Snapshot 2107
Normalized text
Scripts and page chrome removed; this is what change detection compares.
AMENDMENT TO DATA PROCESSING AGREEMENT
The entity as set out in the table below (“Customer”) entered into a Master Subscription Agreement
(“MSA”) and a Data Processing Addendum and/or data processing terms (collectively, the “DPA”; and
jointly with the MSA, the “Agreement”) either by way of signature or by acceptance of an order form with
Zuora, Inc. (“Zuora”). Customer and Zuora are together referred to as the “Parties”. In consideration of
the mutual obligations set out below, the Parties wish to amend the terms of the DPA as set out in this
“Amendment”. Except as modified below, the terms of the Agreement shall remain in full force and
effect.
WHO SHOULD EXECUTE THIS AMENDMENT
Customers who executed a DPA prior to June 2021 and wish to amend that DPA to reflect new
requirements under Privacy Law. In the alternative, Customer may execute Zuora’s Customer Data
Processing Agreement located on Zuora’s Legal Resources webpage.
HOW TO EXECUTE
1. Please complete the table below and sign page 3 (“Signature Page”). Except if expressly
provided otherwise in the MSA, this Amendment will become legally binding upon receipt by Zuora
of the validly completed table and executed Signature Page (“Effective Date”).
2. For the avoidance of doubt, executing this Amendment shall be deemed to constitute acceptance
of the Standard Contractual Clauses as of the Effective Date. Where Customer wishes to
separately execute Standard Contractual Clauses, Customer should contact Zuora Privacy, who
will provide a copy of the applicable Standard Contractual Clauses in an executable format.
3. Send this signed Amendment to privacy@zuora.com.
Customer Name
Postal Address
(street, city, state, country, postal code)
Privacy/Security Alias
(e.g., privacy@yourcompany.com)
MSA Date
(Please list date MSA is signed or
“contemporaneous”)
1. Definitions. In addition to the defined terms in the Agreement, the following definitions shall apply
to this Amendment: (a) “Customer Personal Data” means that portion of Customer Data that
includes personal data or personal information or their equivalent as they are defined under Privacy
Laws and Financial Account Data; (b) “Standard Contractual Clauses” means (i) where the GDPR
applies, module 2 of the contractual clauses annexed to the European Commission's Implementing
Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data
to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the
Council, a copy of which is accessible here: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj and
any successor clauses issued from time to time and officially published (“EU SCCs”); and (ii) where
the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under
Article 46 of the UK GDPR, available here https://ico.org.uk/media/for-
organisations/documents/4019539/international-data-transfer-addendum.pdf, and any successor
clauses issued from time to time and officially published by the UK (“UK SCCs”); (c) “Subprocessor”
means an entity engaged by Zuora for the provision of the Services; a list of Subprocessors who
may Process Customer Personal Data is included with Annex III to Exhibit 1; (d) “Swiss DPA” means
the Swiss Federal Data Protection Act of 19 June 1992 and Swiss Federal Ordinance to the Federal
Act on Data Protection of 14 June 1993, including all subsequent amendments or revisions; and (e)
“UK Data Protection Laws” means the UK General Data Protection Regulation (as incorporated
into UK law under the European Union (Withdrawal) Act 2018), and the UK Data Protection Act 2018,
both as amended by the Data Protection, Privacy and Electronic Communications (Amendments
etc.) (EU Exit) Regulations including all subsequent amendments or revisions.
