Snapshot 21176
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Babel Street, Inc.
Data Processor Addendum
Last Updated: 1.31.26
This Data Processor Addendum (“Addendum”) supplements, and is incorporated into, the Babel
Street End User Subscription Terms governing Customer’s use of the Babel Street Services. This
Addendum is the Parties’ agreement with regard to the Processing of Personal Data and is entered
into to apply together with all agreements in the course of which Babel Street, Inc. (“Babel Street”)
or its Affiliates process Personal Data on behalf of the Customer and its authorized Affiliates, such
as License, Subscription, Services, Support and Maintenance or any other written agreement or
agreement in text form (the “Agreements”) for purchase from Babel Street of software as a service
(including associated Applications), hosting, support and similar data processing services, and
defined as “Services” or otherwise in the Agreement(s) or hereinafter.
Babel Street and Customer may be hereinafter collectively referred to as the “Parties” and
individually as a “Party.” This Addendum is effective as of the date the Customer enters into the
Agreements. The Parties enter into this Addendum on behalf of themselves and, to the extent
required under Applicable Data Protection Laws, in the name and on behalf of their Affiliates and
authorized representatives. The terms used in this Addendum shall have the meanings set forth in
this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to
them in the Babel Street End User Subscription Terms. Except as modified below, the terms of the
Agreements shall remain in full force and effect and are incorporated herein by this reference.
WHEREAS, the Parties acknowledge that each Party may Process Personal Data for the purposes set
forth in the Agreements.
WHEREAS, for compliance with obligations under Applicable Data Protection Laws, the Parties wish
to enter into this Addendum to arrange each Party’s responsibilities and to capture a process
ensuring the enforceability of Data Subjects’ rights under Applicable Data Protection Laws. The
Parties acknowledge that Data Subjects include without limitation any and all workers performing
services for the Company under the Agreements.
1. Key definitions.
The following terms shall have the following meanings:
“Affiliate” means an entity that owns or controls, is owned or controlled by, or is under common
control or ownership with a Party, where control is defined as the possession, directly or indirectly, of
the power to direct or cause the direction of the management and policies of an entity, whether
through ownership of voting securities, by contract or otherwise.
“Applicable Data Protection Laws’’ means any applicable legislative or regulatory regime enacted
by a recognized government, or governmental or administrative entity with the purpose of protecting
the privacy rights of natural persons or households consisting of natural persons, including without
limitation the General Data Protection Regulation 2016/679 (“GDPR”) and supplementing data
protection law of the European Union Member States; the United Kingdom’s Data Protection Act 2018
and the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s
European Union (Withdrawal) Act 2018 (“UK GDPR”); the Swiss Federal Data Protection Act (“Swiss
DPA”); Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) S.C.
2000, ch. 5, and any provincial legislation deemed substantially similar to PIPEDA under the
procedures set forth therein; and any applicable laws of any United States jurisdiction, including
without limitation the California Consumer Privacy Act of 2018 and California Privacy Rights Act
(together, the “CPRA”), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and any
other such applicable law that comes into effect during the term of the Agreements.
"Artificial Intelligence" (AI), means the simulation of human intelligence processes by a machine-
based system that is designed to operate with varying levels of autonomy and that may exhibit
adaptiveness, learning, reasoning, or self-correction after deployment.
“Babel Street AI” refers to the Artificial Intelligence capabilities within Babel Street Services that, for
explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as
predictions, content, recommendations, or decisions that can influence physical or virtual
environments.
“Controller” means the natural or legal person, public authority, agency, or other body which, alone
or jointly with others, determines the purposes and means of the Processing of Personal Data.
“Personal Data” means any structured set of information relating to an identified or identifiable
natural person (‘data subject’) which are accessible according to specific criteria, whether centralized,
decentralized or dispersed on a functional or geographical basis and which are obtained by or made
available to Babel Street in connection with the Services.
“Services” means the Babel Street Application and/or Services described in the Agreements or an
Order Form to which Customer has subscribed.
