Snapshot 223550
Normalized text
Scripts and page chrome removed; this is what change detection compares.
GLOBAL DATA PROCESSING ADDENDUM
This Global Data Processing Addendum (this “Addendum”) is by and between the
Sema4.ai, Inc. customer or partner (“Company”) and Sema4.ai, Inc. a Delaware
corporation, having principal offices at 3340 Peachtree Rd NE, Suite 2200, Atlanta, Georgia
30326 and its affiliates as applicable (“Sema4.ai”). Company and Sema4.ai are referred to
individually as a “Party” and collectively as the “Parties.” This Addendum is incorporated
into the Agreement entered into by and between Company and Sema4.ai (“Agreement”)
and shall have the same effective date as the Agreement.
1. Definitions. Capitalized terms used herein will have the meanings set forth in this
Addendum. Any capitalized term that is not defined in this Addendum will have the
meaning assigned in the Agreement.
1.1 “Authorized Employees” means Sema4.ai’s employees who have a need to
know or otherwise access Covered Personal Information of Confidential Information to
enable Sema4.ai to perform its obligations under this Agreement.
1.2 “Authorized Persons” means (a) Authorized Employees; and (b) Sema4.ai’s
contractors, agents, auditors, and Sub-Processors (as defined below) who have a need to
know or otherwise access Covered Personal Information or Confidential information to
enable Sema4.ai to perform its obligations under this Agreement, and who are bound in
writing by confidentiality and other obligations sufficient to protect Covered Personal
Information or Confidential information in accordance with the terms and conditions of the
Agreement.
1.3 “Covered Personal Information” means any Personal Information provided
by or on behalf of Company, or Company’s customers, to Sema4.ai, collected by Sema4.ai
on behalf of Company, or otherwise made available to Sema4.ai in the course of
Sema4.ai’s performance under the Agreement.
1.4 “Personal Information” will be interpreted consistent with the Privacy Laws,
and includes at a minimum “personal information” and “personal data” as defined in the
Privacy Laws, as well as Sensitive Personal Information.
1.5 “Portable Format” means to the extent technically feasible a structured,
commonly used, machine readable, readily usable format that allows the consumer to
transmit the Covered Personal Information to another entity or controller without
hindrance, as further specified in the Privacy Laws.
1.6 “Privacy Laws” means applicable statutes, regulations, guidance, or other
laws pertaining to privacy, processing of Personal Information, data protection, and/or
information security, including, but not limited to, the EU General Data Protection
Regulation 2016/679 (“GDPR”); United Kingdom General Data Protection Regulation
applicable by virtue of the Data Protection, Privacy and Electronic Communications
(Amendments etc) (EU Exit) Regulations 2019 (“UK GDPR”); Brazil Law No. 13,709/2018
(General Law for the Protection of Personal Data or “LGPD”); Personal Information
Protection and Electronic Documents Act (“PIPEDA”); the Fair Credit Reporting Act, 15
U.S.C. § 1681 et seq.; the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.; the Children’s
Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.; the Telephone Consumer
Protection Act, 47 U.S.C. § 227 et seq.; guidance issued by the U.S. Federal Trade
Commission pursuant to its authority under Section 5 of the FTC Act, 15 U.S.C. § 45; and
the US state privacy laws, including the California Consumer Privacy Act, Cal. Civ. Code
1798.100 et seq., as amended including by the California Privacy Rights Act, the Virginia
Consumer Data Protection Act, Code of Virginia title 59.1, Chapter 52, the Colorado
Privacy Act, Colorado Rev. Stat. 6-1-1301 et seq., the Utah Consumer Privacy Act, Utah
Code 13-61-101 et seq., the Connecticut Act Concerning Personal Data Protection and
Online Monitoring, Conn. Gen. Stat. 42-515 et seq., the Iowa Act Relating to Consumer
Data Protection, Iowa Code § 715D.1 et seq., the Indiana Consumer Data Protection Act,
Ind. Code Ann. § 24-15, the Tennessee Information Protection Act, Tenn. Code Ann. 47-18-
3301 et seq., the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code § 541.001 et
seq., the Montana Consumer Data Privacy Act, SB 384 (2023) [Pending Codification], the
Oregon Act Relating to Protections for Personal Data of Consumers, SB 619 (2023)
[Pending Codification], the Delaware Personal Data Privacy Act, Del. Code Ann. tit. 6, §
12D-101 et seq., the New Jersey Act Concerning Online Services, Consumers, and
Personal Data, P.L. 2023, c. 266, the New Hampshire privacy law, N.H. Rev. Stat. 507-H:1
et seq., the Nebraska Data Privacy Act, L.B. 1074 (2024), the Kentucky Act relating to
consumer data privacy, HB 15 (2024), state data breach notification laws, or any
regulations or guidance issued pursuant thereto.
