Snapshot 224030
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM
Last Updated: June 25, 2025
This Data Processing Addendum (including its Exhibits) (“Addendum”) is incorporated by reference into, and forms part of the terms
and conditions of the applicable end user license agreement, terms of use, or other online or mutually executed agreement (the
“Agreement”) between you (“Customer”) and Versa Networks, Inc. (“Versa”). By accessing or using Versa’s products or services,
Customer acknowledges and agrees that this Addendum is legally binding and forms an integral part of the Agreement, and that
Customer is contractually bound to comply with the terms set forth herein.
1. Subject Matter and Duration.
1.1. Subject Matter. This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the
Processing of Customer Personal Data in connection with Versa’s execution of the Agreement. All capitalized terms that are
not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language
in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.
1.2. Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement or upon the
date that the parties sign this Addendum if it is completed after the effective date of the Agreement. Versa will Process
Customer Personal Data until the relationship terminates as specified in the Agreement.
2. Definitions. For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.
2.1. “Customer Personal Data” means Personal Data Processed by Versa on behalf of Customer to provide the Services under
the Agreement.
2.2. “Data Protection Laws” means the applicable data privacy, data protection, and cybersecurity laws, rules and regulations to
which the Customer Personal Data are subject. “Data Protection Laws” may include, but are not limited to, the California
Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); the EU General Data Protection
Regulation 2016/679 (“GDPR”) and its respective national implementing legislations; the Swiss Federal Act on Data
Protection; the United Kingdom General Data Protection Regulation; the United Kingdom Data Protection Act 2018; and the
Virginia Consumer Data Protection Act (in each case, as amended, adopted, or superseded from time to time).
2.3. “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data
Protection Laws.
2.4. “Process” or “Processing” means any operation or set of operations which is performed on Personal Data or sets of Personal
Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment
or combination, restriction, erasure, or destruction.
2.5. “Security Incident(s)” means the breach of security leading to the accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of, or access to Customer Personal Data attributable to Versa.
2.6. “Services” means the services that Versa performs under the Agreement.
2.7. “Subprocessor(s)” means Versa’s authorized vendors and third-party service providers that Process Customer Personal Data.
3. Processing Terms for Customer Personal Data.
3.1. Documented Instructions. Versa shall Process Customer Personal Data to provide the Services in accordance with the
Agreement, this Addendum, any applicable Statement of Work, and any instructions agreed upon by the parties. Versa will,
unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between
Customer’s instructions and applicable law or otherwise seeks to Process Customer Personal Data in a manner that is
inconsistent with Customer’s instructions.
3.2. Authorization to Use Subprocessors. To the extent necessary to fulfill Versa’s contractual obligations under the Agreement,
Customer hereby authorizes Versa to engage Subprocessors. Customer acknowledges that Subprocessors may further
engage vendors.
1
3.3. Versa and Subprocessor Compliance. Versa shall (i) enter into a written agreement with Subprocessors regarding such
Subprocessors’ Processing of Customer Personal Data that imposes on such Subprocessors data protection requirements for
Customer Personal Data that are consistent with this Addendum; and (ii) remain responsible to Customer for Versa’s
Subprocessors’ failure to perform their obligations with respect to the Processing of Customer Personal Data.
3.4. Right to Object to Subprocessors. Where required by Data Protection Laws, Versa will notify Customer via email prior to
engaging any new Subprocessors and allow Customer ten (10) days to object. If Customer has legitimate objections to the
appointment of any new Subprocessor, the parties will work together in good faith to resolve the grounds for the objection.
3.5. Confidentiality. Any person authorized to Process Customer Personal Data must be subject to a duty of confidentiality,
contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of
confidentiality.
3.6. Personal Data Inquiries and Requests. Where required by Data Protection Laws, Versa agrees to provide reasonable
assistance and comply with reasonable instructions from Customer related to any requests from individuals exercising their
rights in Customer Personal Data granted to them under Data Protection Laws.
3.7. Data Protection Assessment, Data Protection Impact Assessment, and Prior Consultation. Where required by Data Protection
Laws, Versa agrees to provide reasonable assistance and information to Customer where, in Customer’s judgement, the type
of Processing performed by Versa requires a data protection assessment, data protection impact assessment, and/or prior
consultation with the relevant data protection authorities. Customer shall reimburse Versa for all non-negligible costs Versa
incurs in performing its obligations under this Section.
3.8. Demonstrable Compliance. Versa agrees to provide information reasonably necessary to demonstrate compliance with this
Addendum upon Customer’s reasonable request.