“Subprocessor” means third party organizations engaged by and acting under the instructions of a
Processor for the Processing of Personal Data on behalf a Controller.
“Training Data” means any data used to develop, train, validate, test or otherwise improve Babel
Street AI.
The terms “Data Subject”, “Personal Data Breach”, “Process/Processed/Processing”,
“Processor”, and “Supervisory Authority” have the meaning set out in the GDPR, and the terms
“business,” “service provider,” “sell” and “share” shall have the same meaning as set forth in
Applicable Data Protection Laws, and their cognate terms shall be construed accordingly.
2. Compliance with the Customer’s instructions
Babel Street shall be a Processor Processing Personal Data on behalf of the Customer, acting as a
Controller, and this Addendum shall apply accordingly. Where Customer is a Processor of the
Personal Data covered by this Addendum, Babel Street shall be a Subprocessor of Customer and
this Addendum shall apply accordingly. Customer is solely responsible for the quality, accuracy and
integrity of Customer Data (including without limitation, any Personal Data) inputted into the
Services in relation to the Agreements. Babel Street may only Process Personal Data in connection
with its provision of the Services to Customer pursuant to the Agreements and as set out in
Attachment A, or as otherwise in accordance with the documented instructions of Customer (which
may be provided to Babel Street from time to time, including for example by way of letter of
instruction or through the Customer’s use of Babel Street settings, controls or other user preference
functionality within the Services), or required by Applicable Data Protection Laws. The subject-
matter, duration, nature and purpose of the Processing, types of Personal Data and categories of
individuals will be the same as for the relevant Term of Customer’s access to the Services to which
the Processing relates. Any Processing unrelated to the provision of the Services set forth in
Attachment A will require additional consent and approval of the Parties. For the avoidance of doubt,
Babel Street shall not sell, assign, or lease Customer Data. Each Party shall notify the other Party
immediately of any known violation of Applicable Data Protection Laws.
Customer represents and warrants that: (i) its use of the Services and the documented instructions
provided do not contravene Applicable Data Protection Laws; (ii) it has complied with and continues
to comply with Applicable Data Protection Laws, in particular that it has obtained any necessary
consents and/or given any necessary notices, and/or otherwise has the right to disclose Personal
Data to Babel Street and enable the Processing set out in this Addendum and as contemplated by
the Agreements; (iii) it has assessed the requirements under Applicable Data Protection Laws as
they apply to Customer with regard to Personal Data and finds that the security measures referenced
herein are adequate to meet those requirements; and (iv) it will ensure compliance with and shall
not in any way alter or diminish such security measures to the extent applicable to Customer through
its use of the Services. Customer will also ensure that any Authorized User(s) (including users from
its Affiliates or any third-party) will comply with the Customer’s obligations under this Addendum.
Customer shall be liable for any acts or omissions of its Authorized User(s) in their use of the Services.
3. Security
Customer acknowledges that the Services are not designed for Processing the following categories
of information: (a) "Protected Health Information" or "PHI" as that term is defined by the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, and its implementing
regulations at 45 CFR §160.103; (b) “Cardholder Data” or “Sensitive Authentication data”, as such
terms are defined in the Payment Card Industry Data Security Standard (“PCI DSS”).
Notwithstanding the foregoing, Babel Street will implement appropriate technical and organizational
measures for the Services that are designed to protect Customer Data (including without limitation,
any Personal Data) against accidental or unlawful destruction, loss, alteration, disclosure or access,
taking into account the state of the art, the costs of implementation, and the nature, scope, context
and purposes of Processing as well as the risk of varying likelihood and severity for the rights and
freedoms of natural persons, including, but not limited to, the measures set forth in Attachment B to
this Addendum. In the event of a Personal Data Breach, Babel Street shall notify Customer without
undue delay and in accordance with Applicable Data Protection Laws. Such security procedures and
practices include an information security program consistent with the NIST 800-171 Standards and
ISO 27001 requirements.