2. EU SCCs. The Parties agree that Module 2 (Controller to Processor) will apply if Customer is a
controller of Customer Personal Data and Module 3 (Processor to Processor) will apply where both
Customer and Zuora are processors of Customer Personal Data. For each applicable EU SCC
module the following applies for each of the listed Clauses: (a) Clause 7, the optional docking clause,
will not apply; (b) Clause 8.1(a), the instructions by Customer to process Customer Personal Data
include onward transfers to a third party outside of European Union for the purpose of performing the
Services; (c) pursuant to Clauses 8.5 and 16(d), upon termination of the Services, Customer
Personal Data will be destroyed in accordance with the Agreement terms and Zuora will provide a
certification of deletion upon request; (d) Clause 8.6(a), Customer is solely responsible for
determining as to whether the technical and organization measures instituted by Zuora meet
Customer’s requirements (taking into account the state of the art, costs of implementation, and the
nature, scope, context and purposes of the processing of Customer Personal Data; (e) Clause 8.6(c),
personal data breaches, and the audit described in Clause 8.9, each shall be handled as set forth in
the Agreement; (f) Clause 9, Option 2 will apply and the time period for prior notice of Subprocessor
changes shall be thirty (30) days or as otherwise set out in the Agreement (whichever is longer) and
Zuora will make available the current list of Subprocessors upon request; (g) Clause 11, the optional
language will not apply; (h) Clause 12, Zuora’s liability shall be limited to any damage caused by its
processing where Zuora has not complied with its obligations under the GDPR specifically directed
to Processors or where it has acted outside of or contrary to lawful instructions of Customer, as
specified in Article 28 provided that, no Party may limit its liability with respect to any data subject’s
rights under the GDPR; (i) Clause 13 and Annex I shall be completed as follows, the “competent
supervisory authority” is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02
RD28, Ireland; (j) any reference to “competent supervisory authority” and “competent courts” shall be
replaced with the respective choice of law set out in the MSA and if none, shall be the laws and courts
of Ireland; and (k) Annexes I-III of the EU SCCs shall be deemed completed with the information set
out in Exhibit 1 to this Amendment and as set out in the DPA.
3. Local Laws. As of the execution of this Amendment, Zuora has no reason to believe that the laws
and practices in any country of destination applicable to its processing of Customer Personal Data,
including any requirements to disclose Customer Personal Data or measures authorizing access by
a government agency or a supervisory authority, prevent Zuora from fulfilling its obligations under the
Agreement (including this Amendment). If Zuora reasonably believes that any existing or future
enacted or enforceable law in the country of destination applicable to its processing of Customer
Personal Data ("Local Laws") prevent it from fulfilling its obligations, it shall promptly notify Customer.
In such a case, Zuora shall use reasonable efforts to make available to the affected Customer a
change in the Services or recommend a commercially reasonable change to Customer’s
configuration or use of the Services to facilitate compliance with the Local Laws without unreasonably
burdening Customer.
4. Swiss DPA. Where Customer is established in Switzerland or falls within the territorial scope of
application of the Swiss DPA, the Swiss Federal Data Protection and Information Commissioner shall
act as competent supervisory authority. With respect to the transfer Customer Personal Data subject
to the Swiss DPA, the Parties agree that the EU SCCs shall be applied as follows: (a) any reference
to GDPR, including any specific articles, shall be interpreted as the Swiss DPA; (b) any reference to
Website Amendment Version 1│ Last Updated: October 12, 2022 Page 2
EU, Union or Member State shall be replaced with Switzerland; (c) Clause 13(a) and Part C of Annex
I of Exhibit 1 of this Amendment shall not be used; (d) any reference to “competent supervisory
authority” and “competent courts” shall be replaced with references to the Swiss Federal Data
Protection Information Commissioner and courts of Switzerland; (e) Clause 17 shall state the laws of
Switzerland; and (f) Cause 18 shall be replaced with: “Any dispute arising from these Clauses shall
be resolved by the competent courts of Switzerland. The parties agree to submit themselves to the
jurisdiction of such courts.”
5. UK Data Protection Laws. Where Customer is established in the United Kingdom or falls within the
territorial scope of application of the UK Data Protection Laws, the Information Commissioner's Office
shall act as competent supervisory authority. With respect to the transfer of Customer Personal Data
governed by UK Data Protection Laws, the UK SCCs shall apply. The information required to
complete the UK SCCs Tables 1 to 3 for Party One is included in this Amendment under Exhibit 1
and/or the Agreement (as applicable).
6. Replacement Standard Contractual Clauses. Should the Standard Contractual Clauses be
replaced or modified, Zuora and Customer will work in good faith to execute such terms as required
to meet their respective obligations under the GDPR, UK GDPR, Swiss DPA or other applicable
Privacy Laws.
7. California Specific Provisions. If applicable to the Services provided, the parties agree that Zuora
is a Service Provider as such term is defined under the CCPA and its implementing regulations.
Customer discloses Customer Personal Data to Zuora solely for a valid business purpose and to
perform the Services. Zuora is prohibited from: (a) selling or sharing Customer Personal Data; (b)
retaining, using, or disclosing Customer Personal Data for a commercial purpose other than providing
the Services; or (c) retaining, using, or disclosing Customer Personal Data for purposes outside of
complying with its obligations under the Agreement.
8. Duration. This Amendment and the DPA will remain in force for so long as Zuora Processes
Customer Personal Data.
