Snapshot 231786
Normalized text
Scripts and page chrome removed; this is what change detection compares.
OPEN TEXT DATA PROCESSING ADDENDUM
1. SCOPE AND APPLICABILITY
This Data Processing Agreement (“DPA”) (including its Appendices and incorporations by reference) supplements and
forms part of the agreement (“Agreement") between the Open Text entity (“OT”) and the other party to the Agreement
(“Customer”). The terms in this DPA apply to the extent OT and its Sub-processors Process Customer Personal Data in
the course of providing the Services, either as a Processor or Service Provider, and when such Processing is subject to
the Data Protection Legislation. This DPA is in addition to, and does not relieve, remove, or replace either party’s
obligations under the applicable Data Protection Legislation.
Customer enters into this DPA on behalf of itself and, to the extent applicable and permissible under the Agreement, each
Customer Affiliate (as defined below) that Customer grants access to the Services in accordance with the terms of the
Agreement.
2. DEFINITIONS
In this DPA, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly.
Capitalized terms used in this DPA that are not expressly defined herein shall have the meanings set forth in the
Agreement.
2.1. “Adequacy Decision” means a designation issued by a competent authority that is aimed to declare an adequate
level of protection applied to a territory, context, scheme or organization, to allow for the Processing of Personal Data
under applicable Data Protection Legislation to take place within the scope defined in the designation, and shall include
certifications or authorizations granted or otherwise approved by Supervisory Authorities or government bodies (such as
the EU-US (plus UK Extension) and Swiss-US Data Privacy Frameworks).
2.2. “Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or
ownership with a company, where control is defined as the possession, directly or indirectly, of the power to direct or cause
the direction of management and the policies of an entity, whether through ownership of voting securities, by contract or
otherwise.
2.3. “Customer Personal Data” means Personal Data made available by Customer and/or its authorized users in
connection with their use of the Services pursuant to the Agreement.
2.4. “Data Protection Legislation” means any laws, regulations and other legal requirements, to the extent applicable
to the Processing (as defined below) of Customer Personal Data under this DPA and the Agreement relating to: (a) privacy,
confidentiality and data security of Personal Data; and/or (b) the use, collection, retention, storage, security, disclosure,
transfer, disposal, and/or other Processing of any Personal Data (as defined below) to the extent applicable to performance
of the Services. Notwithstanding the preceding, Data Protection Legislation does not include the Health Insurance
Portability and Accountability Act of 1996, as amended (“HIPAA”).
2.5. “Derogation” means a legal exemption or exception set out in the Data Protection Legislation that permits a
Restricted Transfer to take place under certain circumstances.
2.6. "EEA" means the European Economic Area as set forth in the European Economic Area Agreement of 1992, as
amended.
2.7. Restricted Transfer” means an international transfer of Personal Data made in connection with the Agreement that
is prohibited by applicable Data Protection Legislation except where a Transfer Mechanism is in place.
2.8. “Services” means the services to be supplied to or carried out by or on behalf of OT for Customer pursuant to the
Agreement, excluding on-premise and software maintenance services.
2.9. "Personal Data Breach" means a confirmed breach of security resulting in the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data and also includes any
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 1 of 12
incident classified as a “security incident”, “data breach” or similarly defined term under Data Protection Legislation to the
extent such Data Protection Legislation is applicable to the Processing of Customer Personal Data.
2.10. “Standard Contractual Clauses” or “SCCs” means, to the extent applicable under Data Protection Legislation,
model contractual clauses approved by a competent authority (as set out in the Data Protection Legislation) to ensure
appropriate data protection safeguards used as a Transfer Mechanism that provides for a legal ground for Restricted
Transfers to take place.
2.11. “Sub-processor” means any third party (including any OT Affiliate) appointed by or on behalf of OT as a sub-
contractor to Process Personal Data on behalf of Customer or Customer Affiliate in connection with the Agreement.
2.12. “Supervisory Authority” means the data protection authority, public body or government department identified and
authorized by the applicable Data Protection Legislation as being responsible for regulating and enforcing compliance with
Data Protection Legislation.
2.13. “Technical and Organizational Measures” means the technical and organizational measures set out at
https://www.opentext.com/assets/documents/en-US/pdf/opentext-technical-and-organizational-measures-en.pdf (and
also referred to as Appendix 3), as may be amended, updated or replaced from time to time, which are incorporated into
this DPA by reference.
2.14. “Transfer Mechanism” means the Standard Contractual Clauses and/or any other mechanism, including Adequacy
Decisions, Derogations and any other solution incorporated by Data Protection Legislation to allow Restricted Transfers
to take place.