1.7 “Security Breach” means (a) any event that compromises either the
security, confidentiality, availability, or integrity of Covered Personal Information or
Confidential Information or the physical, technical, administrative, or organizational
safeguards that relate to the protection of the security, confidentiality, availability, or
integrity of Covered Personal Information or Confidential Information, or (b) receipt of a
complaint in relation to the privacy and data security practices of Sema4.ai or a breach or
alleged breach of this Agreement relating to such privacy and data security practices.
Without limiting the foregoing, a Security Breach will include any actual or reasonably
suspected unauthorized access to or disclosure, loss, alteration, or acquisition of Covered
Personal Information or Confidential Information.
1.8 “Sensitive Personal Information” will be interpreted consistent with the
Privacy Laws, and will include at a minimum “sensitive personal information” and
“sensitive data” as defined in the Privacy Laws. For the avoidance of doubt, wearable or
sensor data associated with bodily functions, including heart rate monitor data, will be
considered Sensitive Personal Information.
1.9 “EU Standard Contractual Clauses” means the standard contractual
clauses annex to European Commission Implementing Decision (EU) 2021/914 for the
transfer of Personal Information to Third Countries (and any successor clauses).
1.10 “Third Countries” means countries that are not recognized by the Privacy
Laws as countries providing adequate protection of Personal Information.
1.11 “UK Addendum” means the International Data Transfer Addendum to the
EU Standard Contractual Clauses, issued by the Information Commissioner’s Office of the
United Kingdom.
1.12 The terms “business,” “business purposes,” “consumer,” “controller,”
“data subject,” “process,” “processing,” “processor,” “profiling,” “sale,” “Sema4.ai,”
“sharing,” and “supervisory authority” will have the meanings given to those terms in the
Privacy Laws as enacted and effective as of the Effective Date of the Agreement. In the
event of a conflict in the meanings of terms in the Privacy Laws, the Parties agree that only
the meanings in applicable Privacy Laws will apply.
2. Terms of Data Processing
2.1 Relation to the Agreement – Covered Personal Information is deemed to be
Confidential Information of Company or its customers and is not Confidential Information
of Sema4.ai. In the event of a conflict or inconsistency between this Exhibit and the
confidentiality or compliance with laws sections of the Agreement, the terms and
conditions set forth in this Exhibit will govern and control. The Parties agree to cooperate
in good faith to modify this Exhibit as necessary to address any modifications,
amendments, or updates to applicable Privacy Laws.
2.2 Data Processing Instructions – Sema4.ai will process the Covered Personal
Information for the duration of the Agreement (unless otherwise agreed in writing) only (a)
as necessary to effect Sema4.ai’s obligations under the Agreement; and/or (b) on
documented and customary instructions from Company, unless otherwise required by
applicable law. Sema4.ai will immediately notify Company if Sema4.ai believes such
instructions violate the applicable Privacy Laws.
2.3 Relationship of the Parties – The Parties acknowledge and agree that, for
purposes of the Agreement and this Exhibit, Company is the sole Party that determines the
purposes and means of processing Covered Personal Information as the “business” or
“controller;” and Sema4.ai processes Covered Personal Information on behalf of the
Company as the “Sema4.ai” or “processor.” Sema4.ai will process Covered Personal
Information solely as instructed in the Agreement and this Exhibit for the duration of the
provision of Cloud Services to Company. Sema4.ai receives no monetary or other valuable
consideration in exchange for the Covered Personal Information.
2.4 Compliance with Obligations – Sema4.ai represents and warrants that
Sema4.ai and Authorized Persons (a) understand and will comply with applicable Privacy
Laws and this Exhibit while providing Cloud Services, (b) will provide the level of privacy
protection required by applicable Privacy Laws, including the level of privacy protection
required of businesses in the Privacy Laws, and (c) will provide Company with all
reasonably-requested assistance to enable Company to fulfill its own obligations under
applicable Privacy Laws.
