequently amended by California Privacy Rights Act (“CPRA”) and the
implementing regulations; (iii) the Brazilian General Data Protection Law, Federal Law no. 13,709/2018
("LGPD"); and (iv) any other enacted comprehensive privacy laws with similar provisions.
“Data Subject” means an identified or identifiable natural person to whom the Personal Data relates.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons regarding the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the
2
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union
(Withdrawal) Act 2018 (the "UK GDPR").
“Personal Data” means any information relating to an identified or identifiable natural person or any
other information defined as ‘personal data’ or ‘personal information’ under applicable Data Protection
Laws and Regulations.
“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise
Processed in connection with the provisioning of the Services.
“Processing” or “Process” means any operation or set of operations which is performed by Progress as part
of the Services upon Personal Data, whether or not by automatic means, such as collection, recording,
organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
The nature and purpose of the Processing, as well as the types of Personal Data and categories of Data
Subjects covered by these Terms are set out under Appendix 1 to the Standard Contractual Clauses
attached hereto as Appendix 1.
“Processor” means the entity which Processes Personal Data on behalf of the Controller.
“Progress” means the Progress Group member that is a party to the applicable Agreement with Customer.
“Progress Group” means Progress Software Corporation and its Affiliates.
“Services” means the provision of maintenance and support services, consultancy or professional services
and the provision of software as a service or any other services provided under the applicable Agreement
where Progress Processes Customer’s Personal Data.
“Standard Contractual Clauses” means (i) where the GDPR applies, the standard contractual clauses
annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021, available at https://eur-
lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1623940939861 ("EU SCCs"); and
(ii) where the UK GDPR applies, the UK Data Transfer Addendum (“UK DTA”) issued by the Commissioner
under S119A(1) Data Protection Act 2018.; in each case as may be amended, superseded or replaced from
time to time. ;
“Third-Party Sub-Processor” means a third-party subcontractor, other than Progress’ Affiliate, engaged by
Progress that Processes Customer’s Personal Data.
“Sub-Processor" means any Third-Party Sub-Processor or Progress Affiliate which is engaged to process
Personal Data on behalf of the Customer who is either Controller or Processor.
Other terms have the definitions provided for them in the Agreement or as otherwise specified below.
2. Role of the parties
(a) When Progress Processes Personal Data on behalf of Customer in connection with the licensed
cloud-based products or services, Progress will Process such Personal Data as a Processor or a
Sub-Processor on behalf of Customer (who, in turn, processes such personal data as a Controller
or a Processor) and this DPA will apply accordingly. Progress is acting as a Processor or
3
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
respectively as a Sub-Processor for cloud-based products and services and for technical support
only to the extent when personal data is submitted as a part of the Customer support case.
(b) When Progress solely determines the purposes and means of Personal Data Processing, it
Processes Personal Data as a Controller. Progress will Process Personal data as an independent
Controller for: (i) account creation and maintenance (e.g. email addresses provided during the
account registration), administration, services access, or contact information for the account to
provide assistance through customer support activities (ii) to manage customer relationship (iii)
facilitate security, fraud prevention, performance monitoring, business continuity, disaster
recovery; (iv) to carry out core business functions such as marketing, contract management,
accounting, invoicing, billing, reporting, compliance, legal protection and other similar
purposes. Progress will Process such Personal Data in compliance with the applicable Data
Protection Laws and Regulations and only for the purposes that are compatible with those
described herein. Unless otherwise stated in the respective provision, for the operations where
Progress is acting as an independent Controller, only Sections 12 - 20 of this DPA will apply, to
the extent applicable to the specific case.
(c) Nothing in this DPA shall be interpreted in a way to assume joint controllership unless the
otherwise is determined by the parties after taking into account the factual circumstances
which imply joint controllership. If the parties agree that they will jointly determine the
purposes and means of processing, they shall stipulate in a transparent manner their respective
responsibilities for compliance with the obligations in accordance with the applicable law.
3. Customer Processing Instructions for Personal Data processed on Customer`s behalf
Customer undertakes not to provide Personal Data for Processing by Progress unless it is strictly necessary
for the performance of the Agreement or the respective order and shall take all necessary measures to
sanitize the data or information provided to Progress for technical support or professional services from
Personal Data unless it is necessary for the support case or the professional services engagement.
The Personal Data shall be confidential and shall be treated by Progress consistently with the confidentiality
obligations contained in the Agreement. Accordingly, Progress shall only Process Personal Data on behalf
of and in accordance with this DPA and the Agreement. Inter alia for the purposes of Clause 8.1 of the
Standard Contractual Clauses, the following is deemed a documented instruction by Customer to process
Personal Data: (a) Processing in accordance with the Agreement and applicable order(s); (b) Processing
initiated by end-users in their use of the Service and (c) Processing to comply with other documented
instructions provided by Customer where such instructions are consistent with the terms of the applicable
Agreement.
Customer’s instructions for the Processing of Personal Data will comply with Data Protection Laws and
Regulations. Customer will have sole responsibility for the accuracy, quality, and legality of Personal Data
and the means by which Customer acquired Personal Data. If applicable law requires Progress (or, for the
avoidance of doubt, any Sub-Processor) to conduct Processing inconsistent with any of Controller’s
instructions, or if Progress believes that any instruction from Controller is in violation of or would result in
a violation of applicable law, Progress will notify Controller hereof without undue delay and prior to
commencing the Processing.
