Snapshot 161029
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Immuta, Inc.
Data Processing Agreement
This Data Processing Agreement (the “DPA”) is made by and between Immuta and Licensee and is subject to the
Master Subscription Agreement or other agreement between the Parties for the provision of Software or Services to
Licensee (the “Agreement”). The DPA is effective as of the Effective Date of the Agreement.
This DPA is incorporated into the Agreement between Immuta and Licensee and applies to Immuta’s Processing of
Personal Data in connection with Immuta’s provision of the Software or Services (as such terms may be defined in
the Agreement) to Licensee. In the event of any inconsistency between the DPA and the Agreement as to Immuta’s
Processing of Personal Data, the DPA shall control.
1.0 DEFINITIONS
1. “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Process” and “Supervisory Authority”
shall have the same meaning as set out in applicable Data Protection Laws with the same or equivalent
terms.
2. “Licensee Personal Data” means any Personal Data that Immuta Processes on behalf of Licensee in the
course of utilizing the Software as a Processor.
3. “Data Protection Laws” means all applicable laws, rules and regulations relating to the Processing of
Personal Data as amended, repealed, consolidated or replaced from time to time.
4. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, any Licensee Personal Data by Immuta that
compromises the security, confidentiality or integrity of such Licensee Personal Data.
5. “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data
annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
6. “Subprocessor” means any Processor engaged by Immuta to Process Licensee Personal Data on Immuta’s
behalf.
7. “Third Country” means any destination country outside of a source country in which the Data Protection
Laws restrict transfers of Personal Data to such other destination countries, except where the Data
Protection Laws and applicable regulatory authorities of the source country adopted an adequacy decision
regarding the Data Protection Laws of the destination country such that transfers of Personal Data to that
destination country are not restricted. For purposes of this DPA, the United States is a Third Country.
8. “UK Addendum” means United Kingdom (“UK”) Information Commissioner’s (“ICO”) International
Data Transfer Addendum to the EU Commission Standard Contractual Clauses Version B1.0 in force 21
March 2022.
Capitalized terms used in this DPA and not defined above shall have the meaning set forth in the Agreement.
2.0 DATA PROCESSING
1. Immuta will only Process Licensee Personal Data in accordance with the Agreement (including any order
form), and Licensee’s written instructions, to the extent necessary to provide the Software to Licensee,
including with respect to international transfers of Licensee Personal Data, unless Processing is required by
other applicable laws, in which case Immuta shall, to the extent permitted by applicable law, inform Licensee
of that legal requirement before so Processing that Licensee Personal Data. The Agreement (including
any order form) and the DPA shall be Licensee’s complete and final instructions to Immuta in relation to the
Processing of Licensee Personal Data. Processing outside the scope of the foregoing will require prior written
agreement between Licensee and Immuta on additional instructions for Processing and may be subject to
additional fees.
2. Immuta is prohibited from (a) selling or sharing (as such terms may be defined in Data Protection Laws)
Licensee Personal Data; (b) retaining, using or disclosing Licensee Personal Data for any purpose other than
providing Software under the Agreement; (c) processing Licensee Personal Data outside of the direct
business relationship between Immuta and Licensee; and (d) combining Licensee Personal Data with
Personal Data of another customer or otherwise obtained outside of the scope of services unless permitted by
v2026-1 Internal Use
applicable Data Protection Laws. Except as otherwise expressly provided in the Agreement, no Licensee
Personal Data is processed by Immuta as consideration for any service provided to Licensee. As set forth in
Section 5.2, Licensee may take reasonable and appropriate steps to help to ensure that Immuta uses Licensee
Personal Data in a manner consistent with Immuta’s obligations. As required by Data Protection Laws,
Immuta will notify Licensee if it makes a determination that Immuta can no longer meet its obligations under
Data Protection Laws. Licensee may, upon written notice to Immuta and as set forth in Section 5.2, take
reasonable and appropriate steps to stop and remediate unauthorized use of Licensee Personal Data.