2.5 Assistance – Upon the reasonable request of Company, Sema4.ai will (a)
make available to Company all information in Sema4.ai’s possession necessary to
demonstrate Sema4.ai’s compliance with this Exhibit, and (b) provide Company with such
assistance and information as is reasonably necessary to enable Company to carry out
privacy impact assessments under applicable Privacy Laws.
2.6 Obligations at Termination – When the Agreement expire, Sema4.ai will
discontinue processing and, at Company’s discretion, return or destroy Covered Personal
Information without undue delay unless otherwise instructed by Company.
2.7 Audit Rights – Company will have the right to monitor Sema4.ai’s compliance
with this Exhibit through measures that may include manual reviews, automated scans,
regular assessments, audits, or technical or operational testing (collectively, an
“Assessment”). Upon Company’s reasonable request, Sema4.ai will grant Company or,
upon Company’s election, a third party on Company’s behalf, permission to perform such
Assessment. Sema4.ai will fully cooperate with such Assessment, provided that the
Assessment will not unreasonably interfere with the normal conduct of Sema4.ai’s
business, by providing access to knowledgeable personnel, physical premises,
documentation, infrastructure, and application software used to process Covered
Personal Information or Confidential Information pursuant to this Agreement. In addition,
upon Company’s request, Sema4.ai will provide Company with the results of any audit
performed by or on behalf of Sema4.ai that assesses the effectiveness of Sema4.ai’s
information security and privacy program as relevant to the security and confidentiality of
Covered Personal Information or Confidential Information.
2.8 Inquiries. In the event that Sema4.ai receives any inquiry or correspondence
regarding Covered Personal Information from a regulatory or supervisory authority,
Sema4.ai will, to the extent not prohibited by applicable law or any regulatory or
supervisory authority, notify Company of the inquiry within three (3) calendar days; provide
Company with all copies of documents and correspondence relating to the inquiry without
undue delay after their receipt; and provide Company with a written certification at the
conclusion of the inquiry describing the outcome of the inquiry and any actions taken for
compliance with the applicable Privacy Laws. Unless compelled to do so by law, Sema4.ai
will not disclose any confidential information of Company to a regulatory or supervisory
authority without Company’s prior written consent.
3. Limitations on Processing of Covered Personal Information
3.1 Limited Scope of Processing – Company or its customers disclose the
Covered Personal Information to Sema4.ai (or permits Sema4.ai to collect Covered
Personal Information on Company’s behalf) for limited and specified purposes described
in the Agreement and this Exhibit. The details of the processing are provided in Annex A
attached hereto, including the duration of processing, the nature of processing, the types
of Covered Personal Information subject to processing, and the purpose of processing.
The rights and obligations of the Parties will be as set forth in the Agreement.
3.2 Data Restrictions – Sema4.ai is instructed to process the Covered Personal
Information for limited and specified business purposes in connection with the provision
or improvement of Cloud Services and as provided in Annex A attached hereto. Sema4.ai
will not: (a) sell or share Covered Personal Information, (b) retain, use, or disclose Covered
Personal Information for any purpose other than to provide Cloud Services for business
purposes to Company as specified in the Agreement, (c) retain, use, or disclose Covered
Personal Information outside the direct business relationship with Company, (d) retain,
use, or disclose Covered Personal Information for any commercial purpose not specified
in the Agreement or this Exhibit including in the servicing of a different business, or (e)
when prohibited by applicable Privacy Laws, combine Covered Personal Information
received from Company with Personal Information that Sema4.ai receives from, or on
behalf of, another person or persons, or collects from its own interactions with consumers.
3.3 Compliance Remediation; Termination Rights – Sema4.ai agrees to notify
Company within five (5) business days if Sema4.ai determines that it can no longer meet its
obligations under applicable Privacy Laws. Upon receiving notice from Sema4.ai in
accordance with this subsection, Company may direct Sema4.ai to take steps as
reasonable and appropriate to remediate unauthorized use of Covered Personal
Information or terminate the Agreement upon thirty (30) days’ notice.
3.4 Sub-Processors – Sema4.ai will provide Company with a list of and notify
Company of any intended changes concerning the addition or replacement of contractors
or sub-contractors that process Covered Personal Information (“Sub-Processors”).
