Snapshot 219789
Normalized text
Scripts and page chrome removed; this is what change detection compares.
PERSONAL DATA PROCESSING AGREEMENT
This Personal Data Processing Agreement (the “DPA”) supplements an existing purchase agreement
between BlueCat and Customer for BlueCat products or services (the “Agreement”). This DPA sets out
the additional terms on which BlueCat will Process Personal Data when providing products or services
under the Agreement. All other terms of the Agreement shall remain in full force and effect.
1. Definitions and Interpretation.
1.1 In this DPA, except where the context or subject matter is inconsistent therewith, the following terms
shall have the following meanings, and such meanings shall apply to both singular and plural forms
of any such terms:
(a) "Affiliate" means a party's direct or indirect parent or subsidiary corporation (or other entity),
or any corporation (or other entity) with which the party is under common control.
(b) “BlueCat” means the applicable BlueCat entity that is party to the Agreement and its Affiliates.
(c) “Customer” means the party identified in the Agreement receiving products or services from
BlueCat under the Agreement.
(d) "Data Protection Laws" means all mandatory applicable laws that apply to the Processing of
Personal Data under the Agreement.
(e) "Data Subject" means an individual who is the subject of the Personal Data and to whom or
about whom the Personal Data relates or identifies, directly or indirectly.
(f) "Effective Date” means the date that Customer first begins using BlueCat products or
services.
(g) “EU Standard Contractual Clauses” means the Standard Contractual Clauses for Personal
Data Transfers from an EU Controller to a Processor Established in a Third Country (Module
Two: Controller-to-Processor Transfers) available at https://trustcenter.bluecatnetworks.com.
(h) "Personal Data" means any information BlueCat Processes for the Customer relating to a
Data Subject in connection with the provision of BlueCat products or services under the
Agreement.
(i) “Privacy Data Sheet” means BlueCat’s Privacy Data Sheet available at
https://trustcenter.bluecatnetworks.com that describes the Processing activities in relation to
BlueCat products and services.
(j) "Processing” means any operation or set of operations that is performed by or on behalf of
BlueCat upon Personal Data, whether or not by automatic means, such as collection,
recording, securing, organization, storage, adaptation or alteration, access to, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, blocking, erasure, or destruction.
(k) "Security Breach" means a breach of Security Measures leading to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
(l) “Security Measures” means BlueCat’s organizational security measures described in the
1
BlueCat Personal Data Processing Agreement November 2023
BlueCat Technical and Organizational Measures document available at
https://trustcenter.bluecatnetworks.com.
(m) "Subprocessor" means a processor engaged by BlueCat to carry out Processing of Personal
Data, as identified in the Privacy Data Sheet.
(n) “UK Addendum” means the UK International Data Transfer Addendum to the EU Standard
Contractual Clauses available at https://trustcenter.bluecatnetworks.com.
1.2 In the case of conflict or ambiguity between: (a) any of the provisions of this DPA and the provisions
of the Agreement, the provisions of this DPA will prevail and (b) any of the provisions of this DPA
and the EU Standard Contractual Clauses, the provisions of the EU Standard Contractual Clauses
will prevail.
2. Processing and Transfers of Personal Data.
2.1 The Parties agree that in respect of the Personal Data, for the purposes of Data Protection Laws,
Customer shall be the data controller (or equivalent) and BlueCat shall be the Customer’s data
processor (or equivalent). The Customer retains control of the Personal Data and remains
responsible for its compliance obligations under Data Protection Laws, including providing any
required notices and obtaining any required consents, and for the Processing instructions it gives to
BlueCat.
2.2 BlueCat may Process Personal Data in locations where BlueCat or its Subprocessors operate to
provide the BlueCat products or services, as further detailed in the Privacy Data Sheet.