The parties acknowledge and agree that regarding the Processing of Personal Data, Customer and its
Affiliates permitted to use or benefit from the Services pursuant to the Agreement(s) between Customer
and Progress are the Controllers, Progress is the Processor, and that Progress may engage Sub-Processors
4
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
and Third-Party Sub-Processors pursuant to the requirements set forth in the “Affiliates and Third-Party
Sub-Processors” section below.
4. Affiliates and Third-Party Sub-Processors
By entering into this DPA, Customer provides a general written authorization for Progress to engage Sub-
Processors to process Personal Data on Customer`s behalf. Customer acknowledges and agrees that (a)
members of the Progress Group and Progress’ Affiliates may be retained as Sub-Processors and (b)
Progress, members of the Progress Group and Progress’ Affiliates respectively may engage Third-Party
Sub-Processors regarding the provision of the Services provided that the applicable requirements set forth
under the applicable Data Protection Laws and Regulations, Customer’s instructions and this DPA
(specifically Section 3) – including, to the extent applicable, the Standard Contractual Clauses – are
complied with at all times. Any such Sub-Processors will be permitted to obtain Personal Data only to
deliver the services Progress has retained them to provide. Progress maintains a list of Progress’ Affiliates
and Third-Party Sub-Processors that may Process Personal Data. Where Progress engages a Sub-Processor
for carrying out specific Processing activities on behalf of the Customer, the same or equivalent data
protection obligations and restrictions as set out in this DPA – including, insofar as applicable, the Standard
Contractual Clauses – shall be imposed on that Sub-Processor by way of a written agreement. Such
agreement shall provide sufficient guarantees to implement appropriate technical and organizational
measures in such a manner that the Processing will meet the requirements of the applicable Data
Protection Laws and Regulations.
5. Notification of New Third – Party Sub-Processors and Objection Right for new Third – Party Sub-
Processors
Progress will make available to Customer a current list of Sub-Processors for the respective Services with
the identities of those Sub-Processors (“Sub-Processor List”) upon Customer request, such request to be
not more than once per annum unless such information is required by reason of an enquiry by a data
protection authority. Within fourteen (14) days of Progress providing to Customer with its list of Third-
Party Sub-Processors, Controller may object to such a change in writing if the new Third-Party Sub-
Processor represents a substantial and unreasonable risk to the protection of Personal Data and may
terminate the Agreement if, in Controller’s reasonable discretion, Progress does not adequately address
this objection.
Progress will be liable for the acts and omissions of its Sub-Processors to the same extent Progress would
be liable if performing the Services of each Sub-Processor directly under the terms of this DPA, except as
otherwise set forth in the Agreement.
6. Rights of Data Subjects
If Progress receives a request directly from Customer`s Data Subject to exercise one or more of their rights
under Applicable Data Protection Laws, Progress will direct the Data Subject to Customer unless
prohibited by law. Progress can, to the extent legally permitted or required, promptly notify Customer if
Progress receives a request from a Data Subject to exercise the Data Subject's right of access, right to
rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the
Processing, or its right not to be subject to an automated individual decision making (“Data Subject
Request”). However, if Progress receives a Data Subject Request pertaining to data processing operation
(s) for which Progress acts as independent controller Progress shall solely respond to the data subject
request.
5
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
Taking into account the nature of the Processing, Progress will assist Customer by appropriate technical
and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to
respond to a Data Subject Request under Data Protection Laws and Regulations.
In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data
Subject Request, Progress will upon Customer’s request provide commercially reasonable efforts to assist
Customer in responding to such Data Subject Request, to the extent Progress is legally permitted to do so
and the response to such Data Subject Request is required under Data Protection Laws and Regulations.
To the extent legally permitted, Customer will be responsible for any costs arising from Progress’ provision
of such assistance.
7. Personnel
Progress will ensure that its personnel and (as applicable) other persons authorized to Process Personal Data
or engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data,
have received appropriate training on their responsibilities and are subject to obligations of confidentiality
and such obligations survive the termination of that persons’ engagement with Progress.
Progress will take commercially reasonable steps to ensure the reliability of any Progress personnel
engaged in the Processing of Personal Data.
Progress will ensure that any access by a Progress Group member or Third-Party Sub-Processor to Personal
Data is limited to those personnel of the Progress Group member or Sub-Processor who require such
access to perform the Agreement(s).
Members of the Progress Group have appointed a Data Protection Subject Matter Expert or Data
Protection Officer where such appointment is required by Data Protection Laws and Regulations. The
appointed person may be reached by email via privacy@progress.com.
8. Security Measures
Progress will maintain appropriate technical and organizational security measures for the Processing of
Personal Data. These measures are intended to protect Personal Data against accidental or unauthorized
loss, destruction, alteration, disclosure or access, and against all other unlawful forms of Processing. Subject
to mutual agreement, additional measures, and information concerning such measures, including the
specific security measures and practices for the Services ordered by Customer, may be specified in the
Agreement.
Progress’s present technical and organizational security measures are described in Annex II to the
Standard Contractual Clauses. Progress shall adapt these measures according to the development of
regulations and technology.
Additionally, at the request of Controller, Progress will provide commercially reasonable assistance to
Controller to ensure that any technical and organizational information security measures implemented by
Controller satisfy the requirements of applicable Data Protection Laws and Regulations.