Further, Sema4.ai will ensure that Sema4.ai’s Sub-Processors who collect, process, store,
or transmit Covered Personal Information on Sema4.ai’s behalf agree in writing to
materially the same restrictions and requirements that apply to Sema4.ai in this Exhibit
and the Agreement with respect to Covered Personal Information, as well as to comply
with applicable Privacy Laws.
3.5 Right to Object – Company may object in writing to Sema4.ai’s appointment
of a new Sub-Processor on reasonable grounds relating to data protection by notifying
Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with
Section 3.4. In the event Company objects, the Parties will discuss Company’s concerns
in good faith with a view to achieving a commercially reasonable resolution. If no such
resolution can be reached, Sema4.ai will, in its sole discretion, either not appoint the Sub-
Processor or permit Company to terminate the Agreement, in such case refunding
Company for any prepaid unused fees.
3.6 Integrations – Sema4.ai will not activate third-party integrations or other
features that process Covered Personal Information unless approved in writing by
Company.
3.7 Automated Data Processing – Sema4.ai represents and warrants that it will
not process Covered Personal Information using automated data processing, including
generative artificial intelligence or automated decision-making, for purposes of (1) profiling
in furtherance of decisions that produce legal or similarly significant effects concerning a
consumer, or (2) for a significant decision, extensive profiling, or consequential decision as
such terms are used in the applicable Privacy Laws, unless Sema4.ai discloses such
processing in writing to Company and provides Company an opportunity to consent to the
processing. Sema4.ai will cooperate with Company to provide all applicable notices and
obtain all necessary consents as may be required by the applicable Privacy Laws in order
to process Covered Personal Information in accordance with this Section 3.7. Sema4.ai
will not permit any Sub-Processor to use Covered Personal Information to improve
services offered by the Sub-Processor for any purpose.
4. Data Subject and Consumer Requests
4.1 Cooperation – Sema4.ai will implement and maintain sufficient processes
and procedures to satisfy Company’s requests to access, correct, delete, or otherwise
modify the processing of Covered Personal Information held by Sema4.ai and to enable
Company to respond to consumer requests made pursuant to the Privacy Laws.
4.2 Fulfillment of Consumer Requests – Within ten (10) calendar days of a
written request from Company (which notice may be provided via email), Sema4.ai will,
without cost to Company, as applicable: (a) securely erase or destroy, or cause to be
erased or destroyed, specific pieces of Covered Personal Information, including any
copies of such Covered Personal Information maintained by Sema4.ai’s Sub-Processor(s);
(b) provide information requested by Company about Sema4.ai’s collection of the Covered
Personal Information, including, without limitation, the categories of Covered Personal
Information that were collected and categories of Sub-Processors to whom Sema4.ai has
disclosed the Covered Personal Information; (c) provide the Covered Personal Information
that Sema4.ai and/or one of its Sub-Processors has collected from or about the consumer
on behalf of Company in a Portable Format; (d) modify, and direct its Sub-Processors to
modify, specific pieces of Covered Personal Information; or (e) limit processing of
Sensitive Personal Information in accordance with the instructions of Company.
4.3 Referral of Direct Requests – Sema4.ai agrees to refer applicable consumer
requests submitted directly to Sema4.ai for Covered Personal Information to Company.
5. Information Security Controls
5.1 Duty of Confidentiality – Sema4.ai and Authorized Persons are subject to a
duty of confidentiality with respect to the Covered Personal Information and Confidential
Information. Sema4.ai is liable for any breach of confidentiality by Authorized Persons.
Sema4.ai will maintain a disciplinary process to address any unauthorized access, use, or
disclosure of Covered Personal Information or Confidential Information by any of
Sema4.ai’s officers, partners, principals, employees, agents, auditors, contractors, Sub-
Processors, or Authorized Persons.