The terms “Controller”, “Data Subject", “Personal Data", “Processing", “Process” and “Processor”; “Sell”, “Sensitive
Personal Data”, “Service Provider”, “Share” have the same meaning as in the applicable Data Protection Legislation (or
their closest equivalent concept or term as defined under such legislation).
3. ROLES AND DATA PROCESSING OBLIGATIONS
3.1. Roles and Scope of Processing
3.1.1. The terms of this DPA apply only to the Processing of Customer Personal Data in environments controlled by
OT and OT's Sub-processors. This includes Customer Personal Data sent to OT but does not include data that
remains on Customer's premises or in any Customer selected third party operating environments.
3.1.2. Appendix 1 of this DPA sets out the subject matter, nature and purpose of Processing of Customer Personal
Data by OT, the duration of the Processing and the types of Personal Data and categories of Data Subjects.
3.1.3. This DPA shall apply to the extent that OT shall Process Customer Personal Data as a Processor (or Sub-
processor) acting on behalf of Customer, in each case regardless of whether Customer acts as a Controller or as a
Processor on behalf of another Controller.
3.1.4. As a Controller, Customer is responsible for determining whether the Services are appropriate for storage
and/or processing of Customer Personal Data that is subject to any specific law or regulation and for using the
Services in a manner consistent with Customer’s legal and regulatory obligations.
3.1.5. Customer is responsible for providing notice to and obtaining all required valid consents from Data Subjects as
well as notifications and/or express authorizations from Supervisory Authorities, including, without limitation,
regarding any Processing (including collection, transfer, and storage) of Personal Data through the Services as
required by Data Protection Legislation; and confirms it is entitled to lawfully transfer the Customer Personal Data to
OT.
3.1.6. Customer will act as, or appoint, a single point of contact for OT for the Processing of Personal Data, and
confirms that its instructions, including appointment of OT as a Processor or Sub-processor, have been authorized by
the relevant Controller.
3.1.7. Each party will comply with applicable obligations under the Data Protection Legislation given the nature and
scope of that party’s Processing of Personal Data related to the Agreement and this DPA. Unless explicitly set forth
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 2 of 12
herein, OT is not responsible for compliance with any regulatory authority to which Customer is subject to or other
laws or regulations applicable to Customer that are not generally applicable to information technology service
providers.
3.2. OT Processing Obligations
3.2.1. Customer Instructions: OT will Process Customer Personal Data solely for the purpose of providing the
Services and in accordance with documented and commercially reasonable instructions from the Customer (to the
extent necessary to provide the Services and to comply with its obligations under the Agreement). Customer agrees
that the Agreement (including this DPA) are its complete documented instructions to OT for the Processing of Personal
Data. Additional instructions, if any, require a written agreement between the parties. Instructions by Customer related
to the Processing of Personal Data must be provided in writing duly signed by an authorized representative of
Customer. Where in the opinion of OT an instruction from the Customer infringes Data Protection Legislation, OT
shall inform Customer thereof, which Customer agrees shall not constitute legal advice by OT and shall not relieve
Customer from its own responsibility for compliance with Data Protection Legislation.
3.2.2. Lawful Data Processing by OT: To the extent required by applicable law, OT may Process Customer Personal
Data outside of the documented instructions of Customer, including transferring Customer Personal Data to a different
jurisdiction or an international organization provided that, where permitted under such law, OT shall use reasonable
endeavors to inform Customer of that legal requirement before such Processing.
3.2.3. Confidentiality of Processing: OT will: (i) limit Customer Personal Data access to OT personnel with a need
to Process such information for the purpose of providing Services; and (ii) will ensure such persons have committed
themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and have received
appropriate training on their responsibilities.
3.2.4. Cooperation
3.2.4.1. Data Subjects Rights
i. It is the Customer’s (or the party acting as Controller) responsibility to inform the Data Subject(s) concerned of
the purposes and the legal basis for which their Personal Data will be Processed in accordance with Data
Protection Legislation.
ii.Taking into account the nature of the Processing, OT shall assist Customer, insofar as is possible and
reasonable for the fulfillment of Customer’s obligation under Data Protection Legislation, to respond to Data
Subject's rights requests under applicable Data Protection Legislation (including, without limitation, requests
relating to rights of access, erasure and rectification).
iii. Where a Data Subject directly submits a rights request to OT, OT shall forward such request to the
Customer email address on file with OT, without undue delay. If Customer wishes for OT to forward Data Subject
requests to a specific email address, it shall notify OT of such address and provide updates where applicable.
OT shall not respond directly to a Data Subject rights request.