Where Controller determines it is obliged under applicable Data Protection Laws and Regulation to
conduct privacy and/or security assessments, such as a data protection impact assessment (“DPIA”) under
the applicable Data Protection Laws and Regulations, Progress shall provide commercially reasonable
cooperation and assistance with Controller’s obligations. Additionally, if Controller determines that
6
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
applicable Data Protection Laws and Regulations requires Controller to consult with or seek guidance from
a supervisory authority or other regulatory body prior to commencing any particular Processing, Progress
shall provide commercially reasonable cooperation with and assistance to Controller in fulfilling its
obligations. Any reasonable costs associated with Progress’s rendering the assistance required by this
paragraph shall be borne by Customer.
9. Audit Rights
The parties agree that the audits described in Clause 8.9. (c) - (e) and Clause 13 (b) of the applicable module
of the Standard Contractual Clauses shall be carried out in accordance with the following specifications:
Upon Customer’s request, and subject to the confidentiality obligations set forth in the applicable
Agreement, Progress will make available to Customer (or Customer’s independent, third-party auditor
that is not a competitor of Progress) information regarding the Progress Group’s compliance with the
obligations set forth in this DPA in the form of the third-party certifications or a summary copy of the
relevant audit report (s) to the extent Progress makes them generally available to its customers.
Customer may contact Progress in accordance with the “Notices” section of the applicable Agreement to
request an on-site audit of the procedures relevant to the protection of Personal Data. Customer will
reimburse Progress for any time expended for any such on-site audit at Progress’ or the applicable
Progress Group member’s then-current professional services rates, which will be made available to
Customer upon request.
Before the commencement of any such on-site audit, Customer and Progress will mutually agree upon the
scope, timing, and duration of the audit in addition to the reimbursement rate for which Customer will be
responsible. Customer agrees that the scope of the audit shall be limited to matters specific to Customer.
All reimbursement rates will be reasonable, considering the resources expended by Progress.
Customer will provide Progress with copies of any audit reports generated in connection with any audit
under this Section, unless prohibited by applicable law. Customer may use the audit reports only for the
purpose of meeting its regulatory audit requirements and/or confirming compliance with the
requirements of this DPA. Customer will promptly notify Progress with information regarding any
noncompliance discovered during the course of an audit and Progress will have the opportunity to object
against the finding, remediate and/or rectify any issues identified within 30 days.
In terms of initial or annual due diligence or risk assessment questionnaires, Customer acknowledges and
agrees that its requirements can be also satisfied by industry standard documentation including self-
reporting mechanisms and assessments. In this case, Customer would not directly audit the Progress
controls and/or request customer specific questionnaires unless the latter are required under the
applicable Data Protection Laws and Regulations or requested by a competent data protection authority.
10. Incident Management and Breach Notification
Progress maintains security incident management policies and procedures and will notify Customer without
undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to Customer Data, including Personal Data, transmitted, stored or otherwise
Processed by Progress or its Sub-Processors and Third-Party Sub-Processors, of which Progress becomes
aware (a “Customer Data Incident”). Progress shall provide information necessary and requested by the
Controller to investigate the Security Incident. The Parties are aware that Data Protection Laws and
Regulations may impose a duty to inform the supervisory authority or affected Data Subjects in the event of
7
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
a Personal Data Breach. Taking into account the nature of the processing and the information available to the
Processor, the latter shall assist Controller in providing the information required for the notice to the
supervisory authority and when applicable to the data subjects provided that the Controller determined such
breach is likely to result in a risk, respectively high risk to the rights and freedom of a natural person. Progress
will exercise reasonable efforts to identify the cause of such Customer Data Incident and take those steps as
Progress deems necessary and reasonable in order to remediate the cause of such Customer Data Incident to
the extent the remediation is within Progress’ reasonable control. The obligations herein will not apply to
incidents that are caused by Customer or Customer’s users.
For purposes of this section, the term “Customer Data Incident” as described in the preceding paragraph is
further defined to mean the misappropriation or unauthorized Processing of Personal Data located on
Progress’ systems or cloud services environment, including misappropriation or unauthorized Processing
of Personal Data by a Progress employee or a Third-Party Sub-Processor, that materially compromises the
security, confidentiality or integrity of such Personal Data.
Customer agrees that: (i) an unsuccessful Customer Data Incident attempt will not be subject to this
Section. An unsuccessful attempt is one that results in no unauthorized access to Customer’s Personal
Data or to any of Progress’ equipment or facilities and any Third-party equipment or facilities storing
Customer’s Personal Data, and may include, without limitation, pings and other broadcast attacks on
firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet
sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or
headers) or similar incidents; and (ii) Progress’ obligation to report or respond to a Customer Data Incident
under this Section is not and will not be construed as an acknowledgement by Progress of any fault or
liability with respect to the incident.
11. Retention and Disposition of Customer Data
Progress will return Customer Data which is processed on Customer behalf and/or, to the extent allowed
by applicable law, delete Customer Data including existing copies and backups in accordance with the
procedures and time periods specified in the applicable Agreement(s), unless the retention of the data is
required for legal and regulatory purposes.
If the applicable Agreement does not provide guidance on retention and disposition of Customer Data,
Progress will return and/or, to the extent allowed by applicable law, delete Customer Data within a
commercially reasonable period of time, unless the retention of the data is required for legal and
regulatory purposes.
The parties agree that the certification of deletion of Personal Data that is described in Clause 16 (d) of the
Standard Contractual Clauses will be provided by Progress to the Customer only upon Customer’s request.
For avoidance of doubt Progress may retain some Customer Data for which acts as an independent
Controller and/or which is necessary for the management of the relationship between the parties, financial
records, billing, and other information necessary for the audit, reporting, and legal and compliance purposes.