5.2 Security Measures – Sema4.ai will implement and maintain reasonable
technical and organizational security measures, policies, and procedures, including
physical access control, backup, and encryption, to protect the Covered Personal
Information and Confidential Information (“Security Measures”). Such Security Measures
will, at all times, be appropriate to the nature of the Covered Personal Information or
Confidential Information. Sema4.ai will make available to Company upon Company’s
request a written description of the Security Measures. Sema4.ai will review and update
the Security Measures at least annually. At a minimum, the Security Measures will
include: (i) limiting access to Covered Personal Information and Confidential Information
to Authorized Persons; (ii) securing business facilities, data centers, paper files, servers,
backup systems, and computing equipment, including, but not limited to, all mobile
devices and other equipment with information storage capability; (iii) implementing
network, application, database, and platform security; (iv) securing information
transmission, storage, and disposal; (v) implementing authentication and access controls
within media, applications, operating systems, and equipment, including the use of
multifactor authentication for access to any Covered Personal Information or Confidential
Information; (vi) encrypting Covered Personal Information or Confidential Information
stored on any media; (vii) encrypting Covered Personal Information or Confidential
Information when transmitted over public or wireless networks; (viii) strictly segregating
Covered Personal Information and Confidential Information from information of Sema4.ai
or its other Companies so that Covered Personal Information and Confidential Information
is not commingled with any other types of information; (ix) conducting risk assessments,
penetration testing, and vulnerability scans and promptly implementing, at Sema4.ai’s
sole cost and expense, a corrective action plan to correct any issues that are reported as a
result of the testing; (x) implementing appropriate personnel security and integrity
procedures and practices, including, but not limited to, conducting background checks
consistent with applicable law; and (xi) providing appropriate privacy and information
security training to Authorized Persons.
5.3 Industry Standard Security – Without limiting Sema4.ai’s obligations under
this Section 5, Sema4.ai will implement administrative, physical, and technical safeguards
to protect Covered Personal Information and Confidential Information from unauthorized
access, acquisition, or disclosure, destruction, alteration, accidental loss, misuse, or
damage that are no less rigorous than accepted industry practices (including the
International Organization for Standardization's standards: ISO/IEC 27001 - Information
Security Management Systems - Requirements and ISO/IEC 27002 - Code of Practice for
International Security Management, the Control Objectives for Information and related
Technology (COBIT) standards, the National Institute of Standards and Technology (NIST)
Cybersecurity Framework, or other applicable industry standards for information security,
and will ensure that all such safeguards, including the manner in which Covered Personal
Information or Confidential Information is processed, comply with applicable Privacy Laws
and this Agreement.
5.4 Access Controls – Sema4.ai will implement appropriate access controls
restricting access to Covered Personal Information and Confidential Information to only
such Authorized Persons as need to know the information in order to perform their
obligations in furtherance of the Agreement. When any Authorized Persons no longer has a
business need for access privileges to Covered Personal Information or Confidential
Information assigned to them, access privileges will promptly be revoked.
5.5 Direct Marketing. Sema4.ai will implement and maintain reasonable
technical and organizational measures to retain documentation of consent to receive
marketing messages sent by Sema4.ai and comply with requests to stop receiving direct
marketing messages sent by Sema4.ai.
6. Information Security Incident
6.1 Obligations of Sema4.ai – Sema4.ai will:
(a) provide Company with the name and contact information for security
operations or other service desk of Sema4.ai who will serve as Company’s primary security
contact and will be available to assist Company twenty-four (24) hours per day, seven (7)
days per week as a contact in resolving obligations associated with a Security Breach;
(b) notify Company of a Security Breach as soon as practicable, but no
later than twenty-four (24) hours after Sema4.ai becomes aware of it; and
(c) notify Company of any Security Breaches by written notice provided in
accordance with the notice provisions of the Agreement, with a copy by email to
Sema4.ai’s primary business contact within Company.
6.2 Investigation – Immediately following Sema4.ai’s notification to Company of
a Security Breach, the Parties will coordinate with each other to investigate the Security
Breach. Sema4.ai agrees to reasonably cooperate with Company in Company’s handling
of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing
Company with physical access to the facilities and operations affected; (iii) facilitating
interviews with Sema4.ai’s employees and others involved in the matter; and (iv) making
available all relevant records, logs, files, data reporting, and other materials required to
comply with applicable law, regulation, industry standards, or as otherwise required by
Company. Sema4.ai agrees to maintain and preserve all documents, records, and other
data related to any Security Breach except as otherwise agreed in writing by the Parties.