3.2.4.2 Data Protection Impact Assessments and Prior Consultation. Where requested by Customer and to
the extent required to be undertaken by Customer in compliance with Data Protection Legislation, OT shall, taking
into account the nature of Processing and the information available to OT, provide reasonable assistance to the
Customer: (i) in carrying out data protection impact assessments; or (ii) in relation to any prior consultation with
a Supervisory Authority (or other equivalent public authority or body with responsibility for compliance with Data
Protection Legislation).
3.2.4.3 Government and Law Enforcement Requests. If OT receives a request from a law enforcement or other
government entity (“Government Request(s)”) to retain, disclose, or otherwise Process Customer Personal
Data, where permitted to do so, OT shall attempt to redirect the Government Request to Customer. If OT
determines that a requirement to challenge or appeal a Government Request regarding Customer’s Personal
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 3 of 12
Data exists, Customer agrees to participate in and support such challenge as reasonably requested. Where
possible, the Customer itself will seek a protective order or other appropriate remedy in response to the
Government Request. OT will attempt to provide a minimum amount of information if OT is required to disclose
any information by a Government Request.
3.3. Sub-processing
3.3.1. Customer provides OT a general authorization to appoint Sub-processors to Process Customer Personal Data
in connection with the provision of the Services. Customer agrees that OT Sub-processors may include: (i) OT
Affiliates and (ii) any other third party engaged by OT in connection with the provision of the Services.
3.3.2. OT shall Inform Customer in advance of any new Sub-processor or replacement of Sub-processor to give the
Customer opportunity to reasonably object to the changes. OT must receive the notice of objection in writing from the
Customer within 14 days of receiving the notification from OT. The parties agree that the name of the new or
replacement Sub-processor together with details of the Processing activities it will carry out, and the location of such
activities is the information Customer requires to exercise such right. “Inform” shall include by posting the update on
a website (and providing Customer with a mechanism to obtain notice of that update), by email or in other written
form.
3.3.3. Any objection raised by the Customer pursuant to Section 3.3.2 shall be limited to the Sub-processor
demonstrable failure to offer the same or a reasonably comparable level of protection as that previously applicable to
the relevant Processing of Customer Personal Data (“Reasonable Objections”). OT shall have up to 30 days after
receiving the notice of objection (“Rectification Period”) to: (i) address any Reasonable Objections raised by
Customer; or (ii) propose an alternative Sub-processor provided that Sections 3.3.1 and 3.3.2 shall apply to the
appointment of the alternative Sub-processor.
3.3.4. If Customer raises Reasonable Objections to the appointment of a new Sub-processor pursuant to Section
3.3.3, and OT is unable to resolve such objections or provide an alternative Sub-processor, the Parties shall enter
into good faith negotiations to achieve a resolution. Unless otherwise agreed in writing by the parties, the good faith
discussions shall last for up to 14 days after the Rectification Period. Customer may terminate the respective part of
the Services where the new Sub-processor is to be used by giving written notice to OT no later than 30 days from the
conclusion of the good faith discussions where no resolution is reached. Such termination shall take effect no later
than 90 days following OT’s receipt of Customer’s notice of termination. If Customer does not terminate within this
30-day period, Customer is deemed to have accepted the new Sub-processor. Any termination under this Section
3.3.4 shall be deemed to be without fault by either Party and shall be subject to the terms of the Agreement (including
any documents agreed pursuant to it).
3.3.5. OT confirms that it has entered or will enter into a written agreement with its third-party company Sub-
processors incorporating terms which are substantially similar to those set out in this DPA.
3.3.6. As between the Customer and OT, OT shall remain fully liable for all acts or omissions of any Sub-processor
appointed by it pursuant to this Section 3.3 unless the Sub-processor acted in accordance with instructions directly
or indirectly received from Customer.
3.4. Security Measures
3.4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and
purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural
persons, Customer and OT shall both be responsible for implementing appropriate technical and organizational
measures to ensure a level of security appropriate to the risk.
3.4.2. OT shall implement the Technical and Organizational Measures in respect of the Services, and Customer
acknowledges that the Technical and Organizational Measures implemented by OT meet the standard of
appropriateness as required under Data Protection Legislation.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 4 of 12
3.4.3. Customer is responsible for implementing and maintaining privacy protections of components including
technical architecture or infrastructure that Customer or any Customer Affiliate provides, controls, or procures from a
third party. Customer shall apply the principle of data minimization and limit OT access to systems or Customer’s
Personal Data to only where essential for the performance of the Services. Where OT is performing Services on
Customer’s premises (or of any Customer Affiliate or sub-contractor, agent or similar) or in connection with access to
any of such party’s systems and data, Customer shall be responsible for providing OT personnel with user
authorizations and passwords to access those systems, overseeing their use of those passwords, and terminating
these as required. Customer shall not store Customer’s Personal Data in a non-production environment unless it has
production environment equivalent controls in place.
