Snapshot 224510
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
Last Updated: JuLY 16, 2026
This Data Processing Addendum ("DPA") supplements the Agreement or related Order Form entered into between Teleskope Inc. ("Teleskope") and the customer (the "Customer") (the "Agreement") in relation to the transfer and processing of Covered Data in connection with the performance of the Services.
1. DEFINITIONS
1.1 Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalized terms used in this DPA will be defined as follows:
"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation): the GDPR, Swiss Data Protection Laws and the US Data Protection Laws.
"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, including its implementing regulations and the California Privacy Rights Act of 2020.
"Controller Purposes" means: (a) administering, maintaining, and providing technical support for the Services; (b) generating deidentified or aggregated analytics to monitor and improve the performance and security of the Services, provided such analytics cannot reasonably identify Customer or any Data Subject and we commit to notatempting to reidentify Customer or any Data Subject and (c) administering the Customer’s relationship with Teleskopeunder the Agreement. For the avoidance of doubt, Controller Purposes do notinclude training, improving, or developing any machine-learning orartificial-intelligence model for general use using Covered Data.
"Covered Data" means Personal Data that is: (a) provided by or on behalf of Customer to Teleskope in connection with the Services; or (b) obtained, developed, produced or otherwise Processed by Teleskope, or its agents or subcontractors, for the purposes of providing the Services, in each case as further described in Schedule 1.
"DataSubject" means a natural person whose Personal Data is Processed.
"Deidentified Data" means data created using Covered Data that cannot reasonably be linked to such Covered Data, directly or indirectly, and for which there is no attempt to reidentify such data.
"GDPR" means Regulation (EU) 2016/679 (the "EUGDPR") or, where applicable, the "UK GDPR", as defined in section 3 of the UK Data Protection Act 2018.
"Personal Data" means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data", "personal information", "personally identifiable information", or similarly defined data or information under Applicable Data Protection Laws.
"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. "Process", "Processes" and "Processed" will be interpreted accordingly.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorized access to (including unauthorized internal access to), Covered Data.
"Services"means the services to be provided by Teleskope to Customer under the Agreement.
"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.
"Sub-processor" means, with respect to any Processing performed by Teleskope as a processor or service provider, an entity appointed by Teleskope to Process Covered Data on its behalf.
"Swiss Data Protection Laws" means the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP") and the Swiss Data Protection Ordinance of 31 August 2022 (the "Ordinance"), and any new or revised version of these laws that may enter into force for time to time.
"US Data Protection Laws" means all applicable federal and state laws rules, regulations, and governmental requirements relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including (without limitation): the CCPA, the Virginia Consumer Data Protection Act, Code of Virginia Title 59.1 Chapter 52 § 59.1-571 et seq., the Colorado Privacy Act, Colorado Revised Statute Title 6 Article 1 Part 13 § 6-1-1301 et seq., the Utah Consumer Privacy Act, Utah Code § 13-6-101 et seq., Connecticut Senate Bill 6, An Act Concerning Personal Data Privacy and Online Monitoring (as such law is chaptered and enrolled), and similar U.S. state privacy laws.
"Usage and Administration Data" means:
(a) diagnostic, usage and performance information collected by Teleskope in relation to the Customer's and its authorised users' use of the Services, including metadata relating to content and information uploaded by the Customer to the Services;
(b) contact details relating to, and the content of correspondence with the Customer's main account holder or administrator;
(c) support enquiries submitted by the Customer's authorised users in relation to the Services.
1.2 The terms "controller", "processor", "business" and "service provider" have the meanings given to them in the Applicable Data Protection Laws.
2. INTERACTION WITH THE AGREEMENT
This DPA is incorporated into and forms an integral part of the Agreement, and they are a single agreement. In case of contradictions between the DPA and the Agreement, the DPA prevails with respect to any Processing of Covered Data.
3. ROLE OF THE PARTIES
The Parties acknowledge and agree that:
(a) save as set out in paragraph 3(b), Teleskope acts as a processor or service provider in the performance of its obligations under the Agreement and this DPA and Customer acts as a controller or business; and
(b) for the purposes of the GDPR, Teleskope acts as a controller with respect to the Processing of Usage and Administration Data for the Controller Purposes.
4. DETAILS OF DATAPROCESSING
4.1 The details of the Processing of Personal Data under the Agreement and this DPA (including subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.