3.9. California Specific Terms. To the extent that Versa’s Processing of Customer Personal Data is subject to the CCPA, this Section
shall also apply. Customer discloses or otherwise makes available Customer Personal Data to Versa for the limited and
specific purpose of Versa providing the Services to Customer in accordance with the Agreement and this Addendum. Versa
shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under
the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms
are defined by the CCPA) Customer Personal Data; (v) not retain, use, or disclose Customer Personal Data for any purpose
(including any commercial purpose) other than to provide the Services or as otherwise permitted under the CCPA; (vi) not
retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Versa or
as otherwise permitted under the CCPA; and (vii) unless otherwise permitted by the CCPA, not combine Customer Personal
Data with Personal Data that Versa: (a) receives from, or on behalf of, another person, or (b) collects from its own,
independent consumer interaction. Versa will permit Customer, upon reasonable request, to take reasonable and
appropriate steps to ensure that Versa processes Customer Personal Data in a manner consistent with the obligations
applicable to a “Business” under the CCPA by requesting that Versa attest to its compliance with this Section 3.9 of the
Addendum. Following any such request, Versa will promptly provide that attestation or notice about why it cannot provide
it. If Customer reasonably believes that Versa is engaged in the Processing of Customer Personal Data that is not authorized
under this Addendum, Customer will immediately notify Versa of such belief, and the parties will work together in good faith
to remediate the allegedly violative Processing activities, if necessary.
3.10. Aggregation and De-Identification. Versa may: (i) compile aggregated and/or de-identified information in connection with
providing the Services provided that such information cannot reasonably be used to identify Customer or any data subject
to whom Customer Personal Data relates (“Aggregated and/or De-Identified Data”); and (ii) use Aggregated and/or De-
Identified Data for its lawful business purposes.
3.11. Third-Party Services. Certain features and functionalities within the Services may allow Customer and its authorized users
to interface or interact with, access, use, and/or share Customer Personal Data with compatible third-party services,
products, technology, and content (collectively, “Third-Party Services”) through the Services. Customer does not provide
any aspect of the Third-Party Services and is not responsible for any compatibility issues, errors or bugs in the Services or
Third-Party Services caused in whole or in part by the Third-Party Services or any update or upgrade thereto. Customer is
solely responsible for maintaining the Third-Party Services and obtaining any associated licenses and consents necessary for
Customer to use the Third-Party Services in connection with the Services.
4. Information Security Program. Versa shall implement and maintain reasonable administrative, technical, and physical safeguards
designed to protect Customer Personal Data.
2
5. Security Incidents. Upon becoming aware of a Security Incident, Versa agrees to provide written notice without undue delay and
within the time frame required under Data Protection Laws to Customer’s Designated POC. Where possible, such notice will
include all available details required under Data Protection Laws for Customer to comply with its own notification obligations to
regulatory authorities or individuals affected by the Security Incident.
6. Cross-Border Transfers of Customer Personal Data.
6.1. Cross-Border Transfers of Customer Personal Data. Customer authorizes Versa and its Subprocessors to transfer Customer
Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United
Kingdom to the United States.
6.2. EEA, Swiss, and UK Standard Contractual Clauses. If Customer Personal Data originating in the European Economic Area,
Switzerland, and/or the United Kingdom is transferred by Customer to Versa in a country that has not been found to provide
an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed
by Module Two’s obligations in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on
standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council (“Standard Contractual Clauses”) as supplemented by Exhibit A attached hereto,
the terms of which are incorporated herein by reference. Each party’s acceptance of the Agreement and/or this Addendum
shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses
apply hereunder.
7. Audits and Assessments. Where Data Protection Laws afford Customer an audit or assessment right, Customer (or its appointed
representative) may carry out an audit or assessment of Versa’s policies, procedures, and records relevant to the Processing of
Customer Personal Data. Any audit or assessment must be: (i) conducted during Versa’s regular business hours; (ii) with
reasonable advance notice to Versa; (iii) carried out in a manner that prevents unnecessary disruption to Versa’s operations; and
(iv) subject to reasonable confidentiality procedures. In addition, any audit or assessment shall be limited to once per year, unless
an audit or assessment is carried out at the direction of a government authority having proper jurisdiction.
8. Customer Personal Data Deletion. At the expiry or termination of the Agreement, Versa will delete all Customer Personal Data
(excluding any back-up or archival copies which shall be deleted in accordance with Versa’s data retention schedule), except
where Versa is required to retain copies under applicable laws, in which case Versa will isolate and protect that Customer Personal
Data from any further Processing except to the extent required by applicable laws.
9. Customer’s Obligations. Customer represents and warrants that: (i) it has complied and will comply with Data Protection Laws;
(ii) it has provided data subjects whose Customer Personal Data will be Processed in connection with the Agreement with a privacy
notice or similar document that clearly and accurately describes Customer’s practices with respect to the Processing of Customer
Personal Data; (iii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases,
authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by the Agreement; and (iv)
Versa’s Processing of Customer Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a
breach of any agreement or obligations between Customer and any third party.