3. Licensee shall provide all applicable notices to Data Subjects required under applicable Data Protection Laws
for the lawful Processing of Licensee Personal Data by Immuta in accordance with the Agreement. Licensee
shall obtain and maintain throughout the term of the Agreement any required consents and authorizations
and have a valid legal basis (as applicable) related to its provision of, and Immuta’s processing of, Licensee
Personal Data as part of the Software.
4. For the avoidance of doubt, Licensee’s instructions for the processing of Licensee Personal Data shall comply
with the Data Protection Laws. Licensee acknowledges that Immuta is reliant on Licensee for direction as to
the extent to which Immuta is entitled to Process Licensee Personal Data. Consequently, Immuta will not be
liable for any claim brought against Immuta by a Data Subject arising from any act or omission by Immuta
to the extent that such act or omission resulted from Licensee’s instructions or Licensee’s use of the Software.
5. If applicable Data Protection Laws recognize the roles of Controller and Processor as applied to Licensee
Personal Data then, as between Licensee and Immuta, Licensee acts as Controller and Immuta acts as a
Processor (or Subprocessor, as the case may be) of Licensee Personal Data.
6. As required by applicable Data Protection Laws, if Immuta believes any Licensee instructions to Process
Licensee Personal Data will violate applicable Data Protection Laws, or if applicable Data Protection Laws
require Immuta to process Licensee Personal Data relating to data subjects in a way that does not comply
with Licensee’s documented instructions, Immuta shall notify Licensee in writing, unless applicable Data
Protection Laws prohibit such notification, provided Immuta is not responsible for performing legal research
or providing legal advice to Licensee. Immuta shall not be liable for any liabilities or damages arising from
or in connection with any processing in accordance with Customer’s instructions following Company’s
notification to Customer in accordance with the foregoing sentence.
7. Licensee Personal Data may not include any sensitive or special data that imposes specific data security or
data protection obligations on Immuta in addition to or different from those specified in any documentation
or which are not provided as part of the Software. Immuta does not require and does not request any sensitive
or special data to provide the Software.
8. Immuta shall Process Licensee Personal Data for the duration of the provision of Software in accordance
with the Agreement and thereafter only as set forth in the Agreement and this DPA.
9. Each party will comply with Data Protection Laws applicable to such party in connection with the Agreement
and this DPA.
3.0 SUBPROCESSORS
1. Consent to Subprocessor Engagement. Licensee generally authorizes the engagement of third parties as
Subprocessors provided such engagement complies with this Section 3. For the avoidance of doubt, this
authorization constitutes Licensee’s prior written consent to the subprocessing of Licensee Personal Data for
purposes of Clause 9, Option 2 of the Standard Contractual Clauses and any similar requirements of other
data transfer mechanisms.
2. Information about Subprocessors. A current list of Subprocessors is available here (“Subprocessor List”) and
may be updated by Immuta from time to time in accordance with this DPA. Immuta will provide advance
notice of additions to the Subprocessor List via email. Notwithstanding the foregoing, Immuta may replace
a Subprocessor without advance notice where the reason for the change is outside of Immuta’s reasonable
control and prompt replacement is required for security or other urgent reasons. In such a case, Immuta will
inform Licensee of the replacement Subprocessor as soon as possible following its appointment.
3. Requirements for Subprocessor Engagement. When engaging any Subprocessor, Immuta will:
3.1 execute with Subprocessors a written agreement providing:
3.1.1 the Subprocessor only Processes Licensee Personal Data only to the extent required to
perform the obligations subcontracted to it and does so in accordance with the
Agreement and this DPA; and
3.1.2 the Subprocessor utilizes substantially the same level of data protection and security
with regard to its Processing of Licensee Personal Data as described in this DPA.
v2026-1 Internal Use
3.2 be responsible for the Subprocessor’s violations of this DPA or Data Protection Laws in relation to
the services such Subprocessor provides to Immuta to the extent Immuta would be liable for the
same violations under the terms of the Agreement.