4.2 Teleskope shall comply with its obligations under Applicable Data Protection Laws. Save with respect to any Processing of Usage and Administration Data for the Controller Purposes, Teleskope will only Process Covered Data on behalf of and under the instructions of Customer and in accordance with Applicable Data Protection Laws.
4.3 The Agreement and this DPA shall constitute Customer’s instructions for the Processing of Covered Data. Customer may issue further written instructions in accordance with this DPA. Without limiting the foregoing, Teleskope is prohibited from:
(a) selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
(b) sharing Covered Data with any third party for cross-context behavioural advertising;
(c) retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Applicable Data Protection Laws;
(d) retaining, using, or disclosing Covered Data outside of the direct business relationship between the Parties; and
(e) except as otherwise permitted by Applicable Data Protection Laws, combining Covered Data with Personal Data that Teleskope receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.
4.4 Teleskope will:
(a) provide Customerwith information to enable Customer to conduct and document any dataprotection assessments required under Applicable Data Protection Laws; and
(b) promptly inform Customer if, in its opinion, an instruction from Customer infringes the Applicable Data Protection Laws.
5. COMPLIANCE
5.1 Customer shall comply with its obligations as a controller, business or equivalent term under the Applicable Data Protection Laws, and shall:
(a) provide such information to Data Subjects regarding the Processing of their Covered Data in connection with the Customer’s use of the Services as required under Applicable Data Protection Laws; and
(b) implement appropriate technical and organizational measures to give effect to Data Subject rights under Applicable Data Protection Laws, and shall comply, in accordance with Section 8 below, with requests from Data Subjects to exercise their rights under Applicable Data Protection Laws within the timeframe and subject to any exemptions prescribed in the Applicable Data Protection Laws.
6. CONFIDENTIALITY AND DISCLOSURE
6.1 Teleskope shall:
(a) limit access to Covered Data to personnel who have a business need to have access to such Covered Data; and
(b) ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement, including duties of confidentiality with respect to any Covered Data to which they have access.
7. SUB-PROCESSORS
7.1 Teleskope may Process Covered Data anywhere that Teleskope or its Sub-processors maintain facilities, subject to the remainder of this clause 7.
7.2 Customer grants Teleskope general authorisation to engage any of the Sub-processors listed in Schedule 4, as amended in accordance with clause 7.4 (the "Authorised Sub-processors"), to Process Covered Data.
7.3 Teleskope shall:
(a) enter into a written agreement with each Authorised Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Teleskope's obligations under this DPA; and
(b) remain liable for each Authorised Sub-processor’s compliance with the obligations under this DPA.
7.4 Teleskope will provide Customer with at least thirty(30) days’ notice of any proposed changes to the AuthorisedSub-processors. Customer shall notify Teleskope if it objects to the proposedchange to the Authorised Sub-processors (including, where applicable, whenexercising its right to object under clause 9(a) of the SCCs) by providingTeleskope with written notice of the objection within fourteen (14) daysafter Teleskope has provided notice to Customer of such proposed change (an"Objection").
7.5 In the event Customer submits an Objection to Teleskope, Teleskope and Customer shall work together in good faith to find a mutually acceptable resolution to address such Objection. If Teleskope and Customer are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, unless Teleskope is able and elects to Process Customer Data only with Authorized Sub-processor(s) (not the sub-Processor to which Customer lodged its Objection), Customer may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Teleskope.
7.6 Teleskope shall notify the Customer of any failure by the sub-processor to fulfil its obligations under the relevant agreement between Teleskope and the sub-processor.
8. DATA SUBJECT RIGHTS REQUESTS
8.1 Teleskope will notifyCustomer promptly ofany request received by Teleskope or any Authorised Sub-processorfrom a Data Subject to assert their rights in relation to Covered Data underApplicable Data Protection Laws (a "Data Subject Request").
8.2 Other than in respect of any Processing of Covered Data for the Controller Purposes, Customer will have sole discretion in responding to the Data Subject Request, and Teleskope shall not respond to the Data Subject Request, save that Teleskope may advise the Data Subject that their request has been forwarded to Customer.
8.3 Teleskope will provide Customer with reasonable assistance as necessary for Customer to fulfil its obligation under Applicable Data Protection Laws to respond to Data Subject Requests.