4. Audits
Upon Customer’s reasonable request, Babel Street shall, no more than once per calendar year,
make available for Customer’s review, copies of certifications or reports demonstrating Babel
Street’s compliance with this Addendum and Applicable Data Protection Laws. This includes, but is
not limited to, providing mutually agreeable assistance in submitting to an audit, provided such audit
is limited to the purposes of demonstrating compliance with Applicable Data Protection Laws, this
Addendum, and/or the Agreements. Before the commencement of such an audit, Customer and
Babel Street will mutually agree upon the scope, timing, duration, control and evidence
requirements, and fees for the audit. If the audit report generated as a result of Customer’s audit
includes any finding of material non-compliance, Customer shall share such audit report with Babel
Street and Babel Street shall promptly cure any material non-compliance. All such information
contained in an audit report shall be deemed to be the Parties’ Confidential Information. If the
Customer and Babel Street have entered into SCCs (defined below), the Customer’s right to audit
Babel Street’s activities under the SCCs shall be interpreted in line with this Addendum, so as to be
satisfied by the audit rights provided to the Customer.
5. Assistance
Babel Street shall, taking into account the nature of the Processing and the information available to
Babel Street, assist Customer in ensuring compliance with its obligations under Applicable Data
Protection Laws to conduct a data protection impact assessment or similar assessment required
under any Applicable Data Protection Laws and, with prior notice, to assist with consultations with
a Supervisory Authority, where required. In the event of a confirmed Personal Data Breach, Babel
Street shall provide notification to Customer consistent with the GDPR, or other applicable law, and
take such steps as Babel Street in its sole discretion deems necessary and reasonable to remediate
such Breach. In the event of such a Personal Data Breach, Babel Street shall, taking into account the
nature of the Processing and the information available to Babel Street, provide Customer with
reasonable cooperation and assistance necessary for Customer to comply with its obligations under
Applicable Data Protection Laws with respect to notifying (i) the relevant Supervisory Authority
and/or (ii) Data Subjects affected by such Personal Data Breach. These obligations shall not apply in
the event that a Personal Data Breach results from the actions or omissions of Customer, except
where required by Applicable Data Protection Laws. Babel Street’s obligation to report or respond to
a Personal Data Breach under this section will not be construed as an acknowledgement by Babel
Street of any fault or liability with respect to the Personal Data Breach.
6. Individuals
If Babel Street receives requests directly from individuals in relation to the Processing of their
Personal Data used by Customer through the Services, Babel Street will notify Customer of the
request, without responding to it, unless Babel Street has been authorized to respond, or is
prohibited from doing so under applicable law. Customer is solely responsible for providing any
necessary notices to, and obtaining any necessary consent from, individuals with respect to the
Processing of Customer Data (including without limitation, any Personal Data) pursuant to the
Agreements.
7. Subprocessors
Customer agrees that Babel Street may use Subprocessors to assist Babel Street in performance of
the Agreements, provided that:
(i) Babel Street imposes no less stringent duties on such Subprocessors regarding security and
confidentiality as those set out in this Addendum;
(ii) Babel Street remains responsible to Customer for the performance of the relevant Services by the
Subprocessor; and
(iii) Babel Street maintains a list of such Subprocessors and will provide Customer with reasonable
notice of any addition of Subprocessors. Customer may within five (5) days of receiving the notice,
object to the involvement of such new Subprocessor in the delivery of the Services through providing
notice of objective justifiable grounds related to the ability of such Subprocessor to protect Personal
Data or comply with Applicable Data Protection Laws. In the event that the objection is not
unreasonable, the Parties will work together in good faith to find a solution to address such objection
including but not limited to reviewing additional documentation supporting the Subprocessors’
compliance or trying to make the Services available without the involvement of such Subprocessor. If
the foregoing is not commercially feasible, Babel Street may terminate Customer’s access to the
Services in accordance with the Agreements.