12. Legal Disclosure
Except as otherwise required by law, Progress will promptly notify Customer of any subpoena, judicial,
administrative or arbitral order of an executive or administrative agency, regulatory agency, or other
governmental authority (“Demand”) that it receives, and which relates to the Processing of Personal Data.
At the Customer’s request, Progress will provide Customer with reasonable information in its possession
8
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
that may be responsive to the Demand and any assistance reasonably required for Customer to respond to
the Demand in a timely manner. Customer acknowledges that Progress has no responsibility to interact
directly with the entity making the Demand except where Controller assesses, at its sole discretion, it is
necessary to object to any request for access by a government by virtue of national law (such as the U.S.
Cloud Act), and in such case Progress shall reasonably cooperate and assist Controller to compose such
objection and to file such objection within the applicable timeframe. Such assistance and cooperation
include, but is not limited to, Progress binding itself to file such objection in its own name or on behalf of
the Controller, where applicable, and to provide Controller with all required information to complete the
objection. Any reasonable costs associated with Progress’s rendering the assistance required by this
paragraph shall be borne by Customer.
13. Product and Service Analyses
Progress may (i) compile statistical and other information related to the performance, operation and use of
the product and/or the Services, and (ii) use data from the Services environment in a de-identified and/or
aggregated form for security and operations management, to create statistical analyses, and for research
and development purposes (collectively “Service Analyses”). Progress may make Service Analyses publicly
available. However, Service Analyses will not incorporate Customer Data or Personal Data in a form that
could identify or serve to identify Customer or any Data Subject. Progress retains all intellectual property
rights in product and/or Service Analyses.
14. Limitations of Liability
Each party’s and all its Affiliates’ liability, taken together in the aggregate, arising out of or related to this
DPA, and all DPAs between Authorized Affiliates and Progress, whether in contract, tort or under any other
theory of liability, is subject to the ‘Limitation of Liability’ section of the applicable Agreement unless
specified below, and any reference in such section to the liability of a party means the aggregate liability of
that party and all its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt,
Progress' and its Affiliates’ total liability for all claims from Customer and all of its Authorized Affiliates
arising out of or related to the applicable Agreement and each DPA will apply in the aggregate for all claims
under both the Agreement and all DPAs established under the Agreement, including by Customer and all
Authorized Affiliates, and, in particular, will not be understood to apply individually and severally to
Customer and/or to any Authorized Affiliate that is a contractual party to any such DPA. Neither Customer
nor any of its Affiliates shall be entitled to recover more than once in respect of the same claim under this
DPA.
Also, for the avoidance of doubt, each reference to the term “DPA” herein means this DPA including its
Schedules and Appendices.
15. International Data Transfer; Standard Contractual Clauses
15.1 Progress shall comply with applicable Data Protection Laws and Regulations when transferring or
onward transferring Personal Data across national borders.
15.2. Transfers from EEA Countries and the United Kingdom.
15.2.1 Any transfer of Personal Data from the European Economic Area (“EEA”), United Kingdom or
Switzerland to a third country shall take place only if, in addition to complying with all other provisions of
9
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
this DPA, the conditions set forth in this Section 15.2 are complied with. For the avoidance of doubt, the
restrictions of this Section 15.2 also govern onward transfers of Personal Data within the third country, or
from the third country to another third country.
15.2.2. The transfer of Personal Data is permitted to a third country for which the European Commission has
decided that such a third country, a territory or one or more specified sectors within that third country
ensure(s) an adequate level of protection. To other countries, a transfer may only take place if appropriate
safeguards are provided by other transfer mechanisms, such as Binding Corporate Rules; standard data
protection clauses (“Standard Contractual Clauses”) such as the European Commission approved Standard
Clauses for the Transfer of Personal Data located outside the EEA incorporated by reference; or an approved
certification mechanism or approved code of conduct within the meaning of Article 46(2)(e) and (f) of the
GDPR. For the purposes of the UK DTA: (i) the Appendices or Annexes of the UK DTA shall be populated
with the relevant information set out in the Annexes to this Addendum; and (ii) the UK DTA shall be
governed by the laws of England and Wales and disputes shall be resolved before the courts of England
and Wales. The EU SCC are recognized and shall apply for the data transfers originating from Switzerland.
To the extent the EU SCC entered for the benefit of company affiliates in Switzerland, the Swiss courts are
an alternative place of jurisdiction for data subjects habitually resident in Switzerland and the competent
supervisory authority is Federal Data Protection and Information Commissioner (FDPIC) solely or in
cooperation with the competent authority under the SCC.
If and to the extent it is either agreed to by the parties or adjudicated that the specific basis used by the Parties
for such data transfer will no longer be considered as providing appropriate safeguards for transfer of Personal
Data from the EEA, United Kingdom or Switzerland to that third country, Parties agree to start negotiation
about changing to another valid transfer mechanism. Controller may terminate the Agreement if Parties
cannot agree to such a new transfer mechanism prior to the effective date of the final invalidation of the
currently used transfer mechanism.
15.2.3. Depending upon the Services, Customer and Progress may agree upon the location for storage of
Personal Data based on the available locations where the Service is provided. Notwithstanding the foregoing,
Progress may transfer Personal Data to the United States and/or to other third countries as necessary to
perform the Services, and you appoint Progress to perform any such transfer in order to process Personal
Data as necessary to provide the Services. Progress will follow the requirements of this DPA regardless of
where such Personal Data is stored or Processed.