10. Processing Details.
10.1. Subject Matter. The subject matter of the Processing is the Services pursuant to the Agreement.
10.2. Duration. The Processing will continue until the expiration or termination of the Agreement.
10.3. Categories of Data Subjects. Data subjects whose Customer Personal Data will be Processed pursuant to the Agreement.
10.4. Nature and Purpose of the Processing. The purpose of the Processing of Customer Personal Data by Versa is the performance
of the Services.
10.5. Types of Customer Personal Data. Customer Personal Data that is Processed pursuant to the Agreement.
11. Contact Information. Customer and Versa agree to designate a point of contact for urgent privacy and security issues (a
“Designated POC”). The Designated POC for both parties are:
• Customer Designated POC: To be notified by the Customer upon the acceptance of the Agreement
• Versa Designated POC: compliance@versa-networks.com
3
EXHIBIT A TO THE DATA PROCESSING ADDENDUM
This Exhibit A forms part of the Addendum and supplements the Standard Contractual Clauses. Capitalized terms not defined in this
Exhibit A have the meaning set forth in the Addendum.
The parties agree that the following terms shall supplement the Standard Contractual Clauses:
1. Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added the Standard Contractual Clauses which shall read:
“To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that
is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory
authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that
are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which
shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the
Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in
Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and, notwithstanding anything to the contrary, data
importer may engage new subprocessors in accordance with Section 3.4 of the Addendum; (v) the optional text in Clause 11 is
deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers),
Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
2. Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data Exporter: Customer.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: Customer’s Designated POC.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Controller.
Data Importer: Versa.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: Versa’s Designated POC.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Processor.
B. Description of the Transfer:
Categories of data subjects whose personal data is transferred: The categories of data subjects whose personal data is transferred
under the Clauses.
Categories of personal data transferred: The categories of personal data transferred under the Clauses.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the
data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having
followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security
measures: To the parties knowledge, no sensitive data is transferred.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred
in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.
Nature of the processing: The Services.
Purpose(s) of the data transfer and further processing: The Services.
4
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data
importer will retain personal data in accordance with the Addendum.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter,
nature, and duration as identified above.
C. Competent Supervisory Authority: The supervisory authority mandated by Clause 13. If no supervisory authority is mandated
by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties
consistent with the conditions set forth in Clause 13.
D. Additional Data Transfer Impact Assessment Questions:
Will data importer process any personal data under the Clauses about a non-United States person that is “foreign intelligence
information” as defined by 50 U.S.C. § 1801(e)?
Not to data importer’s knowledge.
Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom
where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Clauses?
For example, FISA Section 702. If yes, please list these laws:
As of the effective date of the Addendum, no court has found data importer to be eligible to receive process issued under the
laws contemplated by this question, including FISA Section 702, and no such court action is pending.
Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the
question above? If yes, please explain:
No.
Has data importer ever received a request from public authorities for personal data of individuals located in European Economic
Area, Switzerland, and/or the United Kingdom? If yes, please explain:
No.
E. Data Transfer Impact Assessment Outcome: Taking into account the information and obligations set forth in the Addendum
and, as may be the case for a party, such party’s independent research, to the parties’ knowledge, the personal data originating
in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the Clauses to a country
that has not been found to provide an adequate level of protection under applicable data protection laws is afforded a level of
protection that is essentially equivalent to that guaranteed by applicable data protection laws.
F. Clarifying Terms: The parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses
will be provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of
the Clauses will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried
out in accordance with Section 7 of the Addendum; (iv) the termination right contemplated by Clause 14(f) and Clause 16(c) of
the Clauses will be limited to the termination of the Clauses; (v) unless otherwise stated by data importer, data exporter will be
responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Clauses; (vi) the information required under
Clause 15.1(c) of the Clauses will be provided upon data exporter’s written request; and (vii) notwithstanding anything to the
contrary, data exporter will reimburse data importer for all costs and expenses incurred by data importer in connection with the
performance of data importer’s obligations under Clause 15.1(b) and Clause 15.2 of the Clauses without regard for any limitation
of liability set forth in the Agreement.
5
3. Annex II. Annex II of the Standard Contractual Clauses shall read as follows:
Data importer shall implement and maintain technical and organizational measures designed to protect personal data in
accordance with the Addendum.
Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the
Addendum.
4. Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:
The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual
Clauses (“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in
Annex I, Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including
the Appendix Information, effective as of the effective date of the Addendum.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.
Versa Networks, Inc, 2550 Great America Way, Suite 350, Santa Clara, CA 95054
Tel: +1 408.385.7660 | Email: info@versa-networks.com | Website: www.versa-networks.com
6
© 2025 Versa Networks, Inc. All rights reserved. Portions of Versa products are protected under Versa patents, as well as patents pending. Versa Networks
and VOS are trademarks or registered trademarks of Versa Networks, Inc. All other trademarks used or mentioned herein belong to their respective owners.