8. Transfers
Customer acknowledges and agrees that Babel Street may transfer to and Process Personal Data in
the United States and anywhere else in the world where Babel Street, its Affiliates, or its
Subprocessors maintain Processing operations. Babel Street shall ensure that such transfers are
made in compliance with Applicable Data Protection Laws and this Addendum.
EEA. The Parties acknowledge and agree that each Party may Process Personal Data and/or
permit Personal Data to be Processed in accordance with this Addendum in a territory
outside the European Economic Area (“EEA”) or Switzerland. Therefore, for the purposes of
compliance with Applicable Data Protection Laws relating to cross-border transfers of
Personal Data, the Parties have executed the Standard Contractual Clauses published by
the European Commission (“SCCs”) which are incorporated herein by reference. If required,
each Party will ensure that any of its Subprocessors also comply with the applicable module
of the Standard Contractual Clauses.
Any transfer of Personal Data from member states of the European Union, the EEA (Iceland,
Liechtenstein, Norway), and/or Switzerland to any third country that the European
Commission has decided does not ensure an adequate level of protection for Personal Data
(“Third Country”) shall be made in accordance with the SCCs, in connection with which the
Parties agree the following:
In relation to Personal Data that is subject to GDPR and Processed in accordance with this
Addendum, the SCCs shall apply, completed as follows: Module Two (Controller to Processor
transfers) will apply; in Clause 7, the optional docking clause will apply; in Clause 9, the
general authorization will apply; in Clause 11, the optional language will not apply; in Clause
17, Option 1 will apply and the SCCs will be governed by the law of the Netherlands; in Clause
18(b), disputes will be resolved before the courts of the Netherlands; Annex I of the SCCs shall
be deemed completed with the information set out in Attachment A to this Addendum; and
Annex II of the SCCs shall be deemed completed with the information set out in Attachment
B to this Addendum.
In relation to Personal Data that is subject to the Swiss DPA, the SCCs will apply in
accordance with the terms set forth above, with the following modifications: any references
in the SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” shall be interpreted as
references to Switzerland and Swiss law, as the case may be; and references to the
“competent supervisory authority” and “competent courts” shall be interpreted as
references to the FDIPC and competent courts in Switzerland, unless the SCCs as
implemented above cannot be used to lawfully transfer such Personal Data in compliance
with the Swiss DPA, in which event the Swiss Standard Contractual Clauses shall instead be
incorporated by reference and form an integral part of this Addendum and shall apply to such
transfers. Where this is the case, the relevant Annexes of the Swiss Standard Contractual
Clauses shall be populated using the information contained in Attachment A & B to this
Addendum (as applicable).
With respect to transfers of personal data originating from the United Kingdom, the Parties
acknowledge and agree that the SCCs as modified by this Section shall be read and
interpreted in light of the provisions of UK Data Protection Laws, and so that this Section
provides the appropriate safeguards as required by Article 46 of the UK GDPR:
The ‘Start Date’, ‘Parties’, and “Key Contact” shall be as listed in Attachment A of this
Addendum; Clause 6 is replaced with: “The details of the transfers and in particular the
categories of personal data that are transferred and the purposes for which they are
transferred are those specified in Annex I where UK Data Protection Laws apply to the data
exporter’s processing when making that transfer”; References to “Regulation (EU) 2016/679”
or “that Regulation” are replaced by “UK Data Protection Laws” and references to specific
Articles of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of
the UK Data Protection Laws; references to Regulation (EU) 2018/1725 are removed;
references to the “Union”, “EU” and “EU Member State” are all replaced with the “UK”;
Clause 13(a) and Annex I.C are not used; The “competent supervisory authority” is the
Information Commissioner’s Office (ICO) of the United Kingdom; Clause 17 is replaced to
state “These Clauses are governed by the laws of England and Wales”; Clause 18 of the EU
SCCs is replaced to state "Any dispute arising from these Clauses shall be resolved by the
courts of England and Wales. A data subject may bring legal proceeding against the data
exporter and/or data importer before the courts of any country in the UK. The Parties agree to
submit themselves to the jurisdiction of such courts", unless the EU SCCs as implemented
above cannot be used to lawfully transfer such Personal Data in compliance with the UK
GDPR, in which event the UK SCCs shall instead be incorporated by reference and form an
integral part of this Addendum and shall apply to such transfers. Where this is the case, the
relevant Annexes of the UK SCCs shall be populated using the information contained in
Attachment A & B to this Addendum (as applicable). Either Party may end the UK Addendum
as set out in Section 19 of the UK Addendum to the SCCs, where reasonable and subject to
other applicable terms of the Agreements. The Alternative Part 2 Mandatory Clauses shall
apply, as follows: Part 2: Mandatory Clauses of the Approved Addendum, being the template
Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of
the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those
Mandatory Clauses.