9. Instructions. The Agreement and this Amendment are Customer’s complete and final documented
instructions at the time of signature of the Amendment to Zuora for the processing of Customer
Personal Data. Any additional or alternate instructions must be consistent with the terms of the
Agreement.
Customer: __________________________ Zuora, Inc.
By: ________________________________
Evan Henschel
Printed Name: _______________________ Evan Henschel
Title: _______________________________ Vice President, Deputy General Counsel
Website Amendment Version 1│ Last Updated: October 12, 2022 Page 3
Exhibit 1 to Amendment
ANNEX I
A. LIST OF PARTIES
Data exporter: Customer
Address and Contact Details: as set forth in the Agreement.
Activities relevant to the data transferred under these Clauses: Services specified herein
Role: controller
Data importer: Zuora, Inc.
Address and Contact Details: as set forth in the Agreement, privacy@zuora.com …
Activities relevant to the data transferred under these Clauses: Services specified herein
Role: processor
B. DESCRIPTION OF TRANSFER
1. Data subjects
a. Past and present employees of the Customer;
b. Past and present partners of the Customer, and their employees, partners, advisors,
consultants, suppliers, contractors, subcontractors and agents; and
c. Past and present customers of the Customer, and their employees, partners, advisors,
consultants, suppliers, contractors, subcontractors and agents.
2. Categories of data
a. Contact details (including at least name, address, e-mail address, phone and fax contact
details and associated local time zone information) for Customer and its User(s);
b. IT systems information (including at least user ID and password, computer name, domain
name, IP address, and software usage pattern tracking information);
c. User(s) or data subject's e-mail content and transmission data which is available on an
incidental basis for the provision of information technology consultancy, support and Service
(incidental access may include accessing the content of e-mail communications and data
relating to the sending, routing and delivery of e-mails); and
d. For each customer, User or partner of Customer, financial details for at least one method of
payment (e.g., credit card number, bank details, data required for other payment methods).
3. Special categories of data: Not applicable
4. Frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous
basis)
Ad hoc. Zuora may remotely access Customer Personal Data when providing the Services on
one-off basis upon request by Customer, such as to provide support for using Services
5. Nature of the processing
Zuora will use and otherwise process Customer Personal Data as described in the Agreement (a)
to provide Services to the Customer in accordance with Customer’s documented instructions
under the Agreement, and (b) for business operations incident to providing the Services to
Customer.
Website Amendment Version 1│ Last Updated: October 12, 2022 Page 4
6. Purpose(s) of the data transfer and further processing
For purposes herein:
• “to provide” the Services consists of the following actions: (1) delivering functional capabilities
as licensed, configured, and used by Customer and its Users, including providing
personalized user experiences; (2) troubleshooting (preventing, detecting, and repairing
problems); and (3) ongoing improvement (installing the latest updates and making
improvements to user productivity, reliability, efficacy, quality, and security).
• “business operations” consists of the following, each as incident to delivery of the Services to
Customer: (1) billing and account management; (2) internal reporting; (3) combatting fraud,
cybercrime, or cyber-attacks that may affect Services; (4) improving the core functionality of
accessibility, privacy or efficiency of Services; and (5) compliance with legal obligations as
stated herein. When processing for these business operations, Zuora will apply principles of
data minimization and will not use or otherwise process Customer Personal Data for: (a) user
profiling, (b) advertising or similar commercial purposes, or (c) any other purpose, other than
for the purposes set out in the Agreement.
7. The period for which personal data will be retained, or, if that is not possible, the criteria
used to determine that period
Customer Personal Data will be retained for the Agreement term. Customer has the ability to
rectify, erase or restrict the Processing of Customer Personal Data via the functionalities of the
Services. If Customer is unable to use the functionalities, Zuora will rectify, erase or restrict the
Processing of Customer Personal Data as instructed by Customer.
8. Subprocessor Transfers
As per the Agreement, Subprocessors will process Customer Personal Data as necessary to
perform the Services. Identities of the Subprocessors used for the provision of the Services and
their country of location are made available by Zuora through its website. Please contact
privacy@zuora.com for additional information.
ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
The parties incorporate by reference Zuora’s Security Addendum.
ANNEX III – LIST OF SUBPROCESSORS
The Parties incorporate by reference Zuora’s List of Subprocessors.
Website Amendment Version 1│ Last Updated: October 12, 2022 Page 5