4. Opportunity to Object to Subprocessor Changes. Licensee may, on reasonable and objective grounds, object
to Immuta’s use of a new Subprocessor by providing Immuta with written notice within ten (10) days after
Immuta has provided notice to Licensee as described herein with documentary evidence that reasonably
shows that the Subprocessor does not or cannot comply with the requirements in this DPA or Data Protection
Laws (“Objection”). In the event of an Objection, Licensee and Immuta will work together in good faith to
find a mutually acceptable resolution to address such Objection, including but not limited to reviewing
additional documentation supporting the Subprocessor’s compliance with the DPA or Data Protection Laws.
To the extent Licensee and Immuta do not reach a mutually acceptable resolution within a reasonable
timeframe, Immuta will use reasonable endeavors to make available to Licensee a change in the Software or
will recommend a commercially reasonable change to the Software to prevent the applicable Subprocessor
from Processing Licensee Personal Data. If Immuta is unable to make available such a change within a
reasonable period of time, which shall not exceed thirty (30) days, Licensee shall, as its sole remedy, have
the right to terminate the relevant Software (i) in accordance with the termination provisions in the
Agreement; (ii) without liability to Licensee or Immuta, and (iii) without relieving Licensee from its payment
obligations under the Agreement up to the date of termination.
5.0 INTERNATIONAL TRANSFERS
1. In accordance with Licensee’s instructions under Section 2, Immuta may Process Licensee Personal Data on
a global basis as necessary to provide the Software, including for IT security purposes, maintenance and
provision of the Software and related infrastructure, technical support, and change management.
2. To the extent that the Processing of Licensee Personal Data by Immuta involves the transfer of such Licensee
Personal Data from a country whose Data Protection Laws restrict the transfer of Personal Data to Third
Countries, then such transfers shall be subject to the protections and provisions of the Standard Contractual
Clauses (the Appendix for which is attached to this DPA in Schedule 1), the UK Addendum for transfers
from the UK to Third Countries, or other binding and appropriate transfer mechanisms that provide an
adequate level of protection in compliance with Data Protection Laws. For purposes of this Section 4,
transfers to the United States shall be carried out under the SCCs and UK Addendum, as applicable.
3. Licensee shall be deemed to have signed the SCC in Schedule 1, Annex I in its capacity of “data exporter”
and Immuta in its capacity as “data importer.” Module One of the SCCs shall apply when Licensee and
Immuta both act as Controller of the Personal Data. Module Two shall apply when Licensee is Controller of
the Licensee Personal Data and Immuta is Processor of such data. Module Three shall apply when Licensee
is a Processor of the Licensee Personal Data on behalf of its customer and Immuta is a subprocessor of such
data. If Module Three applies, Licensee hereby notifies Immuta that it is a Processor and the instructions
shall be as set forth in this DPA. For purposes of Clauses 17 and 18 of the SCCs, the Parties select The
Netherlands. Clause 7 is omitted. In Clause 11(a), the optional provision shall not apply. Additional
provisions applicable to customer Personal Data transferred pursuant to SCC are set forth in Schedule 2. To
the extent such a transfer includes Personal Data subject to Data Protection Laws of Switzerland, the Standard
Contractual Clauses shall be adapted to use for Switzerland (where the Swiss Federal Act on Data Protection
shall apply as the applicable Data Protection Law, Clauses 17 and 18 of the SCCs shall refer to Switzerland,
and Data Subjects in Switzerland shall be able to avail themselves of any rights conferred by the Standard
Contractual Clauses).
4. If the UK Addendum applies, then:
a. Table 1 of the UK Addendum is completed with the Parties’ details and Key Contacts of Licensee
(as data exporter) and Immuta (as data importer), as provided above. The “Start date” is the Effective
Date or other similar date of the Agreement.
b. Table 2 of the UK Addendum is completed by selecting “the Approved EU SCCs, including the
Appendix Information and with only the following modules, clauses or optional provisions of the
Approved EU SCCs brought into effect for the purposes of this Addendum”.
c. For the purposes of Table 2 and Table 3 of the UK Addendum, the “Approved EU SCCs” are
completed with the Modules, selections, and details set forth above.
d. Table 4 of the UK Addendum is completed by selecting “neither party”.
v2026-1 Internal Use
5. The SCC, or UK Addendum, as applicable, will cease to apply if Immuta has implemented an alternative
recognized compliance mechanism for the lawful transfer of personal data in accordance with applicable
Data Protection Laws.