Babel Street may adopt a replacement data export mechanism (including any new version of
or successor to the SCCs or alternative mechanisms adopted pursuant to Applicable Data
Protection Laws) ("Alternative Transfer Mechanism"). So long as the Alternative Transfer
Mechanism complies with Applicable Data Protection Laws and extends to the territories to
which the Personal Data is transferred, Customer agrees to execute any documents and take
any other reasonably necessary actions to give legal effect to such Alternative Transfer
Mechanism.
It is not the intention of either Party to contradict or restrict any of the provisions set forth in
the SCCs and, accordingly, if and to the extent the SCCs conflict with any provision of the
Agreements (including this Addendum) the SCCs shall prevail to the extent of such conflict.
9. Return & deletion
Upon termination or expiration of the Agreements, Babel Street will make Customer Data (including
without limitation, any Personal Data) maintained by Babel Street available to Customer for thirty
(30) days to allow Customer to retrieve, where reasonably technically feasible and permitted by the
Agreements, copies of such data in a commonly used format set out by Babel Street. After such
period, Babel Street will destroy or otherwise render inaccessible, at Customer’s written request,
Customer Data (including without limitation, any Personal Data) from the production environment
of the Services, except as may be required by law or applicable third-party terms of use.
10. Babel Street AI
As a part of fulfilling its obligations (including providing the Services) under the Agreements and this
Addendum, Babel Street may utilize AI. The terms in this section govern the use of Babel Street AI,
and they do not apply to the use of any third-party products or third-party sites that are powered by
artificial intelligence, machine learning, or similar technologies. The Parties acknowledge and agree
that:
1. Babel Street representations & warranties
a. Unless otherwise set forth in the Agreements, Customer acknowledges and agrees that Babel
Street may use AI tools available within the Services (“Babel Street AI”).
b. Customer may also input, enter, post, upload, submit, transfer, transmit, or otherwise
provide information, data, materials, text, prompts, images, documentation or other content
(including tables, numbers, photos, reports, graphs, video, audio, or computer code) (“AI
Input”), for Processing by or through Babel Street AI to generate or produce data, materials,
text, images, documentation, insights or other content (including tables, numbers, photos,
reports, graphs, video, audio, or computer code) (“AI Output”), as a result of AI Input. AI
Output is considered “Customer Data” under this Addendum and the Babel Street End User
Subscription Terms, and is subject to all applicable conditions and restrictions herein.
c. No AI Input or any parts thereof will be stored, used, processed or accessed by Babel Street
AI, except to the extent necessary to provide, maintain, and improve the Services.
d. Unless otherwise set forth in the Agreements, Babel Street may use anonymous, aggregate
information derived from the use and operation of Babel Street AI for its own business
purposes, including but not limited to using AI Input and AI Output as Training Data where: (i)
Customer provides feedback regarding AI Output, or (2) AI Input or AI Output are flagged for
review to detect harmful content, enforce Babel Street terms and policies, or comply with
applicable law.