3.5. Notification of Personal Data Breach
3.5.1. Unless prohibited under applicable law, OT shall notify Customer of Personal Data Breach without undue delay,
and in all instances within the time frames set forth under applicable Data Protection Legislation, by contacting the
Customer email address on file. Such notification will include any available documentation necessary to enable the
Customer to make legally required notifications to Data Subject and / or the competent Supervisory Authority.
3.5.2. If available and taking into account the nature of the Processing, the notification sent in accordance with
Section 3.5.1 shall at least:
3.5.2.1 describe the nature of the Personal Data Breach including where possible, the categories and
approximate number of Data Subjects concerned, and the categories and approximate number of
Personal Data records concerned;
3.5.2.2 communicate the name and contact details of the data protection officer or other contact point where
more information can be obtained;
3.5.2.3 describe the likely consequences of the Personal Data Breach; and
3.5.2.4 describe the measures taken or proposed to be taken by OT to address the Personal Data Breach,
including, where appropriate, measures to mitigate its possible adverse effects.
3.5.3. . Where, and in so far as, it is not possible to provide the information at the same time, the information may be
provided in phases without undue further delay.
3.5.4. The Customer (or the party acting as Controller) is responsible to notify the Personal Data Breach to the
Supervisory Authority, and to the Data Subjects, when such is required by the applicable Data Protection Legislation.
3.6. Data Return or Destruction.
Where OT has stored Customer’s Personal Data as part of the Services: at the end of the Service(s) upon Customer’s
written instruction, OT shall (i) return such Customer Personal Data to Customer in such format as OT reasonably
determines, which may be provided via the enablement of export and retrieval functions when available or (ii) delete
the Customer Personal Data, unless applicable law requires further storage of the Personal Data. Where Customer
has not notified OT whether to return or destroy Customer Personal Data within 30 days after termination of the
Services, the parties agree that OT shall delete the data in accordance with subsection (ii) above. OT may charge a
fee for certain data return services.
3.7. Inspections and Audits
3.7.1. For the purpose of fulfilling any inspection obligations under applicable Data Protection Legislation and/or any
Standard Contractual Clauses:
3.7.1.1 Upon written request from Customer, OT shall, where available, provide to Customer a copy of its latest
Service Organization Control (“SOC”) audit report and/or other third-party audit reports (“Audit Report”)
or information to demonstrate OT’s compliance with its obligations under this DPA.
3.7.1.2 In the absence of an Audit Report or where the Audit Report or information made available under Section
3.7.1.1 does not address OT's compliance applicable to the Processing undertaken in connection with
the Services, OT shall, upon Customer's reasonable request either: (i) provide additional documentation
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 5 of 12
or materials to evidence compliance; or (ii) permit an inspection of OT's environment to the extent
relevant to the provision of the Services and required to demonstrate OT's compliance with its
obligations under this DPA.
3.7.2. Any inspection to be undertaken pursuant to Section 3.7.1: (a) may be carried out no more than once annually
(unless otherwise mandated by a Supervisory Authority); (b) shall not be conducted on less than thirty (30) days prior
written notice; (c) may be conducted by Customer or an independent third party auditor mandated by Customer (which
is not a competitor of OT), provided such third party auditor enters into a written agreement with OT protecting the
confidentiality of all disclosed information related to the inspection; (d) shall be subject to agreement in advance
between the parties of the scope of the inspection and the duration (which shall not extend beyond two consecutive
business days or infringe upon the confidential information of third parties); (e) must be conducted during local
business hours, not unreasonably disrupt OT business operations and not unduly burden the provision of services by
OT to its customers; (f) must be undertaken in accordance with OT’s relevant policies and procedures (as are provided
to Customer in advance); and (g) shall as far as reasonably possible, be limited to remote inspections or meetings
with senior representatives of OT (including by relying on latest Audit Report or current certifications, other audit
reports and combining them with other information available to Customer under the Agreement) Customer shall, at
its own cost, provide OT with a written report documenting the results of any inspection undertaken pursuant to this
Section.
3.7.3. Customer shall bear all expenses related to any inspections undertaken pursuant to section 3.7.1 that are
carried out in excess that permitted under Section 3.7.2 and shall reimburse OT for time spent by OT personnel for
any such inspection at then-current professional service rates unless such inspection reveals non-compliance by OT
with its obligations under this DPA in which case OT shall be responsible for its costs associated with such on-site
inspection.