6. In the event of any conflict between any terms in the SCC or UK Addendum, as applicable, and the DPA,
the SCC or UK Addendum, as applicable, shall prevail to the extent of the conflict.
6.0 DATA SECURITY, AUDITS, AND SECURITY NOTIFICATIONS
1. Immuta Security Obligations. Taking into account the state of the art, the costs of implementation and the
nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for
the rights and freedoms of natural persons, Immuta shall implement appropriate technical and
organizational measures designed to ensure a level of security appropriate to the risk of the Processing,
including the measures set out in Schedule 1. Immuta may update its security practices from time to time
but will not materially decrease the overall security of the Software during the term of the Agreement. Such
measures shall include processes for regularly testing, assessing, and evaluating the effectiveness of the
measures.
2. Security Audits.
a. Immuta will, upon Licensee’s written request, verify its compliance with its obligations in this DPA
by first providing to Licensee for its review documentation regarding the same and, if such
documentation is not reasonably sufficient to address Licensee’s inquiries, participate in and assist
with audits as set forth below.
b. Licensee may, upon at least 30 days’ advance written notice and at reasonable times, audit (either
by itself or using independent third-party auditors) Immuta’s compliance with the security measures
set out in this DPA solely for the purpose of confirming Immuta’s compliance with its obligations
under this DPA. Immuta shall reasonably assist with any audits conducted in accordance with this
Section 5.2. Such audits may be carried out once per year, or more often if required by Data
Protection Law or Licensee’s applicable Supervisory Authority.
c. Any third party engaged by Licensee to conduct an audit must be pre-approved by Immuta (such
approval not to be unreasonably withheld) and sign Immuta’s confidentiality agreement. Licensee
must provide Immuta with a proposed audit plan at least two weeks in advance of the audit, after
which Licensee and Immuta shall discuss in good faith and finalize the audit plan prior to
commencement of audit activities.
d. Audits may be conducted only during regular business hours, in accordance with the finalized audit
plan and Immuta’s security and other policies and may not unreasonably interfere with Immuta’s
regular business activities. Immuta is not required to grant access to its premises or systems for the
purposes of such an audit to any individual unless they produce reasonable evidence of identity and
authority. Licensee shall reimburse Immuta for any costs or expenses incurred by Immuta in
connection with the Audit or with granting access to its data processing facilities.
e. Information obtained or results produced in connection with an audit are Immuta confidential
information.
f. In lieu of Licensee auditing a Subprocessor, Licensee may request that Immuta audit a Subprocessor
or provide confirmation that such an audit has occurred (or, where available, obtain or assist
Licensee in obtaining a third-party audit report concerning the Subprocessor’s operations) to verify
compliance with the Subprocessor’s obligations.
g. Without prejudice to the rights granted in Section (b) above, if the requested audit scope is addressed
in a SOC, ISO, or similar audit report or attestation letter issued by a qualified third party auditor
within the prior twelve months and Immuta provides such report or attestation letter to Licensee
confirming there are no known material changes in the controls audited, Licensee agrees to accept
the findings presented in the third party audit report or attestation letter in lieu of requesting an audit
of the same controls covered by the report.
3. Upon Licensee’s written request, Immuta shall make available all information reasonably necessary to
demonstrate compliance with this DPA as required by Data Protection Laws.
4. Personal Data Breach Notification.
a. If Immuta or any Subprocessors becomes aware of and determines a Personal Data Breach has
occurred, Immuta will:
(i) notify Licensee of the Personal Data Breach without undue delay and, in any case, within
seventy-two (72) hours after such determination, at the contact information on file; and
v2026-1 Internal Use
(ii) investigate the Personal Data Breach and provide such reasonable assistance to Licensee (and
any law enforcement or regulatory official) as required to investigate the Personal Data Breach.