e. Babel Street shall follow its AI Usage Policy, ensuring that Babel Street AI systems are
developed and used in ways that respect human rights and promote fairness, accountability,
and transparency. Babel Street’s use of AI and development of Babel Street AI conforms to
prevalent industry standards and practices.
f. Babel Street AI has been and shall be designed and developed in such a way, including with
appropriate human-machine interface tools, that it can be effectively overseen by natural
persons.
g. Babel Street shall implement appropriate mechanisms to detect, mitigate, and report biases
in Babel Street AI. Those measures shall include, but may not be limited to: relevant design
choices; sourcing diverse, suitable, and representative Training Data; and conducting regular
audits of Babel Street AI.
h. Babel Street AI shall allow for the recording of events ('logs') over the life of the applicable
Agreements. Logging capabilities shall ensure a level of traceability of the Babel Street AI that
is appropriate to the intended purpose of the system and reasonably foreseeable misuse,
including substantial modifications.
i. Babel Street has no control over, and cannot independently verify, the accuracy of the
information provided or maintained by third-party information sources and other data that
may be accessible through Babel Street AI. Babel Street makes no guaranties,
representations or warranties as to the availability or accessibility of any data, information, or
other content, or the accuracy or completeness of contents or results of queries, data and/or
data feeds, that use or operation will be error or defect free, and expressly disclaims the
accuracy, comprehensiveness, currency, availability, and suitability of purpose of any data,
information and/or content retrieved from or through Babel Street AI.
j. Babel Street disclaims and excludes any and all other warranties including, but not limited to,
any implied warranties of quality, title, non-infringement, merchantability, suitability,
completeness, or fitness for a particular purpose, irrespective of any course of dealing or
performance, custom or usage of trade. The Services, including Babel Street AI and any
associated support and any third-party software, data, and information, are provided “as is”
and “as available” without warranty of any kind, either express or implied.
k. Certain circumstances may require Babel Street to suspend or terminate, as determined in
Babel Street's discretion, Customer's access to and/or use of Babel Street AI or any portion
thereof without notice, including, but not limited to, in order to comply with the terms of any
provider of any data feed.
l. Without limiting its other remedies, Babel Street may limit Customer's access to or use of the
Services if Babel Street has a reasonable basis to believe that Customer's use of the Services,
Babel Street AI, AI Inputs or AI Outputs violate applicable Babel Street policies, including
without limitation the Babel Street Privacy Policy, Babel Street End-User Subscription Terms,
or applicable law.
2. Customer representations & warranties
a. By using Babel Street AI, Customer acknowledges that features are powered by AI technology,
which may not always perform as expected. Babel Street disclaims all responsibility and
liability for any errors, omissions, or inaccuracies in the information provided through Babel
Street AI, or the consequences of using AI Outputs generated by Babel Street AI, to the extent
applicable. Customer also acknowledges that some data feeds may have limitations, may
not be available to all users, or may require acknowledgement of an approved use case within
the Services.
b. Customer’s current and contemplated use of Babel Street AI, does not, and will not, infringe
upon or violate any claims, suits, demands, rulings, judgments, intellectual property rights,
rights of likeness or publicity, or any other third party right of any kind. Customer’s use of
Babel Street AI will comply with all laws and regulations (including those pertaining to data
privacy and security, national security, and financial or health care regulations) as applicable
to the Customer.
c. Customer has sufficient rights to use AI Inputs in connection with Babel Street AI, including,
without limitation, any Personal Data that Customer uses to produce AI Output.
d. Customer assumes sole responsibility for any results obtained from Babel Street AI based on
Customer Data (including without limitation, any Personal Data) and shall ensure that AI Input
does not include anything that actually or potentially infringes or misappropriates the
copyright, trade secret, trademark, or other intellectual property right of any third party.
e. Customer shall not disable, evade, disrupt, or interfere with the content filters, restrictions,
or other safety systems that are part of Babel Street AI. For Babel Street AI with configurable
prompts or other safety systems, Customer must implement the mitigations required by
Babel Street documentation.