15.2.4. For data transfers from to any other country, parties agree to cooperate in good faith and to apply the
relevant data transfer mechanism to the extent it is required by the applicable Data Protection Laws and
Regulations.
The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual
Clauses as a Data Exporter and, (ii) all Affiliates (as defined above) of Customer established within the EEA,
United Kingdom and/or Switzerland that have purchased product and or/Services on the basis of an order
under the applicable Agreement. For the purpose of the Standard Contractual Clauses and this Section,
the Customer and its Affiliates will be deemed to be “Data Exporters”. The Parties agree that in the case
of any inconsistencies between such Standard Contractual Clauses and this DPA, the Standard Contractual
Clauses will prevail. For the avoidance of doubt, any provision of this DPA that merely goes beyond the
clauses of the Standard Contractual Clauses without contradicting or altering them shall remain valid (to
the extent permitted under applicable Data Protection Laws and Regulations and by competent
supervisory authorities). Nothing in this DPA shall affect any supervisory authority’s or Data Subject’s
rights under the Standard Contractual Clauses and applicable Data Protection Laws and Regulations.
10
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
16. Customer Data Subject to the CCPA/CPRA
As used in this Section 16, “Commercial Purpose”, “Consumer”, “Personal Information”, “Sell”, and
“Service Provider” have the meanings assigned to them in the CCPA/CPRA.
If Customer Data comprises Personal Data subject to the CCPA (“CCPA/CPRA Covered Data”) or other US
states which enacted comprehensive privacy laws with similar provisions, Progress is the Service Provider
as determined by the law and, consistent with the requirements of the applicable law including
CCPA/CPRA, shall not (a) Sell the CCPA/CPRA Covered Data or (b) retain, use or disclose the CCPA/CPRA
Covered Data: (i) for any purpose, including any Commercial Purpose, other than the specific purpose of
providing and supporting the Product or Service or (ii) outside of the Parties’ direct business relationship,
or (iii) for legally permitted business purposes under the CCPA/CPRA and its regulations as disclosed in
the Progress Privacy Policy available on https://www.progress.com/legal/privacy-center as amended from
time to time.
The Customer is responsible for responding to Consumer requests in relation to CCPA/CPRA Covered Data
(each, a “Consumer Request”). If Progress receives a Consumer Request, then, to the extent legally
permissible, Progress will advise the Consumer to submit the Consumer Request to the Customer. To the
extent the Customer is unable through its use of the Product or Service to address a particular Consumer
Request, Progress will, upon request and taking into account the nature of the CCPA/CPRA Covered Data,
provide reasonable assistance in addressing the Consumer Request (provided that Progress is legally
permitted to do so). Customer is responsible for verifying Consumer Requests in accordance with the
CCPA/CPRA. If Progress receives Consumer Requests related to its own operations such as for example
without limitation first party marketing, Progress can respond to the request directly to the Consumer.
17. Customer Data Subject to LGPD
If Customer Data comprises Personal Data subject to the LGPD (“LGPD Covered Data”), then Customer
Personal Data, as the term is used in Sections 2 through 15 of this DPA above, shall be deemed to
include LGPD Covered Data.
18. Parties to the DPA
Each Progress entity that is a party to the applicable Agreement is a party to this DPA. In addition, Progress
Software Corporation is a party to the Standard Contractual Clauses in Annex I A. If Progress Software
Corporation is not a party to the Agreement, the “Limitations of Liability” section of this DPA will apply as
between Customer and Progress Software Corporation, and in such respect any reference to ‘Progress’
will include both Progress Software Corporation and the Progress entity who is a party to the applicable
Agreement.
If the Customer entity signing this DPA is a party to the Agreement, this DPA is an addendum to and forms
part of the Agreement. In such case, the Progress entity that is party to the Agreement is party to this DPA.
If the Customer entity signing this DPA has executed an Agreement with Progress or its Affiliate pursuant
to the Agreement, but is not itself a party to the Agreement, this DPA is an addendum to that Agreement
and applicable amendments and renewals of that Agreement, and the Progress entity that is party to such
Agreements is party to this DPA.
19. Legal Effect
11
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
This DPA will only become legally binding between Customer and Progress when fully executed by the
parties. If this document has been electronically signed by either party such signature will have the same
legal effect as a hand-written signature.
20. Order of Precedence
This DPA is incorporated into and forms part of the Agreement(s). For matters not addressed under this
DPA, the terms of the Agreement(s) apply. With respect to the rights and obligation of the parties, in the
event of a conflict between the terms of the Agreement(s) and this DPA, the terms of this DPA will control.
In the event of a conflict between the terms of the DPA and the Standard Contractual Clauses, the
Standard Contractual Clauses will prevail.
12
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
Customer:
Title: Director
Signature:
Date: September 22, 2026
By: Progress Software Corporation
Title: Signature:
Date: By: Anthony Folger
Progress Software do Brasil Ltda. Title: Chief Financial Officer
Signature: Date: September 23, 2026
By: Bruno da Silva Manhaes Progress Software Corporation of Canada Ltd.