5. Notwithstanding the foregoing, because Immuta personnel may not have visibility into the content of
Licensee Personal Data, Immuta may not be able to and is not required to provide information as to the
particular nature of the Licensee Personal Data impacted by the Personal Data Breach, or where applicable,
the identities or number or categories of affected Data Subjects.
6. Except as required by applicable Data Protection Laws, the obligations set out in Section 5.4 shall not apply
to Personal Data Breaches caused by Licensee.
7. Immuta’s contact point for additional details regarding a Personal Data Breach is privacy@immuta.com.
Immuta’s provision of any notification of a Personal Data Breach shall not constitute an admission of fault.
8. Licensee is solely responsible for fulfilling any Personal Data Breach notification obligations applicable to
Licensee. Licensee and Immuta shall work together in good faith within the timeframes for Licensee to
provide Personal Data Breach notifications in accordance with Data Protection Laws to finalize the content
of any notifications to Data Subjects or Supervisory Authorities, as required by Data Protection Laws.
Immuta’s prior written approval shall be required for any statements regarding, or references to, Immuta,
Immuta’s systems, or details of the Personal Data breach made by Licensee in any such notifications.
9. Immuta shall treat Licensee Personal Data as the Confidential Information of Licensee, and shall put
procedures in place to ensure that any employees or other personnel with access to Licensee Personal Data
have committed themselves to confidentiality of Licensee Personal Data or are under an appropriate statutory
obligation of confidentiality and do not Process such Licensee Personal Data other than in accordance with
this DPA.
10. Licensee is responsible for security relating to its environment and databases and security relating its
configuration of the Software. This includes implementing and managing procedural, technical, and
administrative safeguards on its software and networks sufficient to: (a) ensure the confidentiality, security,
integrity, and privacy of Licensee Personal Data in transit, at rest, and in storage; (b) protect against any
anticipated threats or hazards to the security and integrity of Licensee Personal Data; and (c) protect against
any unauthorized processing, loss, use, disclosure or acquisition of or access to Licensee Personal Data.
Notwithstanding any other provision of this DPA, the Agreement or any other agreement related to the
Software, Immuta will have no obligations or liability as to any breach or loss resulting from: (x) Licensee’s
environment, databases, systems or software, or (y) Licensee’s security configuration or administration of
the Software.
7.0 ACCESS REQUESTS AND DATA SUBJECT RIGHTS
1. Save as required (or where prohibited) under applicable law, Immuta shall promptly notify Licensee of any
request received by Immuta or any Subprocessor from a Data Subject in respect of their Personal Data
included in Licensee Personal Data (“Data Subject Request”) and shall not respond to the Data Subject
Request where the Data Subject identifies Licensee as its Controller. If a Data Subject does not identify a
Controller, Immuta will instruct the Data Subject to identify and contact the relevant Controller.
2. For the avoidance of doubt, Immuta may communicate, without restriction, with a regulatory or judicial body
or a Data Subject if it is not reasonably apparent on the face of the request to which customer of Immuta the
request relates.
3. Where applicable, and taking into account the nature of the Processing, Immuta shall use reasonable
endeavors to assist Licensee by implementing appropriate technical and organizational measures, insofar as
this is possible, for the fulfillment of Licensee’s obligation to respond to Data Subject Requests as required
by Data Protection Laws. In order to receive such assistance, Licensee shall utilize any tools provided by
Immuta including those providing Licensee with the ability to correct, delete, block, access or copy the
Personal Data of a Data Subject. If such functionality or other tools are not available, Licensee may contact
privacy@immuta.com requesting assistance and clearly stating the nature of the Data Subject Request.
8.0 DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
1. To the extent required under applicable Data Protection Laws, Immuta shall provide reasonable assistance to
Licensee with any data protection impact assessments or prior consultations to any Supervisory Authority
of Licensee, in each case solely in relation to Processing of Licensee Personal Data and taking into account
the nature of the Processing and information available to Immuta.
v2026-1 Internal Use
2. Such cooperation and assistance are provided to the extent Licensee does not otherwise have access to the
relevant information, and to the extent such information is available to Immuta. Immuta may fulfill its above
obligations by providing Licensee with documentation regarding its Processing operations.