2.3 Where BlueCat Processes Personal Data from the European Economic Area (EEA) on behalf of
Customer in a country which is not recognized by the European Commission as providing an
adequate level of protection for Personal Data, BlueCat shall perform such Processing in accordance
with the EU Standard Contractual Clauses. Where BlueCat Processes Personal Data from the UK in
a third country, such Processing shall be performed in accordance with the EU Standard Contractual
Clauses, as amended by the UK Addendum.
3. BlueCat Obligations.
3.1 BlueCat will Process the Personal Data in accordance with (i) Data Protection Laws, (ii) Customer’s
written instructions, (iii) the Privacy Data Sheet, (iv) the EU Standard Contractual Clauses (where
applicable), (iv) the Security Measures, and (v) this DPA. BlueCat will promptly notify Customer if
BlueCat reasonably believes that Customer’s instructions are inconsistent with Data Protection Laws.
3.2 BlueCat will maintain the confidentiality of all Personal Data and will not disclose Personal Data to
third parties unless the Customer or this DPA authorizes the disclosure, or as required by law.
3.3 BlueCat will enter into written agreements with Subprocessors containing obligations to Process
Personal Data in accordance with Data Protection Laws.
3.4 BlueCat will assist Customer as reasonably needed to respond to requests from supervisory
authorities or Data Subjects related to BlueCat’s Processing of Personal Data.
4. Customer Obligations.
4.1 Customer will use the BlueCat products and/or services in compliance with Data Protection Laws.
4.2 Customer will ensure all instructions given by it to BlueCat in respect of the Processing of Personal
2
BlueCat Personal Data Processing Agreement November 2023
Dare are at all times in accordance with Data Protection Laws.
4.3 Customer will ensure all Personal Data provided to BlueCat has been collected in accordance with
Data Protection Laws and that Customer has all authorizations and/or consents necessary to provide
such Personal Data to BlueCat.
4.4 Customer will only provide to BlueCat such Personal Data as is strictly necessary to enable BlueCat
to provide the BlueCat products and/or services and will have measures in places to prevent
provision of Personal Data that is not needed for such purposes.
5. Subprocessing.
5.1 BlueCat will execute a written agreement with each Subprocessor containing terms at least as
protective as this DPA. Current Subprocessors are listed in the Privacy Data Sheet.
5.2 BlueCat shall not contract with new Subprocessors without providing Customer with notice by
publishing this information in an updated Privacy Data Sheet, to which Customer may register to
receive updates. If within 14 days of BlueCat’s notice, Customer objects to the proposed
Subprocessor by providing reasonable grounds related to the protection of the Personal Data and
the Parties cannot resolve the objection within 60 days of BlueCat’s notice, then Customer may on
written notice terminate the applicable part of the Agreement relating to those BlueCat products
and/or services which cannot be provided by BlueCat without the use of the Subprocessor giving rise
to the objection. For clarity, Customer shall not receive a refund of any prepaid fees due to such
termination.
5.3 BlueCat shall be liable for the acts or omissions of Subprocessors to the same extent it is liable for
its own action or omissions under this DPA. For the purposes of Clause 9 of the EU Standard
Contractual Clauses, Customer provides a general authorization to BlueCat to engage
Subprocessors.
6. Security.
6.1 BlueCat shall implement, maintain and monitor compliance with the Security Measures.
6.2 Upon becoming aware of a Security Breach, BlueCat will: (i) notify Customer without undue delay,
and where feasible, in any event no later than 48 hours from becoming aware of the Security Breach,
(ii) provide timely information relating to the Security Breach as it becomes known or as is reasonably
requested by Customer, and (iii) investigate and, as necessary, take appropriate steps to mitigate or
remediate the Security Breach in accordance with BlueCat’s security policies and procedures.
BlueCat shall reasonably cooperate with Customer in any post-incident investigation, remediation,
and communication efforts. BlueCat’s notification of or response to a Security Breach will not be
construed as an acknowledgment of any fault or liability with respect to the Security Incident.