6.3 Remediation – Sema4.ai will at its own expense take reasonable steps to
immediately contain and remedy any Security Breach and prevent any further Security
Breach, including, but not limited to taking any and all action necessary to comply with the
applicable Privacy Laws. Sema4.ai will promptly (but in any event within ten (10) days of
Company’s request) reimburse Company for all actual costs and expenses incurred by
Company in responding to, and mitigating damages caused by, any Security Breach,
whether or not required by law, including costs of notification of individuals, establishment
and operation of call center(s), credit monitoring and/or identity restoration services; time
of Company personnel responding to the Security Breach; fees and costs incurred in
litigation; the cost of external investigations; civil or criminal penalties levied against
Company; civil judgments entered against Company; and Company’s attorney’s fees, and
court costs.
6.4 Cooperation – Sema4.ai agrees that it will not inform any third party of any
Security Breach without first obtaining Company’s prior written consent, other than to
inform a complainant that the matter has been forwarded to Company’s legal counsel.
Further, Sema4.ai agrees that Company will have the sole right to determine: (i) whether
notice of the Security Breach is to be provided to any individuals, regulators, law
enforcement agencies, consumer reporting agencies, or others as required by law or
regulation, or otherwise in Company’s discretion; and (ii) the contents of such notice,
whether any type of remediation may be offered to affected persons, and the nature and
extent of any such remediation. Sema4.ai agrees to fully cooperate at its own expense
with Company in any litigation, investigation, or other action deemed necessary by
Company to protect its rights relating to the use, disclosure, protection, and maintenance
of Covered Personal Information or Confidential Information.
7. Cross-Border Data Transfers
7.1 Transfer Mechanism – With regard to any transfers of Covered Personal
Information to countries that do not provide adequate protection for such data (as
determined by the applicable Privacy Laws), the Parties hereby enter into applicable
instruments in support of such transfer.
7.2 Transfers from the UK – For transfers of Covered Personal Information from
the United Kingdom, the UK Addendum (including all Part 2 Mandatory Clauses) is hereby
incorporated by reference when it is available and is a valid transfer mechanism under
applicable Privacy Laws. The Parties further agree to the following provisions with respect
to the UK Addendum:
(a) Table 1 (Parties): The contents of Table 1 (Parties) will be completed
with details provided in Annex A under “Contact Details.”
(b) Table 2 (Selected SCCs, Modules, and Selected Clauses):
(i) The Addendum EU SCCs will be the Approved EU SCCs.
(ii) Module Two will apply.
(iii) In Clause 7, the Parties do not permit docking.
(iv) In Clause 9(a), the Parties select Option 2 and a time period of
30 days.
(v) In Clause 11, the Parties do not select the independent dispute
resolution option.
(c) Table 3 (Appendix Information): The list of parties is provided in Annex
A under “Contact Details.” The description of the transfers are
provided in Annex B, Part A. The technical and organizational
measures including technical and organizational measures to ensure
the security of the data are provided in Annex B, Part B.
(d) Table 4 (Ending this Addendum when the Approved Addendum
Changes): The Parties agree that Exporter may end the Addendum as
set out in Section 19 of the UK Addendum.
(e) Conflicts: In the event of any conflict or inconsistency between this
Addendum and the UK Addendum with respect to UK data subjects,
the UK Addendum will prevail.
7.3 Transfers from the EEA – For all other transfers of Covered Personal
Information, including transfers of Covered Personal Information from the European
Economic Area, the EU Standard Contractual Clauses are hereby incorporated by reference
when they are available and are a valid transfer mechanism under applicable Privacy Laws.
The Parties further agree to the following provisions with respect to the EU Standard
Contractual Clauses:
(a) Identity of the Parties: The data exporter is Company, and the data
importer is Sema4.ai. Accordingly, Module Two (controller to processor) is the sole module
applicable to transfers involving Covered Personal Information.
(b) Conflicts: In the event of any conflict or inconsistency between this
Addendum and the EU Standard Contractual Clauses, the EU Standard Contractual Clauses
will prevail.
(c) Appendices: Responses to the Annexes to the EU Standard Contractual
Clauses are provided in Exhibits 1 and 2, attached hereto.
(d) Transfer Impact Assessments: Upon Company’s request, Sema4.ai will
make available to Company its documented assessment of its processing of Covered
Personal Information hereunder for the purpose of Clause 14.
(e) Specific Provisions: The following specific provisions apply to the EU
Standard Contractual Clauses:
• In Clause 7, the Parties do not permit docking.
• In Clause 9(a), the Parties select Option 2 and a time period of 30
days.
• In Clause 11, the Parties do not select the independent dispute
resolution option.