9.0 RETRIEVAL AND DELETION OF PERSONAL DATA
1. After (i) cessation of Processing of Licensee Personal Data by Immuta on Licensee’s written request or (ii)
termination or expiration of the Agreement, except as otherwise permitted by applicable Data Protection
Laws, Immuta shall delete and use all reasonable efforts to procure the deletion of Licensee Personal Data
Processed by Immuta or any Subprocessors, and where deletion is not possible, sufficiently de-identify
Licensee Personal Data such that it is no longer Personal Data.
2. Licensee may access Licensee Personal Data during the term of the Agreement.
3. Immuta may retain Licensee Personal Data to the extent and for such period required by applicable Data
Protection Laws, provided that Immuta shall ensure the confidentiality of all such Licensee Personal Data
and that such Licensee Personal Data is only Processed as necessary for the purpose(s) specified in the
applicable Data Protection Laws requiring its storage .
10.0 GENERAL
1. With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this
DPA and any other agreements between the parties, including but not limited to the Agreement, the
provisions of this DPA shall prevail.
2. Immuta may disclose Licensee Personal Data and other data of Licensee in connection with, or during the
negotiation of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition
of all or a portion of Immuta’s business by or to another company, including the transfer of contact
information and data of customers, partners and end users.
3. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain
valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure
its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not
possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
v2026-1 Internal Use
SCHEDULE 1
APPENDIX TO THE STANDARD CONTRACTUAL CLAUSES
ANNEX I
ANNEX I.A – LIST OF PARTIES
Data exporter(s):
Name: Identity of the Licensee as set forth in the preamble of the Agreement
Contact person’s name, position and contact details: As set forth in the Agreement
Activities relevant to the data transferred under these Clauses: Data importer provides services to data
exporter as set forth in the Agreement.
Signature and date: See the Agreement
Role (controller/processor): Controller or processor, as the case may be
Data importer(s):
Name: Immuta, Inc.
Address: See the Agreement.
Contact person’s name, position and contact details: Mike Scott, CISO, security@immuta.com
Activities relevant to the data transferred under these Clauses: Performing processing activities related to the
obligations of Immuta under the Agreement.
Signature and date: See the Agreement
Role (controller/processor): Processor or subprocessor, as the case may be
ANNEX I.B – DESCRIPTION OF TRANSFER
1. Categories of data subjects whose personal data is transferred
● Authorized Users
● Any individual whose data may be represented within Licensee data when and only to the extent
that access to the personal data of such data subjects is provided in connection with a support
request.
2. Categories of personal data transferred
● Authorized Users: Categories comprise user IDs, actions performed within an Immuta instance
such as policy or project creation and purpose or tag management, and any other personal data
provided by Authorized Users or Licensee at their sole discretion.
● Any individual whose data may be represented within Licensee data: The categories of personal
data depend on which personal data the Licensee authorizes Immuta to access in the context of a
support request. It is Immuta’s policy that authorizing Immuta to access personal data in the context
of a support request should be avoided whenever possible and should only be allowed when the
rendering of support would be impossible without Immuta’s access to such data.
3. Sensitive data transferred (if applicable).
● None.
4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
● With the exception of transfers that may happen in the context of a specific request for support, all
transfers happen on a continuous basis.
5. Nature of the processing
● Providing the Software as identified in the Agreement, which entails the automated processing of
personal data through Immuta’s cloud-based services, and other related internal activities as
described below.
6. Purpose(s) of the data transfer and further processing
● To be able to provide the Software and in particular:
i. Providing support to Licensee, including troubleshooting and debugging (preventing,
detecting, and repairing problems);
ii. Activity logging and log and security management;
v2026-1 Internal Use
iii. Other processing operations, as will be performed to comply with applicable laws.
7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to
determine that period
● As set forth in the Agreement and the DPA.
8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
● As set forth in the Agreement and the DPA.