Title: Legal Representative Signature:
Date: September 22, 2026 By: Domenic LoCoco
Progress Software Gesellschaft mbH (Austria) Title: Director
Signature: Date: September 22, 2026
By: Domenic LoCoco Progress Software N.V. (Belgium)
Title: Director Signature:
Date: September 22, 2026 By: Leendert Steendijk
Progress Software E.A.D. (Bulgaria) Title: Director
Signature: Date: September 22, 2026
By: Domenic LoCoco and Charles Pollak
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
Flowmon Networks A.S. (Czech Republic) Date: September 22, 2026
Signature: Progress Software Oy (Finland)
By: Charles Pollak Signature:
Title: Director By: Anthony Folger
Date: September 22, 2026 Title: Director/Chairman of the Board
September 23, 2026
Progress Software A/S (Denmark) Date:
Signature: Progress Software GmbH (Germany)
By: Leendert Steendijk Signature:
Title: Director By: Domenic LoCoco
Date: September 22, 2026 Title: Director
Progress Software S.A.S. (France) Date: September 22, 2026
Signature: Progress Software B.V. (Netherlands)
By: Domenic LoCoco Signature:
Title: President By: Domenic LoCoco
Date: September 22, 2026 Title: Director
Progress Software Srl (Italy) Date: September 22, 2026
Signature: Progress Software AS (Norway)
By: Domenic LoCoco Signature:
Title: Director By: Domenic LoCoco
14
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
Title: Chairman By: Domenic LoCoco
Date: September 22, 2026 Title: Director
Progress Software sp. z.o.o. (Poland) Date: September 22, 2026
Signature: Progress Software SLU (Spain)
By: Domenic LoCoco Signature:
Title: Director By: Leendert Steendijk
Date: September 22, 2026 Title: Director
Progress Software Svenska AB (Sweden)
Date: September 22, 2026
Signature: Progress Software AG (Switzerland)
By: Domenic LoCoco Signature:
Title: Director By: Domenic LoCoco
Date: September 22, 2026 Title: Director
Progress Software Limited (UK) Date: September 22, 2026
Signature: Progress Software Pty. Ltd. (Australia)
By: Domenic LoCoco Signature:
Title: Director By: Domenic LoCoco
Date: September 22, 2026 Title: Director
Progress Software Corporation Limited (Hong
Date: September 22, 2026
Kong)
Progress Software Development Private Ltd.
Signature: (India)
15
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
Signature: Date: September 22, 2026
By: Domenic LoCoco Progress Software Technologies Limited
(Ireland)
Title: Director
Signature:
Date: September 22, 2026
By: Domenic LoCoco
Progress Software Corporation (S) Pte Ltd.
(Singapore) Title: Director
Signature: Date: September 22, 2026
By: Domenic LoCoco Progress (Shanghai) Software System Co., Ltd.
(China/Shanghai)
Title: Director
Signature:
Date: September 22, 2026
By: Anthony Folger
Progress Software Japan KK (Japan)
Title: Director/Chairman
Signature:
Date: September 23, 2026
By: Charles Pollak
Title: Representative Director
September 22, 2026
Domo, LLC
Signature:
By: Domenic LoCoco
Title: President
16
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
APPENDIX 1
TO THE DATA PROCESSING ADDENDUM
EXPLANATORY NOTE:
It must be possible to clearly distinguish the information applicable to each transfer or category of
transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or
data importer(s). This does not necessarily require completing and signing separate appendices for each
transfer/category of transfers and/or contractual relationship, where this transparency can be achieved
through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should
be used.
MODULE in operation
☒ Module 1 – Controller – Controller
INFORMATION REQUIRED BY THE SCCS OPTIONAL CLAUSES.
☒ Module 2 – Controller – Processor
☒ Module 3 – Processor to Processor applicable when the Customer is data processor for its own
customers
1. Clause 7 (Docking clause) – Parties agree to apply the Docking clause;
2. Clause 9 (a) (Use of sub-processors) - Option 2 General Written Authorization shall apply and
the time period for informing the data exporter of intended changes to the list of Sub-
Processors shall be 14 days;
3. Clause 11 (Redress) - the optional wording in Clause 11 shall not apply;
4. Clause 17 and Clause 18 (Governing law and Jurisdiction): The following option and choice of
law shall apply in the following scenarios:
a. Option 2. These clauses shall be governed by the law of the EU Member State in which
the data exporter is established. Where such law does not allow for third party beneficiary
rights, they shall be governed by the law of Netherlands.
b. Switzerland only: For the purpose of the SCC being entered into for the benefit of
company affiliates in Switzerland, the Swiss courts are an alternative place of
jurisdiction for data subjects habitually resident in Switzerland.
17
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
ANNEX I
A. LIST OF PARTIES
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their
data protection officer and/or representative in the European Union]
1. Name:
Address:
Contact person’s name, position and contact details:
Activities relevant to the data transferred under these Clauses: The data exporter may, at its sole
discretion transfer Personal Data to the data importer through its use of the software products and
services licensed for its use by the data importer.
Signature and date:
Role (controller/processor): …………………………..
2.
Data importer(s):
1. Name: Progress Software Corporation
Address: 15 Wayside Road, Suite 400, Burlington, MA 01803
Contact person’s contact details: Email: privacy@progress.com, , Address as above.
Activities relevant to the data transferred under these Clauses: Progress Software Corporation, is a
software company and cloud service provider which Processes Personal Data, where such data is
Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement
and the Data Processing Addendum.
September 23, 2026
Signature and date:
Role (controller/processor): Controller for Module 1, Processor for Module 2 or 3 as applicable.