4. INTERNATIONAL TRANSFERS AND GEOGRAPHICAL SPECIFIC DATA PROCESSING TERMS
Where mandatory requirements under Data Protection Legislation apply to the Processing or transfer of Personal
Data covered by this Section, the Parties agree that the corresponding provisions of this Section 4 shall be
incorporated into this DPA and apply accordingly.
4.1. Incorporation of Transfer Mechanisms
4.1.1. Transfers subject to Data Protection Legislation applicable in the European Economic Area (EEA):
Restricted Transfers shall be governed by the SCCs approved by the COMMISSION IMPLEMENTING DECISION
(EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (EEA SCCs), the mandatory
clauses of which are incorporated into this Agreement by reference, and completed as agreed in this Section 4.1.1
(as set out in the table below) unless other Transfer Mechanism applies.
SCCs Clause Module Two Module Three
Controller to Processor Processor to Processor
1 to 7 Incorporated
8 General and Module Two provisions General and Module Three provisions
9 For clause 9 (a) the Parties choose Option 2, agreeing on a period of 14 business days.
General and Module Two provisions General and Module Three provisions
10
11 In clause 11 (a) the optional clause shall be excluded.
12 General and Module Two provisions General and Module Three provisions
For paragraph 13 (a), the competent Supervisory Authority shall be the competent
13
Supervisory Authority that has supervision over the Customer.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 6 of 12
14 to 16 General and Module Two provisions General and Module Three provisions
17 The Parties select option 1, the governing law being the Data Protection Legislation (as
defined in the Agreement) applicable to the data exporter.
General and Module Two provisions General and Module Three provisions
18 Regarding the choice of court and jurisdiction, the Parties choose the court where the data
exporter is based.
Appendices Shall be completed as applicable with the details agreed in Appendix 1 of this DPA.
4.1.2. Transfers subject to Data Protection Legislation applicable in Switzerland: Where a Restricted Transfer
is subject to Swiss Data Protection Legislation, the EEA SCCs shall apply, amended as follows:
a. References to the GDPR shall be understood as references to the Swiss Federal Act on Data Protection (as such
laws are amended or re-enacted from time to time) (“FADP”).
b. The “competent supervisory authority” is the Federal Data Protection and Information Commissioner;
c. Where the transfer is subject to both the FADP and the GDPR (as defined in the EEA SCCs), the supervisory
authority is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by
the FADP, and the supervisory authority is as set forth in the EEA Standard Contractual Clauses insofar as the transfer
is governed by the GDPR;
d. Clause 18 (c) shall be interpreted to permit data subjects in Switzerland to bring legal proceedings in Switzerland
4.1.3. Transfers subject to Data Protection Legislation applicable in the United Kingdom (UK): Where a
Restricted Transfer is subject to Data Protection Legislation of the United Kingdom the EEA SCCs incorporated to
this Agreement shall apply, as amended under the International Data Transfer Addendum to the EU Commission
Standard Contractual Clauses (a.k.a. EEA SCCs) issued by the Information Commissioner’s Office under S119A(1)
Data Protection Act 2018 (version B1.0, in force 21 March 2022), (international-data-transfer-addendum.pdf) shall
apply, completed as it follows:
Part 1 Table 1 “Parties”:
• Start Date shall be the “Effective Data of the Agreement”
• Exporter shall be Customer, and Importer shall be OT.
• Key contacts shall be as set out in the Agreement.
Part 1 Table 2 “Selected SCCs, Modules and Selected Clauses”, the Parties choose “the Approved EU SCCs,
including the Appendix Information and with only the following modules, clauses or optional provisions of the
Approved EU SCCs brought into effect for the purposes of this Addendum” as the option for the “Addendum EU
SCCs”, for which: Modules 2 and 3 are incorporated, of which: Optional clause 7 “Docking Clause” is
incorporated; Clause 11 is excluded from all Modules, Clause 9a of Modules 2 and 3 incorporated the General
Authorization option and notifications timeframe of 14 business days.
Part 1 Table 3 “Appendix Information” is completed with the details agreed in the EEA SCCs.
Part 1 For Table 4: “Ending this Addendum when the Approved Addendum Changes” the Parties choose
that neither Party may end this Addendum.
Part 2 Mandatory Clauses shall consist of the Mandatory Clauses of the Approved Addendum, being the
template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data
Protection Act 2018 on 2 February 2022, as it is revised under Section 5.3 of those Mandatory Clauses.