ANNEX I.C – COMPETENT SUPERVISORY AUTHORITY
The data protection authority competent for the Data Exporter or, if the Data Exporter is not established in the
European Union or has not appointed a representative in the European Union, is the data protection authority
competent for the data subjects whose personal data are transferred under the clauses.
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATA
The technical and organizational security measures taken by Immuta include the following:
Security Controls at Immuta
Infrastructure Security
Immuta is cloud-native, including all our supporting cloud computing infrastructure and our software solution
(Software-as-a-Service).
Our cloud computing infrastructure is provided by Amazon Web Services (AWS). This infrastructure is built and
managed according to security best practices and standards and with the unique needs of the cloud in mind. AWS
uses redundant and layered controls, continuous validation and testing, and substantial automation to ensure that
the underlying infrastructure is monitored and protected 24/7.
Backups of Immuta SaaS data are taken continuously to allow for point-in-time recovery, with a maximum
recovery point objective (RPO) of 1 hour. Backups are retained for a minimum of 7 days.
Physical Security
We rely on AWS for the physical security of our supporting cloud computing infrastructure. We also take
physical security measures for our own offices (such as badge access and video surveillance).
Product Security
We have a clearly-defined software development process based on industry standard frameworks including
OWASP, ISO, and NIST, ensuring that our software is tested and ready for production use being deployed.
We take security measures to protect our software solution from cyber attacks and to detect fraudulent or malicious
activities. Our software is monitored and protected by an industry-leading continuous process of cloud security
improvement and adaptation which includes active defenses against known and unknown attacks. In addition, we
undergo periodic security measures carried out by a qualified external party (such as penetration testing).
Additional security measures we implement include encrypting your data both at rest and in transit, restricting
access based on roles and attributes, applying the need-to-know principle, requiring strong passwords and multi-
factor authentication, and maintaining monitoring logs.
Data Security
In accordance with our DPA, we process personal data in accordance with Data Protection Laws, both in terms of
security and data protection. Sub-processors are also required to comply with Data Protection Laws in the
agreements we conclude with them. We are able to host our software solution in a number of different regions as
v2026-1 Internal Use
set forth in a service agreement, to correspond with the location of your infrastructure. Immuta implements strict
access control, including purpose-based access control for all categories of personal data.
Data Retention and Access
In accordance with our DPA, we do not retain your personal data longer than necessary. We will retain your
personal data for as long as you are an active customer and for a period afterward in accordance with the DPA. In
the event your Agreement is terminated or expires, we will delete your personal data 90 days after such an event.
In the case of a trial period, we will retain your personal data for 90 days after the trial period ends, unless you
request that we delete your data sooner.
We only access your personal data on request or with your permission, for example when you sign up for or use
our Software or request Support.
Attestation & Certification
We can demonstrate that we have appropriate controls in place to mitigate security, availability, confidentiality,
processing integrity, or privacy risks.
Our security measures are audited annually by an independent and external party in the context of SOC 2 Type 2
and PCI-DSS attestation and ISO 27001/27701 certifications. If you need more information or if you would like to
receive our SOC 2 Type 2 report, PCI-DSS AOC, or ISO 27001/27701 certificates, please contact us at
revops@immuta.com.
ANNEX III
LIST OF SUB-PROCESSORS
The list of sub-processors engaged by Immuta is available on Immuta’s website at
https://www.immuta.com/trust.
SCHEDULE 2 – ADDITIONAL SCC PROVISIONS
BASED ON EUROPEAN DATA PROTECTION BOARD RECOMMENDATIONS
1. Government Disclosure Requests.
a. Immuta shall, unless otherwise prohibited by law or a legally binding order of an applicable body
or agency, promptly notify Licensee or the applicable data subject of any request for the disclosure
of Licensee Personal Data by a governmental or regulatory body or law enforcement authority
(including any Supervisory Authority) (“Disclosure Request”) without responding to such request,
unless otherwise required by applicable law (including to provide acknowledgement of receipt of
the request). If applicable laws prohibit Immuta from informing Licensee or the applicable data
subject of the Disclosure Request, Immuta shall use reasonable efforts to obtain a waiver of such
restrictions and shall in any event provide such notification as soon as any relevant restrictions are
lifted.
b. Immuta will review applicable law to evaluate any Disclosure Request, for example the ability of
the requesting authority to make the Disclosure Request, and to challenge the Disclosure Request
if, after a careful assessment, it concludes that there are grounds under applicable law to do so. When
challenging a Disclosure Request, Immuta shall seek interim measures to suspend the effects of the
Disclosure Request until an applicable court or other authority has decided on the merits. Immuta
shall not disclose Licensee Personal Data requested until required to do so under applicable law.