9. SECURITY
9.1 Teleskope will implement and maintain appropriate technical and organizational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorised or unlawful Processing and against accidental loss, destruction, or damage of or to Covered Data.
9.2 When assessing the appropriate level of security, Teleskope shall take into account the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Covered Data.
9.3 Teleskope will implement and maintain as a minimum standard the measures set out in Schedule 2.
10. INFORMATION AND AUDITS
10.1 Teleskope shall notify Customer promptly if Teleskope determines that it can no longer meet its obligations under Applicable Data Protection Laws.
10.2 Customer may take reasonable and appropriate steps to:
(a) ensure that Teleskope uses Covered Data in a manner consistent with Customer’s obligations under Applicable Data Protection Laws; and
(b) upon reasonable notice, stop and remediate unauthorized use of Covered Data.
10.3 Customer may audit Teleskope's compliance with this DPA on an annual basis (or with no frequency cap, following a Security Incident). The Parties agree that all such audits will be conducted:
(a) upon reasonable written notice to Teleskope;
(b) only during Teleskope's normal business hours; and
(c) in a manner that does not materially disrupt Teleskope's business or operations and that does not reveal confidential or proprietary information of Teleskope or its other customers where not relevant to Customer.
10.4 With respect to anyaudits conducted in accordance with clause 10.3:
(a) Customer may engage a third-party auditor to conduct the audit on its behalf;
(b) Teleskope shall not be required to facilitate any such audit unless and until the Parties have agreed in writing the scope and timing of such audit.
10.5 Customer shall promptly notify Teleskope of any non-compliance discovered during an audit.
10.6 The results of the audit shall be Teleskope's confidential information.
10.7 Teleskope shall provide to Customer upon request, or may provide to Customer in response to any audit request submitted by Customer toTeleskope, either of the following:
(a) data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company; or
(b) such other documentation reasonably evidencing the implementation of the technical and organizational data security measures in accordance with industry standards.
10.8 If an audit requested by Customer is addressed in the documents or certification provided byTeleskope in accordance with paragraph 10.7, and:
(a) the certification or documentation is dated within twelve (12) months of Customer’s audit request; and
(b) Teleskope confirms that there are no known material changes in the controls audited,
Customer agrees to accept that certification or documentation in lieu of conducting a physical audit of the controls covered by the relevant certification or documentation.
11. SECURITY INCIDENTS
11.1 Teleskope shall notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after becoming aware of any Security Incident.
11.2 Teleskope shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and shall send Customer timely information about the Security Incident, to the extent known to Teleskope or as the information becomes available to Teleskope, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation.
11.3 Teleskope shall provide reasonable assistance with Customer’s investigation of any Security Incidents and any of Customer’s obligations in relation to the Security Incident under Applicable Data Protection Laws, including any notification to Data Subjects or supervisory authorities. If the Security Incident was caused by Teleskope’s material breach of this DPA, Teleskope will pay the reasonable out-of-pocket costs of legally-required notifications to Data Subjects, provided that Teleskope’s aggregate liability under this DPA shall be subject to the liability limitations set forth in the Agreement.
11.4 Teleskope's notification of or response to a Security Incident under this paragraph 11 shall not be construed as an acknowledgement by Teleskope of any fault or liability with respect to the Security Incident.
12. TERM, DELETION AND RETURN
12.1 This DPA shall commence on the Effective Date of the Agreement and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Teleskope's deletion of all Covered Data as described in this DPA.
12.2 Teleskope shall:
(a) if requested to do so by Customer within thirty (30) days of expiry of the Agreement (the "Retention Period"), provide a copy of all Covered Data in such commonly used format as requested by Customer, or provide a self-service functionality allowing Customer to download such Covered Data; and
(b) on expiry of the Retention Period, delete, destroy, or de-identify all copies of Covered Data Processed by Teleskope or any Authorized Sub-processors within thirty (30) days, excluding any Covered Data Processed for the Controller Purposes.