4.1.4. New Standard Contractual Clauses: The Parties agree that if competent authorities issue new Standard
Contractual Clauses (“New SCCs”) applicable to the Processing activities under this DPA, whether to (i) replace or
supplement SCCs already incorporated by the Parties, or (ii) introduce a new transfer mechanism required under
Data Protection Legislation, such New SCCs shall automatically apply and form a binding part of this Agreement from
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 7 of 12
the date they become legally mandatory. Where required, the New SCCs shall be completed in accordance with the
following “Completion Rules”, unless the Parties expressly agree otherwise in writing:
a. Schedules – Schedules 1 to 3 of this Agreement shall be incorporated into the New SCCs.
b. Optional Clauses – Optional or voluntary clauses included in New SCCs shall apply only if expressly agreed
in writing by the Parties.
c. Authorizations – Where an option exists between express or general authorization, the Parties shall adopt
general authorization.
d. Notification Periods – Where a period must be chosen, the default shall be 14 business days, except 48
hours for Personal Data Breaches.
e. Rights Allocation – Where rights must be allocated between Data Exporter, Data Importer, or neither, the
default shall be “both Parties.” If that option is not available, the option "none of them" shall be selected.
f. Supervisory Authority – The designated supervisory authority shall be the authority with jurisdiction over the
Data Exporter.
g. Regulatory Filings – Where an obligation to notify or register with a supervisory authority must be allocated,
it shall rest with the Data Exporter (Customer).
h. Governing Law & Jurisdiction – The law and jurisdiction shall be those of the country where the Data
Exporter is established.
i. Multiple Models – If a competent authority authorizes or issues more than one model of New SCCs, and one
such model is an adaptation of SCCs already incorporated into this DPA (including with adjusted definitions), that
model shall be the version automatically incorporated under this DPA.
j. Fallback Provision - If, due to the nature or structure of any New SCCs, the above Completion Rules cannot
be applied to allow their valid implementation, the Parties shall in good faith take the necessary steps to ensure
compliance with Data Protection Legislation, including (where required) executing a separate set of the relevant
New SCCs or another valid transfer mechanism made available under Data Protection Legislation.
4.1.5. Hierarchy applied to incorporated Transfer Mechanisms: In the event of coexistence or contradiction
between Transfer Mechanisms incorporated by the Parties, the following prevalence order shall apply:
1- Derogations, where and to the extent that apply,
2- Adequacy Decisions
3- Standard Contractual Clauses that have been expressly incorporated to this DPA by the Parties or otherwise
expressly put in place.
4- New Standard Contractual Clauses.
4.1.6. Onward Transfers: The parties agree that OT is permitted to transfer Customer Personal Data to additional
third parties (“Onward Transfer”), for the purposes and subject to the terms of this DPA, provided that such transfer
complies, where applicable, with the terms and conditions set forth under clauses 3.3 (Sub-processing) and this
Section 4 of this DPA.
4.2. Geographical Specific Data Processing Terms
4.2.1. Processing Personal Data of US-based Data Subjects: The following terms apply where Customer provides
Customer Personal Data collected from individuals in the United States of America (US).
4.2.1.1 For the purposes of Section 4.2.1, the following terms shall have the meanings set out below and related
terms shall be construed accordingly:
o “US State Privacy Laws” means the subset of Data Protection Legislation originating from U.S.
state, territorial, and local laws, regulations, and governmental requirements including, without limitation,
the CCPA.
o “Specified Business Purpose” means the provision of the Services as set forth under the
Agreement.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 8 of 12
o “Business Purpose”, “Sell”, “Service Provider”, and “Share” have the meanings set forth in the
US State Privacy Laws.
4.2.1.2 To the extent OT Processes Customer Personal Data containing any data regulated by the CCPA, the
Parties agree OT does so acting as a Service Provider to Customer. Additionally, taking into account the
context of the Processing and Services, each Party will comply with its obligations under US State Privacy
Laws. Given the nature and scope of its Processing, OT: (i) acknowledges that Customer is disclosing
Personal Data to OT only for the Specified Business Purpose; (ii) shall Process all Personal Data on
behalf of Customer only; (iii) shall not Sell or Share Customer Personal Data; (iii) shall not retain, use, or
disclose Customer Personal Data for any purpose other than for the Specified Business Purpose,
including not retaining, using, or disclosing Customer Personal Data: (a) for a commercial purpose other
than the Specified Business Purpose or (b) outside of the direct business relationship between OT and
Customer unless expressly permitted by applicable law; (iv) shall not, unless otherwise permitted by
applicable law or for the purpose of performing the Services, combine Customer Personal Data with other
personal information it: (a) receives from or on behalf of another person or third party, or (b) collects from
its own interactions with the applicable individual; (v) shall notify Customer if it makes a determination
that it can no longer meet its obligations under this Agreement, and cooperate with Customer to take
reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data
to the extent required by US State Privacy Laws; and (vi) shall enable Customer to comply with privacy
requests made pursuant to applicable US State Privacy Laws.