f. Customer may not use web scraping, web harvesting, data mining or other data extraction
methods to extract Training Data or to discover any underlying components of the models,
algorithms, and systems, such as exfiltrating the weights of models or computer code from
Babel Street AI.
g. Customer will not use and will not direct or enable third parties to use, Babel Street AI to
generate AI Output for the express purpose of creating synthetic training data to develop or
train AI models or systems that have substantially similar functionality to Babel Street AI.
h. It is Customer’s responsibility to (i) verify AI Outputs for appropriateness, accuracy, and
completeness before relying on or using AI Outputs, and (ii) incorporate quality assurance
protocols (such as human review or additional validation) to ensure that use of the AI Outputs
is suitable for its intended purpose.
11. Confidentiality
In the course of providing Services pursuant to the Agreements, Babel Street may disclose Personal
Data to its employees, independent contractors, agents, and representatives who require access to
such data in connection with Babel Street’s obligations under this Addendum. Babel Street shall
take reasonable steps to ensure the reliability of any employee, independent contractor, agent or
representative who may have access to Personal Data, ensuring that access is strictly limited to
those individuals who need to know or access as strictly necessary for the purposes of the
Agreements and/or to comply with Applicable Data Protection Laws, ensuring that all such
individuals are subject to confidentiality undertakings or professional or statutory obligations of
confidentiality in respect of Personal Data, and have undertaken training on Applicable Data
Protection Laws relating to handling Personal Data and how it applies to their particular duties.
12. Changes
Babel Street may make changes to this Addendum from time to time as necessary to reflect changes
in its business or legal and regulatory requirements. Babel Street will provide thirty (30) days’ notice
of any such changes to Customer, at which time, Customer may accept the changes or terminate
the Agreements.
13. General
All terms and conditions of the Agreements shall remain unchanged and in full force and effect. In
the event of any conflict or inconsistency between the terms of this Addendum and the Agreements,
the terms of this Addendum will control. Any alteration or modification of this Addendum is not valid
unless made in writing and executed by duly authorized personnel of both Parties. Invalidation of
one or more of the provisions under this Addendum will not affect the remaining provisions. Invalid
provisions will be replaced, to the extent possible, by such valid provisions which achieve essentially
the same objectives. In the event of a change in Applicable Data Protection Laws or a determination
or order by a Supervisory Authority or competent court affecting this Addendum or the lawfulness of
any Processing under this Addendum, Babel Street may (in its sole discretion) make any
amendments to this Addendum as are reasonably necessary to ensure continued compliance with
Applicable Data Protection Laws and/or the Customer’s Processing instructions herein.
ATTACHMENT A
A. LIST OF PARTIES
Data processor(s): Babel Street, Inc.
1900 Reston Metro Plaza, #950, Reston, Virginia 20190 USA
[email protected]
+1 (703) 956-3572
Activities relevant to the data transferred under these Clauses: Provision of Products under the
Agreements
Data controller(s): Customer, as defined in the Agreements
Name: Customer, as defined in the Agreements
Activities relevant to the data transferred under these Clauses: Use of and/or receipt of Products
under the Agreements
B. DESCRIPTION OF THE TRANSFER
Categories of data subjects whose personal data is transferred:
• Search targets of the Babel Street Products
Categories of personal data transferred:
• Name and contact details (e.g., location/address, email address, phone number, etc.),
citizenship status, marriage status, government ID information, employment history, birth
date, educational history, job title(s), criminal background, and/or location data
Sensitive data transferred (if applicable):
• May include personal data revealing racial or ethnic origin, political opinions, philosophical
or religious beliefs, criminal background, and/or location data
The frequency of the transfer:
• The publicly available content will be made available through API connections or file
transfers.
• Continuous in provision of Products under the Agreements.
Nature of the processing:
• Return of publicly available information based on search terms input by Data controller into
the Babel Street Products.