13. STANDARD CONTRACTUALCLAUSES
13.1 The Standard Contractual Clauses shall, as further set out in Schedule 3, apply to the transfer of any Covered Data from Customer to Teleskope, and form part of this DPA, to the extent that:
(a) the GDPR or Swiss Data Protection Law applies to the Customer when making that transfer; or
(b) the Applicable Data Protection Laws that apply to the Customer when making that transfer (the "Exporter Data Protection Laws") prohibit the transfer of Covered Data to Teleskope under this DPA in the absence of a transfer mechanism implementing adequate safeguards in respect of the Processing of that Covered Data, and any one or more of the following applies:
(i) the relevant authority with jurisdiction over the Customer’s transfer of Covered Data under this DPA has not formally adopted standard data protection clauses or another transfer mechanism under the Exporter Data Protection Laws; or
(ii) such authority has issued guidance that entering into standard contractual clauses approved by the European Commission would satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
(iii) established market practice in relation to transfers subject to the Exporter Data Protection Laws is to enter into standard contractual clauses approved by the European Commission to satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
(c) the transfer is an "onward transfer" (as defined in the applicable module of the SCCs).
13.2 The Parties agree that execution of the Agreement shall have the same effect as signing the SCCs.
14. DEIDENTIFIED DATA
If Teleskope receives Deidentified Data from or on behalf of Customer, Teleskope shall:
(a) take reasonable measures to ensure the information cannot be associated with a Data Subject;
(b) publicly commit to Process the Deidentified Data solely in deidentified form and not to attempt to reidentify the information; and
(c) contractually obligate any recipients of the Deidentified Data to comply with the foregoing requirements and Applicable Data Protection Laws.
15. GENERAL
15.1 The Parties hereby certify that they understand the requirements in this DPA and will comply with them.
15.2 To the maximum extent permitted by applicable law, the Parties agree that each Party's aggregate liability for any claims, losses, damages or liability arising under this DPA shall be subject to liability limitations set forth in the Agreement.
15.3 The Parties agree to negotiate in good faith any amendments to this DPA as may be required inconnection with changes in Applicable Data Protection Laws.
15.4 Upon Customer’s reasonable request, Teleskope shall provide Customer with reasonable cooperation and assistance needed to fulfill Customer’s obligation under Applicable Data Protection Laws to carryout a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information and to the extent such information is available to Teleskope.
15.5 Unless otherwise specified in the Agreement or anapplicable Order Form, Teleskope shall Process Covered Data within the United States. Teleskope shall provide Customer with at least forty-five (45) days’ prior written notice before Processing Covered Data in any additional jurisdiction. For the avoidance of doubt, international transfers of Covered Data shall be subject to the Standard Contractual Clauses as set forth in Section 13 and Schedule 3.
Schedule 1
Details of Processing
A. List of Parties
Customer Teleskope
Role Data exporter (controller) Data importer (processor)
Contact person As specified in the Agreement. Elizabeth Nammour (Chief Executive Officer)
elizabeth.nammour@teleskope.ai
Activities relevant to the transfer The receipt of the Services under the Agreement. The performance of the Services under the Agreement.
B. Description of Processing
Categories of Data Subjects Customer’s employees, contractors, vendors, suppliers, end users, and any other Data Subjects whose Personal Data is processed in connection with the Services.
Categories of Personal Data
Name, email address, job title, employer, IP address, device identifiers, browser metadata, and such other categories of Personal Data as contained in data provided by or on behalf of Customer through the Services
Special categories of Personal Data
The Services are not intended to process special categories of Personal Data and Customer should not provide such data to Teleskope.
Frequency of the transfer
Continuous for the term of the Agreement.
Nature of the Processing
Collection, storage, deletion, rectification, aggregation
Purposes of the data transfer and further Processing The provision of Teleskope's data management and compliance platform, including:
analysing and structuring data managed by the Customer through the Services;
providing the Customer's authorised users with access to the Services;
resolving queries and support requests submitted by the Customer.
Retention period For as long as Teleskope Processes Personal Data pursuant to the Agreement, unless earlier deletion is requested by the Customer
Subprocessors As set out in Schedule 4
Schedule 2
Technical and Organizational Measures
Introduction
Teleskope maintains SOC 2 Type II certification and aligns its information security management system with ISO/IEC 27001 standards. Teleskope employs a combination of policies, procedures, and technical and physical controls to protect the personal and sensitive data it processes from accidental loss and unauthorised access, disclosure or destruction.
Information Security Policies
Teleskope assigns personnel with responsibility for the determination, review and implementation of data handling policies and measures.