4.2.1.3 In accordance with HIPAA requirements, Customer shall not provide to OT protected health information
(as defined under HIPAA) without the execution of a mutually agreed upon Business Associate
Agreement.
4.2.2 Processing Personal Data of Data Subjects Based in Other Jurisdictions: Where Data Protection
Legislation related to the Processing of Personal Data in other jurisdictions requires additional contractual terms,
including without limitation terms related to Restricted Transfers other than the Restricted Transfers detailed above,
Customer shall notify OT of such requirement and the parties agree to cooperate in good faith to negotiate such terms.
5. GENERAL PROVISIONS
5.1 Execution of this DPA.
Where requested by Customer, OT and Customer shall execute this DPA in one or more counterparts, each of which shall
be deemed an original and all of which together shall constitute one and the same instrument. For the purposes hereof, a
facsimile or scanned copy of this DPA, including all pages hereof, shall be deemed an original.
5.2 Superseding Agreement.
The parties agree that with respect to the period on and after the date that this DPA comes into effect between the parties
(or if earlier, the mandatory date when the relevant Standard Contractual Clauses must apply), this DPA shall replace and
supersede any existing data processing addendum, attachment, exhibit, or standard contractual clauses that Customer
and OT may have previously entered into in connection with the Services.
5.3 Order of Precedence
To the extent there is any conflict or inconsistency between the terms of this DPA, the Standard Contractual Clauses,
and/or the Agreement, in relation to the Processing of Customer Personal Data, the parties agree that the documents shall
prevail in the following order: (i) the Standard Contractual Clauses; (ii) this DPA; and (iii) the Agreement.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 9 of 12
5.4 Termination
The parties agree that this DPA shall terminate automatically upon (i) termination of the Agreement; or (ii) expiry or
termination of all service contracts, statements of work, work orders or similar contract documents entered into by the
parties pursuant to the Agreement, whichever is later. This Section 5.4 shall be without prejudice to any rights to terminate
Standard Contractual Clauses (if applicable).
5.5 Changes in Law.
The parties shall negotiate in good faith and mutually agree in writing to any amendments to this Addendum that are
necessary to reflect changes in Data Protection Legislation.
5.6 Communications.
OT’s data protection office can be reached by emailing dpo@opentext.com.
6. PARTNER AGREEMENTS
6.1 If the Agreement relates to the resale or supply of Services with a partner under an OT partner program or a partner
agreement (a “Partner”), with OT acting as the Partner’s Processor or Service Provider under that arrangement
and OT having no direct contractual relationship to the direct and indirect customers of the Partner which are entitled
to use the Services such as the End User or, in the case of a Partner who is a Managed Service Provider (MSP),
the Beneficiary (as in each case as defined in the Agreement) (hereinafter “Using Parties”), then the following
provisions shall apply.
6.2 All references to “Customer” in this DPA shall mean the Partner; Sections 3.1.4, 3.1.5 and 3.1.6 of this DPA shall
be amended to read as follows:
• 3.1.4: “As a Controller, Partner is responsible for determining whether the Services are appropriate for
storage and Processing of Partner and Using Parties' Personal Data that is subject to any specific law or
regulation and for using the Services in a manner consistent with Partner's legal and regulatory obligations”.
• 3.1.5: “Partner is responsible for providing notice to and obtaining all required valid consents from Data
Subjects as well as notifications and/or express authorizations from Supervisory Authorities, including,
without limitation, regarding any Processing (including collection, transfer, and storage) of Personal Data
through the Services as required by Data Protection Legislation; and confirms it is entitled to lawfully transfer
the Partner and Using Parties' Personal Data to OT.”
• 3.1.6: “Partner will act as, or appoint, a single point of contact for OT for the Processing of Personal Data,
and confirms that its instructions, including appointment of OT as a Processor or Sub-Processor, have been
authorized by the relevant Controller”.
6.3 Section 3.4.3 of this DPA shall be amended to read as follows:
• 3.4.3: “Partner is responsible for implementing and maintaining privacy protections and security measures
for components of the technical architecture or infrastructure that Partner or any Using Party provides,
controls, or procures from a third party. Partner shall (and shall procure that the Using Parties shall) apply
the principle of data minimization and limit OT access to systems or Partner's Personal Data to only where
essential for the performance of the Services. Where OT is performing Services on premises of the Partner
or Using Parties (or of an Affiliate, sub-contractor, agent or similar of any of these) or in connection with
access to any of their systems and data, Partner shall be responsible for procuring provision to OT personnel
of user authorizations and passwords to access those systems, oversight of their use of those passwords
and termination of these as required. Partner shall not store any Personal Data in a non-production
environment unless it has production environment equivalent controls in place (and procure the same from
Using Parties)”.