Purpose(s) of the data transfer and further processing:
• Personal Data will be Processed in the provision of Products under the Agreements.
The period for which the personal data will be retained, or, if that is not possible, the criteria used
to determine that period:
• Data will be retained first for as long as specified in the applicable Agreement(s) terms
between the Parties. Second, data will be retained in compliance with local laws and
regulations.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the
processing:
• The Personal Data transferred may be disclosed only to the following recipients or
categories of recipients: Those Subprocessors required by the Parties to allow them to
meet their contractual and legal obligations under the Agreements.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent EU supervisory authority/ies in accordance with SCC Clause 13:
the Netherlands
ATTACHMENT B
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATA
EXPLANATORY NOTE:
Below is a description of the technical and organizational measures implemented by Babel Street to ensure an
appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and
the risks for the rights and freedoms of natural persons.
Governance
During the term of the Agreements, Babel Street will maintain compliance with the standards set
forth in NIST 800-171 and ISO 27001. This helps drive strategic and operational initiatives to continue
to improve our Security Program’s maturity. These initiatives include policies, security controls and
demonstration of compliance with our regulatory drivers.
Authorization and confidentiality
Access Control Policy
Access controls are established at sites, systems, system documentation, applications, databases,
directories, and files (information assets), using automated systems to enforce a role-based access
control model, such that users only have access to the information assets necessary to perform their
job function. Privileges are set using the principle of least privilege. The default posture will be to
deny all access thereby requiring all access that is granted to be granted based on an approved role
or access request. Roles are assigned based on user department, team, and job function.
Authentication and Identity Management Policy
All access to information resources shall use an approved method of identification and
authentication. All third-party service provider access to the Babel Street network and information
systems must adhere to the same access restrictions as internal users.
Access rights shall be established, documented, and periodically reviewed based on business
needs and external requirements. Access controls should consider:
• Security requirements given business needs, known threats, and vulnerabilities.
• Relevant legislative and regulatory requirements.
• Contractual obligations and service level agreements.
• Consistency across Babel Street’s systems and networks.
Access control considerations include:
• The use of clearly stated rules and rights based on user profiles.
• Consistent management of access rights across information resources using an
appropriate mix of logical (technical) and physical access controls.
• Segregation of access control roles including access request by the appropriate
department, access authorization by the data owner, and access administration by the
network administrator.
• Requirements for the formal authorization and timely removal of access rights.
Personnel
Personnel Security Policy
Information security responsibilities are to be followed by all staff who have access to Babel Street’s
information resources. All staff must acknowledge that they have read and understood Babel
Street’s Security Policies. In addition, all staff shall receive annual security-related training. All staff
must also sign a Babel Street Non-Disclosure Agreement prior to beginning work for Babel Street.
Code of Conduct
Employees, officers and directors must maintain the confidentiality of confidential information
entrusted to them, including our suppliers and customers, except when disclosure is authorized by
a supervisor or legally mandated. Unauthorized disclosure of any confidential information is
prohibited. Additionally, employees should take appropriate precautions to ensure that confidential
or sensitive business information, whether it is proprietary to the company or another company, is
not communicated except to employees who have a need to know such information to perform their
responsibilities.
Physical security of the operating environment
Security tools and procedures
As part of its core offering, Babel Street leverages Amazon Web Services to deliver its SaaS solution.
Before reaching customer instances, network traffic passes through multiple layers of network
protections. These include DDOS protection, isolated VLANs, and firewalls. Production
environments are segmented from QA and other non-production environments.
In addition to its core infrastructure as defined above, Babel Street maintains its standard approach
to secure practices. This is updated annually and includes its coverage of hardware, software,
network monitoring protocol and procedure.
Monitoring and logging
Intrusion Detection and/or Prevention Systems must be deployed on all Production systems. These
solutions shall be configured to alert personnel to potential information security events. Alerts and
security events shall be reported and responded to. These solutions shall also be maintained with
updated patches and signatures on a regular basis – at least weekly when available.