Teleskope:
has Information Security policies and procedures in place that outline the acceptable use and protection of customers, employees, and Teleskope, Inc. from illegal or damaging actions by individuals, either knowingly or unknowingly;
reviews, updates, and communicates all Information Security policies and procedures annually and when there are major updates within Teleskope, Inc.'s systems and processes;
Conducts Security Training upon a new hire's first week, and annually thereafter.
Teleskope’s Secure Development Policy ensures that information security is designed and implemented within the development lifecycle for applications and information systems.
Incident Response
Teleskope’s Incident Response Plan establishes the procedure for managing information security incidents and events, and offers guidance for employees or incident responders who believe they have discovered, or are responding to, a security incident.
Intrusion, anti-virus and anti-malware defenses
Teleskope IT systems have threat detection and vulnerability scanning by default, including:
firewall, network intrusion prevention and detection;
data exfiltration prevention and detection;
brute force attack prevention and detection;
continuous vulnerability scanning;
annual penetration testing and additional penetration testing when there are major updates;
collection, retention, and review of audit trails
active monitoring and alerting of Teleskope, Inc.'s network, infrastructure, mobile devices, systems, and applications.
Access controls
Teleskope limits access to information and information processing systems, networks, and infrastructure to authorized parties in accordance with business objectives by following the principles of least privilege access:
never copying or retaining customer data, only processing data for the purposes of classification;
access to information computing resources is limited to personnel with a business requirement for such access. Access rights are granted or revoked in accordance with the policy;
Single-SignOn is applied where possible with a hardware security key as the method for multi-factor authentication;
all access and action events have audit trails/logged;
access to Teleskope platform application file systems and operating systems is prohibited and disabled by default;
access to Teleskope platform ONLY supports passwordless authentication; and
access requests are tracked via a ticketing system.
Business Continuity and Disaster Recovery Plan
Teleskope’s Business Continuity and Disaster Recovery Plan prepares the company in the event of service outages caused by factors beyond our control (e.g. natural disasters, man-made events), and restores services to the widest extent possible in a minimum time frame. The plan is reviewed, tested, and updated annually and when updates are necessary.
Teleskope performs daily automated backups which are configured and restoration is tested on a regular basis.
Segmentation of personal data
Teleskope, Inc. uses a single-tenant architecture. Each customer's Teleskope deployment is either self-hosted, or deployed in an isolated AWS account. No customers share the same AWS account or infrastructure.
Teleskope, Inc. does not copy or retain customer data, except for end-useremail that is used to authenticate to their deployment of the Teleskope platform.
Encryption
All databases, datastores and file systems are encrypted according to Teleskope's Cryptography Policy.
Data at rest is encrypted using industry standard 256-bit Advanced Encryption Standard.
Teleskope supports the latest recommended secure cipher suites to encrypt all traffic in transit, including the use of TLS 1.2 protocols, AES256 encryption and SHA2 signatures.
Schedule 3
STANDARD CONTRACTUAL CLAUSES
1. EU SCCS
With respect to any transfers referred to in clause 13, the Standard Contractual Clauses shall be completed as follows:
1.1 Module One (controller to controller) of the SCCs will apply with respect to Teleskope's Processing of Covered Data for the Controller Purposes; otherwise, Module Two (controller to processor) of the SCCs will apply.
1.2 Clause 7 of the Standard Contractual Clauses (DockingClause) does not apply.
1.3 Option 2 of Clause 9(a) (General written authorization) shall apply, and the time period to be specified is determined in clause 7.4 of the DPA.
1.4 The option in Clause 11(a) of the Standard Contractual Clauses (Independent dispute resolution body) does not apply.
1.5 With regard to Clause 17 of the Standard Contractual Clauses (Governing law), the Parties agree that option 1 will apply and the governing law will be Irish law.
1.6 In Clause 18 ofthe Standard Contractual Clauses (Choice of forum and jurisdiction), the Parties submit themselves to the jurisdiction of the courts of Ireland.
1.7 For the Purpose of Annex I of the Standard Contractual Clauses, Schedule 1 of the DPA contains the specifications regarding the parties, the description of transfer, and the competent supervisory authority.
1.8 For the Purpose ofAnnex II of the Standard Contractual Clauses, Schedule 2 of the DPA contains the technical and organizational measures.