6.4 Any references to “Customer” in Appendix 2 shall be read as “Partner (and Using Parties, as applicable)”.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 10 of 12
APPENDIX 1
DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA
See Appendix 2 of this DPA for each of following: Subject matter and duration of the Processing of Personal Data, the
nature and purpose of the Processing of Personal Data, the types of Personal Data to be Processed, special categories
of data (if appropriate) and the categories of Data Subject to whom the Customer Personal Data relates.
APPENDIX 2
DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Data Subjects may include Customer employees, contractors, business partners, prospects, customers, vendors, agents,
advisors, freelancers or other individuals having Personal Data stored, transmitted to, made available to, accessed, or
otherwise Processed by OT.
Categories of personal data transferred
Customer determines the categories of Personal Data which are Processed by OT in connection with the Services in
accordance with the terms of the Agreement (and documentation governed by it). Customer submits Personal Data for
Processing after careful evaluation of compliance with applicable laws. The Personal Data may include but are not limited
to the following categories of data: Identification and contact data (name, address, title, contact details phone numbers, e-
mail address, time zone, company name), IT information, Usage Data, Content Data, credentials, plus any application-
specific data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration
the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions
(including access only for staff having followed specialized training), keeping a record of access to the data,
restrictions for onward transfers or additional security measures.
The choice and type of Personal Data that will be Processed using the OT Services remains solely within the discretion
and choice of the Customer. In selecting the Personal Data of any category, the Customer shall ensure that such Personal
Data is suitable for Processing with and through the Services in compliance with applicable Data Protection Legislation.
As part of such assessment, prior to providing OT with or giving OT access to any ‘special categories of personal data’ or
Sensitive Personal Data subject to enhanced protection requirements under applicable Data Protection Legislation
(“Enhanced Requirements”), Customer shall notify OT of the Enhanced Requirements and seek prior written confirmation
from OT of its ability to comply with such. Customer agrees that the Technical and Organizational Measures shall (i) apply
to the Processing of all Customer Personal Data, including special category of personal data or Sensitive Personal Data;
and (ii) be appropriate safeguards for the Processing of special category of personal data or Sensitive Personal Data for
the provision of the Services taking into consideration the nature of the data and risks involved in Processing such data,
unless otherwise agreed between the parties. OT disclaims all liabilities in relation to the selection of data for use with the
Services or non-compliance with Enhanced Requirements unless prior written confirmation has been provided.
The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis).
Transfers shall be made on a continuous basis.
Nature of the Processing
OT offers its Services, and in doing so, OT requires to Process Personal Data. The Personal Data is subject to the basic
Processing activities as set out in the Agreement and pursuant to Customer’s Processing instructions as provided in
accordance with the Agreement and this DPA which may include:
(a) use of Personal Data to provide the Services;
(b) storage of Personal Data;
(c) computer Processing of Personal Data for data transmission; and
(d) other Processing activities to deliver the Services.
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 11 of 12
Purpose(s) of the data transfer and further Processing
See “Nature of Processing” above.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine
that period.
The duration of the Processing of the Personal Data is set out in the Agreement (and documentation governed by it) and
this DPA.
Subject matter, nature, and duration of the Processing for transfer to (sub-) processors
As above.
OT partner programs and partner agreements: Where Section 6 of the DPA applies: for the purposes of these
Appendices 1, 2 and 3, categories of Personal Data shall also include that of Using Parties (as defined in Section 6 of the
DPA). In Appendix 3, “Customer systems” refers to those of the Partner and Using Parties. Notwithstanding the foregoing,
this shall not release the Partner of its obligations, either in these Appendices, the Annexes, the DPA or otherwise, and
the Partner shall remain responsible for the decisions, acts and omissions of Using Parties, and shall procure that Using
Parties comply with the provisions of these Appendices.
APPENDIX 3
TECHNICAL AND ORGANIZATIONAL MEASURES
OT has implemented and will apply the Technical and Organizational Measures which are set out at
https://www.opentext.com/assets/documents/en-US/pdf/opentext-technical-and-organizational-measures-en.pdf
OpenText Global DPA / Version 2.0 (S)_ 2025 Page 12 of 12
01.26 | 270-000012-004