6.3 Except as required by applicable law, BlueCat agrees that it will not inform any third party (other than
BlueCat’s advisors retained to assist with the Security Breach) of a Security Breach referencing or
identifying Customer, without Customer’s prior written consent. If disclosure of the Security Breach
referencing or identifying Customer is required by applicable law, BlueCat will work with Customer
regarding the timing, content, and recipients of such disclosure.
7. Data Subjects. To the extent legally permitted, BlueCat shall promptly direct any Data Subjects to
send their requests to Customer or notify Customer if it receives a Data Subject request relating to
their Personal Data. Unless required by Data Protection Laws, BlueCat shall not otherwise respond
to any such Data Subject request without Customer’s prior written consent.
8. Audit. Upon Customer’s written request, BlueCat shall make available to Customer such information
3
BlueCat Personal Data Processing Agreement November 2023
as is reasonably necessary to demonstrate BlueCat’s compliance with the obligations of this DPA.
Customer acknowledges and agrees that any exercise of its audit rights under the EU Standard
Contractual Clauses will be conducted in accordance with this DPA.
9. Return of Data. Upon termination or expiration of the Agreement and Customer’s written request,
BlueCat will delete or return to Customer all Personal Data in BlueCat’s possession or control, except
for Personal Data that BlueCat is required by applicable law to retain or Personal Data that BlueCat
has archived in its backup systems. Any Personal Data archived will be subject to reasonable
measures to prevent the Personal Data from any active Processing and will be deleted in accordance
with BlueCat’s retention and deletion policies, unless otherwise required by applicable law.
10. LIABILITY. EXCEPT FOR ANY LIABILITY WHICH CANNOT BE LIMITED OR EXCLUDED UNDER
MANDATORY APPLICABLE LAW AND WITHOUT LIMITING IN ANY WAY THE RIGHTS OF ANY
DATA SUBJECTS UNDER MANDATORY APPLICABLE LAW, THE AGGREGATE LIABILITY OF
BLUECAT AND ITS AFFILIATES TO CUSTOMER AND ITS AFFILIATES FOR ALL SECURITY
BREACHES AND ANY BREACH OF THIS DPA (WHETHER FOR BREACH OF CONTRACT,
MISREPRESENTATIONS, NEGLIGENCE, STRICT LIABILITY, OTHER TORTS OR OTHERWISE)
SHALL NOT EXCEED ONE MILLION US DOLLARS. WHERE A SECURITY BREACH AND/OR
BREACH OF THIS DPA IS ALSO A BREACH OF ANY CONFIDENTIALITY OR NON-DISCLOSURE
OBLIGATIONS IN THE AGREEMENT, THE LIABILITY CAP IN SECTION WILL APPLY.
11. Miscellaneous.
11.1 This DPA will have effect as of the Effective Date and will remain in effect for the term of the
Agreement. This DPA will replace any existing data processing agreement or similar document that
the Parties may have previously entered into in connection with BlueCat products and services.
11.2 This DPA (including the documents references herein) and the Agreement contain the entire
understanding of the parties hereto on the subject matter hereof and supersedes any previous
agreements or understandings, written or oral, in effect between the parties relating to the subject
matter hereof. No amendment or modification of this DPA shall be effective or binding unless agreed
to in writing by both parties. No one other than a party to this DPA, their successors and permitted
assignees shall have any right to enforce any of its terms.
11.3 Notwithstanding the termination or expiry of this DPA, all obligations which either expressly or by
their nature are to continue after the termination of this DPA shall survive and remain in effect,
including, without limitation, Sections 2.1, 9, 10, 11 and 11.
11.4 The parties will provide notices under this DPA in accordance with the Agreement, provided that all
such notices may be sent via email.
11.5 Unless prohibited by Data Protection Laws, this DPA is governed by the laws stipulated in the
Agreement and the parties hereby submit to the choice of jurisdiction and venue stipulated in the
Agreement, if any, with respect to any dispute arising under this DPA.
4
BlueCat Personal Data Processing Agreement November 2023