2. UK Addendum
2.1 This paragraph 2 (UK Addendum) shall apply to any transfer of Covered Data from Customer (as data exporter) to Teleskope (as data importer), to the extent that:
(a) the UK Data Protection Laws apply to Customer when making that transfer; or
(b) the transfer is an "onward transfer" as defined in the Approved Addendum.
2.2 As used in this paragraph 2:
"Approved Addendum" means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, as it may be revised according to Section 18 of the Approved Addendum.
"UK Data Protection Laws" means all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
2.3 The Approved Addendum will form part of this DPA with respect to any transfers referred to in paragraph 2.1, and execution of this DPA shallhave the same effect as signing the Approved Addendum.
2.4 The Approved Addendum shall be deemed completed as follows:
(a) the "Addendum EUSCCs" shall refer to the SCCs as they are incorporated into this Agreement in accordance with clause 13 and this Schedule 3;
(b) Table 1 of the Approved Addendum shall be completed with the details in paragraph A of Schedule 1;
(c) the "Appendix Information" shall refer to the information set out in Schedule 1 and Schedule 2
(d) for the purposes of Table 4 of the Approved Addendum, either Party may end this DPA, to the extent the Approved Addendum applies, in accordance with Section 19 of the Approved Addendum; and
(e) Section 16 of the Approved Addendum does not apply.
3. Swiss Addendum
3.1 This Swiss Addendum will apply to any Processing of Covered Datathat is subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the EU GDPR.
3.2 Interpretation of this Addendum
(a) Where this Addendum uses terms that are defined in the Standard Contractual Clauses, those terms will have the same meaning as in the Standard Contractual Clauses. In addition, the following terms have the following meanings:
"Addendum" means this addendum to the Clauses;
"Clauses" means the Standard Contractual Clauses as incorporated into this DPA in accordance with clause 13 and as further specified in this Schedule 3; and
"FDPIC" means the Federal Data Protection and Information Commissioner.
(b) This Addendum shall beread and interpreted in a manner that is consistent with Swiss Data Protection Laws, and so that it fulfils the Parties' obligations under Article 16(2)(d) ofthe FADP.
(c) This Addendum will not be interpreted in a way that conflicts with rights and obligations provided forin Swiss Data Protection Laws.
(d) Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Swiss Addendum has been entered into.
(e) In relation to any Processing of Personal Data subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the GDPR, this Addendum amends and supplements the Clauses to the extent necessary so they operate:
(i) for transfers made by the data exporter to the data importer, to the extent that Swiss Data Protection Laws apply to the data exporter’s Processing when making that transfer; and
(ii) as standard data protection clauses approved, issued or recognised by the FDPIC for the purposes of Article 16(2)(d) of the FADP.
3.3 Hierarchy
In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions of the Clauses will prevail.
3.4 Changes to the Clauses for transfers exclusively subject to Swiss Data Protection Laws
To the extent that the data exporter's Processing of Personal Data is exclusively subject to Swiss Data Protection Laws, or the transfer of Personal Data from a data exporter to a data importer under the Clauses is an "onward transfer" (as definedin the Clauses, as amended by the remainder of this paragraph 3.3(a)) the following amendments are made to the Clauses:
(a) References to the "Clauses" or the "SCCs" mean this Swiss Addendum as it amends the SCCs.
(b) Clause 6 Description ofthe transfer(s) is replaced with:
"The details of the transfer(s), and in particular the categories of Personal Data that are transferred and the purpose(s) for whicht hey are transferred, are those specified in Schedule 1 of this DPA where Swiss Data Protection Laws apply to the data exporter’s Processing when making that transfer."
(c) References to "Regulation (EU) 2016/679" or "that Regulation" or "GDPR" are replaced by "Swiss Data Protection Laws" and references to specific Article(s) of "Regulation (EU) 2016/679" or "GDPR" are replaced with the equivalent Article or Section of Swiss Data Protection Laws extent applicable.
(d) References to Regulation (EU) 2018/1725 are removed.
(e) References to the "European Union", "Union", "EU" and "EU Member State" are all replaced with "Switzerland".
(f) Clause 13(a) and Part C of Annex I are not used; the "competent supervisory authority" is the FDPIC;
(g) Clause 17 is replaced to state:
"These Clauses are governed by the laws of Switzerland".