• In Clause 17 (Option 2), the Clauses will be governed by the law of
the EU Member State in which the data exporter is established.
Where such law does not allow for third-party beneficiary rights, or if
the date exporter is not established in an EU Member State, they will
be governed by the laws of the Republic of Ireland.
• In Clause 18(b), disputes will be resolved before the courts of the
Republic of Ireland.
7.4 Transfers from Brazil – The Parties agree to amend this Addendum and adopt
such mechanism for restricted transfers as is required by Brazil’s data protection domestic
authority and provided that such mechanism is compatible with this Addendum.
ANNEX A TO EXHIBIT D
TERMS OF DATA PROCESSING
1. Duration of processing. The duration of the Processing of Covered Personal
Information by the Sema4.ai under the Agreement is for the duration of the term of
the Agreement and the longer of such additional period as: (i) is specified in any
provisions of the Agreement regarding data retention; and (ii) is required for
compliance with law.
2. Nature of processing. Such processing as is necessary to enable the Sema4.ai to
comply with its obligations and exercise its rights under the Agreement, including
collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure, or destruction
processing activities.
3. Categories of Personal Information. Company may upload, submit, or otherwise
transfer certain personal data to Cloud Services, the extent of which is typically
determined and controlled by Company in its sole discretion, and may include the
following types of personal data: product user identifier, name, email address,
group memberships (if the user elected to control product access in such a
manner), profile picture, and IP address.
4. Sensitive Personal Information. Sema4.ai does not want to collect or process, nor
does it intentionally collect or process, any Sensitive Personal Information in
connection with Cloud Services.
5. Purpose of processing. Sema4.ai’s processing of Covered Personal Information is
in connection with the provision of Cloud Services, including maintaining or
servicing accounts, providing Company service, processing or fulfilling orders and
transactions, verifying Company information, processing payments, providing
financing, providing analytic services, providing storage, and complying with any
other reasonable instructions provided by Company (e.g., via email or support
tickets) that are consistent with the terms of the Agreement.
6. Contact Details. Please contact us at privacy@sema4.ai.
ANNEX B to EXHIBIT D
CROSS BORDER DATA TRANSFERS
A. DESCRIPTION OF CROSS-BORDER DATA TRANSFERS (IF APPLICABLE)
1. Roles of the Parties. Company is the Data Exporter. If the Agreement allows for use by
Company’s customers, then and only then, may the Company’s customers also be a Data
Exporter. In such cases, the Company shall obtain all necessary consents from its
customer for such transfers. Sema4.ai is the Data Importer.
2. Description of activities relevant to the Covered Personal Information transferred
under the Standard Contractual Clauses. Sema4.ai provides a multi-tenant portal that
Company logs into to deploy agents. Agents deployed through the control room run in the
Company’s virtual private cloud. Once deployed, Company can interact with these agents
through the work room. Covered Personal Information will be processed in accordance
with the Agreement (which includes this Addendum), and may include (a) storage as well as
other processing activities designed to provide and improve Cloud Services, and (b)
disclosures required under the Agreement or applicable law.
3. Categories of data subjects whose Covered Personal Information is transferred. The
categories of data subjects whose personal data is processed include Company’s
employees and contractors, and may also include the Company’s customers if the
Agreement permits such use.
4. Categories of Covered Personal Information transferred. Product user identifier,
name, email address, group memberships (if Company elected to control access in
such a manner), profile picture, and IP address.
5. Types of sensitive (or special) categories of Covered Personal Information transferred
and applicable restrictions or safeguards. Sema4.ai does not desire to collect or to
process any sensitive or special categories of Covered Personal Information, and does not
intentionally collect any of the foregoing.
6. Frequency of the transfer. Continuous and as determined by Company and Cloud
Services.
7. Purpose of the data transfer and further processing. Provision of Cloud Services as set
forth in the Agreement.
8. Sub-processor transfers. Transfers to sub-processors will occur where necessary for the
provision of Cloud Services in accordance with the Agreement and this Addendum.
9. Competent Supervisory Authority. EEA data subjects: Republic of Ireland. UK data
subjects: United Kingdom. Sema4
B. TECHNICAL AND ORGANIZATIONAL MEASURES
1. Sema4 maintains compliance with ISO 27001, SOC 2, HIPAA, and GDPR.