18
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
B. DESCRIPTION OF TRANSFER/PROCESSING
Categories of data subjects whose personal data is transferred/processed:
Customer/Data exporter may submit Personal Data to the Service, the extent of which is
determined and controlled by the data exporter in its sole discretion, and which may include,
but is not limited to Personal Data relating to the following categories of data subjects:
Customers, business partners, and vendors of the data exporter (who are natural persons)
Employees or contact persons of data exporter customers, business partners, and vendors
Employees, agents, advisors, contractors, or any user authorized by the data exporter to use
the Service (who are natural persons)
Categories of personal data transferred/processed
Customer/Data exporter may submit Personal Data to the Service, the extent of which is
determined and controlled by the data exporter in its sole discretion, and which may include, but
is not limited to the following categories of personal data:
First and last name
Business contact information (company, email, phone, physical business address)
Personal contact information (email, cell phone)
Title
Position
Employer
ID data
Professional life data
Personal life data (in the form of security questions and answers)
Connection data
Localization data
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose limitation,
access restrictions (including access only for staff having followed specialised training), keeping a record
of access to the data, restrictions for onward transfers or additional security measures.
Data exporter may submit sensitive data to the Service, the extent of which is determined and
controlled by the data exporter in its sole discretion if this is relevant for the product or service in use,
and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin,
political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data
concerning health or sex life.
Information about security measures and safeguards is available at https://www.progress.com/trust-
center
Data importer will not ask for, and data exporter will not transfer or otherwise provide, sensitive data to
data importer.
19
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
By default, Customer Personal Data must not contain sensitive personal data, unless necessary for the
provision of the service.
The frequency of the transfer/processing (e.g. whether the data is transferred on a one-off or continuous
basis).
Continuous basis during the term of the Agreement, at the discretion of the data exporter.
Nature of the processing and Purpose(s) of the data transfer and further processing
Progress will process Customer Personal Data to the extent this is necessary to provide the products,
services and the related technical support or professional services in accordance with the applicable
Agreement and/or Statement of Work. Additional information regarding the nature of Processing
(including transfer) is described in the respective Agreement, Statement of Work or Order for the relevant
product and service and the product documentation referring to the technical capabilities and features
including but not limited to collection, structuring, storage, transmission or otherwise making available.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to
determine that period
Duration of the Agreement, subject to any post-termination provisions relating to the return or
destruction of Customer Data set out in the Agreement.
For the operations where Progress is acting as independent controller personal data may be retained as
long as necessary for legal, regulatory, contract management and archive purposes, financial reporting,
audit, and history of the business relationship. The criteria used to determine the retention period are
statutory requirements to retain data and limitation periods in the respective jurisdiction and determined
legitimate business need.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Detailed list of Sub-Processors, available on request or to be further published on
https://www.progress.com.
C. COMPETENT SUPERVISORY AUTHORITY
As identified under Clause 13 or, if no Supervisory Authority is identified under that Clause, the
Netherlands.
20
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATA
Progress shall maintain administrative, physical and technical safeguards for protection of the security,
confidentiality and integrity of Customer Data, as detailed at https://www.progress.com/trust-center.
Progress regularly monitors compliance with these safeguards. Progress will not materially decrease the
overall security of the Service during a term of an Agreement.
21
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
ANNEX III
LIST OF SUB-PROCESSORS
A list of Sub-Processors for the Products/Services made available by Progress to Customer is available on
request or as to be further published on https://www.progress.com.
22
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
ANNEX IV
This Addendum has been issued by the Information Commissioner for Parties making Restricted
Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for
Restricted Transfers when it is entered into as a legally binding contract.
Part I: Tables
a. Table 1: Parties
Start As of the Effective Date of the Terms of Service/End User License Agreement between the Parties
date
The Importer (who receives the Restricted
Exporter (who sends the Restricted Transfer)
Parties Transfer)
Parties’ Annex I to the DPA is incorporated by reference Annex I to the DPA is incorporated by reference
details
Key privacy@progress.com
Contact
Signature
(if _______________________________________ _______________________________________
required
for the
purposes Date: Date: September 23, 2026
of
Section
2)
b. Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs ☐The version of the Approved EU SCCs which this Addendum is appended to,
detailed below, including the Appendix Information:
Date:
Reference (if any):
Other identifier (if any):
Or
☒the Approved EU SCCs, including the Appendix Information and with only the
following modules, clauses or optional provisions of the Approved EU SCCs brought
into effect for the purposes of this Addendum:
Module Module in Clause 7 Clause 11 Clause 9a Clause 9a (Time Is personal data
operation (Docking (Option) (Prior period) received from the
Clause) Authorisation Importer combined
or General with personal data
Authorisation) collected by the
Exporter?
1 Yes No N/A N/A N/A N/A
23
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
2 Yes No No General 14 days prior notice No
3 Yes (if No No General 14 days prior notice N/A
applicable)
4 No N/A N/A N/A N/A N/A
c. Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set
out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is
set out in:
Annex 1A: List of Parties: as per Annex I.A to the DPA
Annex 1B: Description of Transfer: as per Annex I.B to the DPA
Annex II: Technical and organisational measures including technical and organisational measures to ensure the
security of the data: as per Annex II to the DPA
Annex III: List of Sub processors (Modules 2 and 3 only): as per Annex III to the DPA
d. Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Which Parties may end this Addendum as set out in Section 19:
Addendum when ☒Importer
the Approved
Addendum ☒Exporter
changes ☐neither Party
Part 2: Mandatory Clauses
Entering into this Addendum
1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for
the other Party also agreeing to be bound by this Addendum.
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the
purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that
makes them legally binding on the Parties and allows data subjects to enforce their rights as set out
in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU
SCCs and any part of the Approved EU SCCs.