(h) Clause 18 is replaced to state:
"Any dispute arising from these Clauses relating to Swiss Data Protection Laws will be resolved by the courts of Switzerland. A Data Subject may also bring legal proceedings against the data exporter and/or data importer before the courts of Switzerland in which he/she has his/her habitual residence. The Parties agree to submit themselves to the jurisdiction of such courts."
3.5 Supplementary provisions for transfers of Personal data subject to both the GDPR and Swiss Data Protection Laws
(a) To the extent that the data exporter's Processing of Personal Datais subject to both Swiss Data Protection Laws and the GDPR, or the transfer of Personal Data from a data exporter to a data importer under the Clauses is an "onward transfer" under both the Clauses and the Clauses as amended by paragraph 3.3(c) of this Addendum:
(i) for the purposes of Clause 13(a) and Part C of Annex I:
(A) the FDPIC shall act as competent supervisory authority with respect to any transfers of Personal Data to the extent Swiss Data Protection Laws apply to the data exporter's Processing when making that transfer, or such transfer is an "onward transfer" as defined in the Clauses (as amended by paragraph 3.3 of this Addendum; and
(B) subject to the provisions of paragraph 2 of this Schedule 3 (UK Addendum), the supervisory authority identified in Schedule 1 shall act as competent supervisory authority with respect to any transfers of Personal Data to the extent the GDPR applies to the data exporter's processing, or such transfer is an "onward transfer" as defined in the Clauses.
(b) the terms "European Union", "Union", "EU", and "EU Member State" shall not be interpreted in a way that excludes the ability of Data Subjects in Switzerland bringing a claim in their place of habitual residence in accordance with Clause 18(c) of the Clauses.
4. Transfers under the laws of other jurisdictions
4.1 With respect to any transfers of Personal Data referred to inclause 13.1(b) (each a "Global Transfer"), the SCCs shall not be interpreted in a way that conflicts with rights and obligations provided for in the Exporter Data Protection Laws.
4.2 For the purposes of any Global Transfers, the SCCs shall be deemed to be amended to the extent necessary so that they operate:
(a) for transfers made by the applicable data exporter to the data importer, to the extent the Exporter Data Protection Laws apply to that data exporter's Processing when making that transfer; and
(b) to provide appropriate safeguards for the transfers in accordance with the Exporter Data Protection Laws.
4.3 The amendments referred to in clause paragraph 4.2 include (without limitation) the following:
(a) references to the "GDPR" and to specific Articles of the GDPR are replaced with the equivalent provisions under the Exporter Data Protection Laws;
(b) reference to the "Union", "EU" and "EU Member State" are all replaced with reference to the jurisdiction in which the Exporter Data Protection Laws were issued (the "Exporter Jurisdiction");
(c) the "competent supervisory authority" shall be the applicable supervisory in the Exporter Jurisdiction; and
(d) Clauses 17 and 18 ofthe SCCs shall refer to the laws and courts of the Exporter Jurisdiction respectively.
4.4 Where, at any time during Teleskope's Processing of Covered Dataunder this DPA, a transfer mechanism other than the SCCs is approved under the Exporter Data Protection Laws with respect to transfers of Covered Data by Customer to Teleskope, the Parties shall promptly enter into a supplementary agreement that:
(a) incorporates any standard data protection clauses or another transfer mechanism formally adopted by the relevant authority in the Exporter Jurisdiction;
(b) incorporates the details of Processing set out in Schedule 1; and
(c) shall, with respect tothe transfer of Personal Data subject to the Exporter Data Protection Laws, take precedence over this DPA in the event of any conflict.
4.5 Where required under the Exporter Data Protection Laws, the relevant data exporter shall file a copy of the agreement entered into in accordance with paragraph 4.4 with the relevant national authority.
Schedule 4
Authorised SUB-PROCESSORS
A list of Sub-processors is available at: https://www.teleskope.ai/legal/subprocessors
Product
Platform OverviewData Reasoning LayerIntegrationsUnderstandDecideEnforceKosmo
Company
About usCareersPrivacy PolicyTerms of ServiceTrust Center
Resources
Resource LibraryDocumentationBlogNews
Connect
Contact@teleskope.aiRegister a partner dealBook a DemoContact Sales
© 2026 Teleskope, Inc. All Rights Reserved