Immuta shall only provide the minimum amount of Licensee Personal Data permissible when
responding to the Disclosure Request, based on a reasonable interpretation of the Disclosure
Request.
c. If the Disclosure Request is incompatible with the SCCs or other data transfer mechanism utilized
in accordance with Section 4 in this DPA, Immuta will so notify the requesting authority and, if
permitted by applicable law, notify the competent EEA government authority with jurisdiction over
the Licensee Personal Data subject to the Disclosure Request.
v2026-1 Internal Use
d. Immuta will maintain a record of Disclosure Requests and its evaluation, response, and handling of
the requests. Immuta will provide Licensee with such records relevant to Licensee Personal Data
except as prohibited by applicable law or legal process or in the interest in protecting Immuta’s legal
rights in connection with threatened, pending, or current litigation.
e. Immuta will maintain internal policies and/or procedures related to the handling of Disclosure
Requests.
2. Immuta has, as of the Effective Date, not received any national security orders under Foreign Intelligence
Surveillance Act (“FISA”) Section 702.
3. As of the Effective Date, no court has found Immuta to be the type of entity defined in 50 U.S.C § 1881(b)(4)
eligible to receive process issued under FISA Section 702.
4. Immuta has not purposefully created “back doors” or similar programming in its systems that provide
Software that could be used to access the systems and/or Licensee Personal Data, nor has Immuta
purposefully created or changed its business processes in a manner that facilitates access to Licensee Personal
Data or its systems that provide the Software. To the best of Immuta’s knowledge, United States Data
Protection Laws do not require Immuta to create or maintain “back doors” or to facilitate access to Licensee
Personal Data or systems that provide Software or for Immuta to possess or provide the encryption key in
connection with a United States Disclosure Request.
5. The parties shall each monitor Data Protection Laws, and upon any changes to the same, either party may
request to amend the DPA in such a manner as it determines necessary to comply with such amended Data
Protection Laws and the parties shall thereafter negotiate in good faith an amendment to this DPA. If the
parties are unable to agree on an amendment within thirty (30) days, a) either party may terminate the DPA
as set forth in the Agreement, b) the parties may explore options to further protect the Licensee Personal Data
or alter the Processing so as to mitigate certain risks identified by the parties, or c) request the destruction
and/or return of Licensee Personal Data as set forth in the DPA.
6. Immuta shall use reasonable efforts to assist Licensee and its Data Subjects, as instructed by Licensee (in
accordance with Section 6 of the DPA), regarding Disclosure Requests, unless prohibited by applicable law,
for example to provide information to Licensee in connection with the Data Subject’s efforts to exercise its
rights and obtain legally available redress, provided Immuta shall not be required to provide Licensee or Data
Subjects with legal advice.
7. Immuta will maintain internal policies and/or procedures related to transfers of Personal Data of customers.
Immuta has procedures for applicable personnel to receive information, as appropriate, regarding applicable
transfers of Licensee Personal Data, where such information may include an explanation of the necessity of
the transfer and any data protection safeguards in scope. Personnel responsible for reviewing requests to
transfer Personal Data of customers may include IT, security, compliance, and legal personnel.
8. In the event Immuta receives a request to voluntarily disclose unencrypted Licensee Personal Data to a
government authority, Immuta will use reasonable efforts to first obtain Licensee’s consent, either on its
behalf or on behalf of the relevant Data Subject, unless Immuta has already obtained Licensee’s implied
consent.
v2026-1 Internal Use