Interpretation of this Addendum
3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have
the same meaning as in the Approved EU SCCs. In addition, the following terms have the following
meanings:
Addendum This International Data Transfer Addendum which is made up of this Addendum
incorporating the Addendum EU SCCs.
Addendum EU SCCs The version(s) of the Approved EU SCCs which this Addendum is appended to, as
set out in Table 2, including the Appendix Information.
Appendix Information As set out in Table 3.
Appropriate Safeguards The standard of protection over the personal data and of data subjects’ rights,
24
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
which is required by UK Data Protection Laws when you are making a Restricted
Transfer relying on standard data protection clauses under Article 46(2)(d) UK
GDPR.
Approved Addendum The template Addendum issued by the ICO and laid before Parliament in
accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it
is revised under Section 18.
Approved EU SCCs The Standard Contractual Clauses set out in the Annex of Commission
Implementing Decision (EU) 2021/914 of 4 June 2021.
ICO The Information Commissioner.
Restricted Transfer A transfer which is covered by Chapter V of the UK GDPR.
UK The United Kingdom of Great Britain and Northern Ireland.
UK Data Protection Laws All laws relating to data protection, the processing of personal data, privacy
and/or electronic communications in force from time to time in the UK,
including the UK GDPR and the Data Protection Act 2018.
UK GDPR As defined in section 3 of the Data Protection Act 2018.
4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection
Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is
not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not
be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take
their place.
6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data
Protection Laws applies.
7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which
most closely aligns with UK Data Protection Laws applies.
8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific
provision) as it may change over time. This includes where that legislation (or specific provision) has
been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
Hierarchy
9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related
agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in
Section 10 will prevail.
10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum
EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where
(and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater
protection for data subjects, in which case those terms will override the Approved Addendum.
11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect
transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties
acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
Incorporation of and changes to the EU SCCs
25
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so
that:
a. together they operate for data transfers made by the data exporter to the data importer,
to the extent that UK Data Protection Laws apply to the data exporter’s processing when making
that data transfer, and they provide Appropriate Safeguards for those data transfers;
b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by
the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of
England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland
have been expressly selected by the Parties.
13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12,
the provisions of Section 15 will apply.
14. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be
made.
15. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
a. References to the “Clauses” means this Addendum, incorporating the Addendum EU
SCCs;
b. In Clause 2, delete the words: “and, with respect to data transfers from controllers to
processors and/or processors to processors, standard contractual clauses pursuant to Article
28(7) of Regulation (EU) 2016/679”;
c. Clause 6 (Description of the transfer(s)) is replaced with: “The details of the transfers(s)
and in particular the categories of personal data that are transferred and the purpose(s) for
which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply
to the data exporter’s processing when making that transfer.”;
d. Clause 8.7(i) of Module 1 (if applicable) is replaced with:
“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR
that covers the onward transfer”;
e. Clause 8.8(i) of Modules 2 and 3 is replaced with: “the onward transfer is to a country
benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the
onward transfer;”
f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard
to the processing of personal data and on the free movement of such data (General Data
Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”.
References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent
Article or Section of UK Data Protection Laws;
g. References to Regulation (EU) 2018/1725 are removed;
h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member
State” and “EU or Member State” are all replaced with the “UK”;
i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one is not applicable,
intentionally left blank;
j. Clause 13(a) and Part C of Annex I are not used;
k. The “competent supervisory authority” and “supervisory authority” are both replaced
with the “Information Commissioner”;
l. In Clause 16(e), subsection (i) is replaced with: “the Secretary of State makes regulations
26
Docusign Envelope ID: C75D0AE5-3585-86A7-83EE-78679039BEBD
pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data
to which these clauses apply;”;
m. Clause 17 is replaced with: “These Clauses are governed by the laws of England and
Wales.”;
n. Clause 18 is replaced with: “Any dispute arising from these Clauses shall be resolved by
the courts of England and Wales. A data subject may also bring legal proceedings against the
data exporter and/or data importer before the courts of any country in the UK. The Parties agree
to submit themselves to the jurisdiction of such courts.”; and
o. The footnotes to the Approved EU SCCs do not form part of the Addendum.
Amendments to this Addendum
16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws
and/or courts of Scotland or Northern Ireland.
17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved
Addendum, they may do so by agreeing to the change in writing, provided that the change does not
reduce the Appropriate Safeguards.
18. From time to time, the ICO may issue a revised Approved Addendum which:
a. makes reasonable and proportionate changes to the Approved Addendum, including
correcting errors in the Approved Addendum; and/or
b. reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which the changes to
the Approved Addendum are effective and whether the Parties need to review this
Addendum including the Appendix Information. This Addendum is automatically
amended as set out in the revised Approved Addendum from the start date specified.
19. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4
“Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes
in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
a. its direct costs of performing its obligations under the Addendum; and/or
b. its risk under the Addendum, and in either case it has first taken reasonable steps to
reduce those costs or risks so that it is not substantial and disproportionate, then that Party
may end this Addendum at the end of a reasonable notice period, by providing written notice
for that period to the other Party before the start date of the revised Approved Addendum.
20. The Parties do not need the consent of any third party to make changes to this Addendum, but any
changes must be made in accordance with its terms.
Alternative Part 2 Mandatory Clauses:
Mandatory Clauses Part 2: Mandatory Clauses of the Approved Addendum, being the template
Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with
s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under
Section 18 of those Mandatory Clauses.
The agreement has been entered into on the date stated at the beginning of it.
27