Snapshot 232291
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM
Version: March 2026
This Data Processing Addendum ("Addendum") forms part of the Agreement ("Agreement") between: (i) the legal
entity identified in the Agreement ("Client") acting on its own behalf and as agent for each Client Affiliate; and (ii)
the Absorb legal entity as identified in the Agreement ("Company") acting on its own behalf and as agent for each
Company Affiliate. The terms used in this Addendum shall have the meanings set forth in this Addendum.
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. Except as
modified below, the terms of the Agreement shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set
out below shall be added as an Addendum to the Agreement. Except where the context requires otherwise,
references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum.
1. Definitions
1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly:
1.1.1 "Applicable Laws" means all laws, rules, regulations, binding regulatory guidance, and orders
applicable to a party in connection with the Agreement, including applicable Data Protection
Laws;
1.1.2 "Client Affiliate" means with respect to any entity, any other entity directly or indirectly
controlling or controlled by, or under common control with, such entity or one or more of the
other Affiliates of that entity (or a combination thereof). For purposes of this definition, an
entity shall control another entity if the first entity: (i) owns, beneficially or of record, more
than fifty percent (50%) of the voting securities/shares of the other entity; or (ii) has the ability
to elect a majority of the directors of the other entity;
1.1.3 "Client Group Member" means Client or any Client Affiliate;
1.1.4 "Client Personal Data" means any Personal Data or personal information Processed by a
Contracted Processor on behalf of a Client Group Member pursuant to or in connection with
the Agreement, and excludes Company Business Operations Data and information that has
been irreversibly anonymized in accordance with Applicable Laws such that it no longer
constitutes Personal Data or personal information;
1.1.5 "Contracted Processor" means Company, Company Affiliate or a Sub-processor;
1.1.6 “Company Business Operations Data" means Personal Data relating to Client’s
representatives, personnel, administrators, billing contacts, authorized users (solely to the
extent such Personal Data is Processed for the business operations purposes listed below and
not for delivering the Services as a Processor on behalf of Client), or other individuals that
Company or Company Affiliates Process as an independent Controller for their own business
operations and not on behalf of Client in connection with the Services, including for account
administration, customer relationship management, billing and collections, financial
accounting, tax, legal compliance, audit, fraud prevention, security, abuse detection, service
communications, and enforcing or exercising Company’s rights under the Agreement.
Company Business Operations Data does not include Client Personal Data.
1.1.7 "Company Affiliate" means an entity that owns or controls, is owned or controlled by or is or
under common control or ownership with Company, where control is defined as the possession,
directly or indirectly, of the power to direct or cause the direction of the management and
policies of an entity, whether through ownership of voting securities, by contract or otherwise;
1.1.8 "Data Protection Law(s)" means all applicable laws, regulations, and binding regulatory
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 1
requirements relating to privacy, data protection, security, breach notification, or the
Processing of Personal Data or personal information, in each case as amended, replaced, or
superseded from time to time, including, to the extent applicable:
1.1.8.1 Regulation (EU) 2016/679 ("EU GDPR");
1.1.8.2 the laws of the EEA Member States and other jurisdictions implementing,
supplementing, or replacing the EU GDPR;
1.1.8.3 the EU GDPR as it forms part of the laws of England and Wales, Scotland, and
Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act
2018 ("UK GDPR");
1.1.8.4 the UK Data Protection Act 2018;
1.1.8.5 Canada’s Personal Information Protection and Electronic Documents Act
("PIPEDA") and any substantially similar or other applicable provincial privacy
laws, including, as applicable, the Personal Information Protection Act (Alberta),
the Personal Information Protection Act (British Columbia), and An Act respecting
the protection of personal information in the private sector (Quebec), as amended;
1.1.8.6 applicable United States federal, state, and local privacy and data protection laws,
including the California Consumer Privacy Act, as amended by the California
Privacy Rights Act, and its implementing regulations (collectively, "CCPA"), and
other applicable U.S. state comprehensive privacy laws (collectively, “U.S.
Privacy Laws”);
1.1.8.7 the Australian Privacy Act 1988 (Cth), including the Australian Privacy Principles
and the Notifiable Data Breaches scheme, and other applicable Australian
Commonwealth, state, or territory privacy laws;
1.1.8.8 the Swiss Federal Act on Data Protection of 25 September 2020 ("Swiss FADP"),
the Ordinance on Data Protection ("Swiss DPO"), and any binding guidance or
officially recognized transfer mechanism issued or recognized by the Swiss
Federal Data Protection and Information Commissioner ("FDPIC"), to the extent
applicable;
1.1.8.9 any other Applicable Laws governing the Processing of Client Personal Data under
the Agreement,
in each case, to the extent applicable in respect of any Processing of Client Personal Data in
connection with the Services and each as amended, extended, re-enacted or replaced from time
to time;
1.1.9 "EEA" means the European Economic Area;
1.1.10 "Restricted Transfer" means (a) a transfer of Client Personal Data from a Client Group
Member to a Contracted Processor; or (b) an onward transfer of Client Personal Data from one
Contracted Processor to another Contracted Processor, or between two establishments of a
Contracted Processor, in each case where such transfer requires a specific transfer mechanism,
contractual safeguard, adequacy decision, or other lawful basis under applicable Data
Protection Laws, including, where applicable, Articles 16 and 17 of the Swiss FADP;
1.1.11 "Service Provider” and “Contractor” shall have the same meaning as in the CCPA, to the
extent applicable;
1.1.12 "Services" means the services and other activities to be supplied to or carried out by or on
behalf of Company for Client Group Members pursuant to the Agreement;
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 2
1.1.13 "Standard Contractual Clauses" means, as applicable: (a) the standard contractual clauses
approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021,
as may be amended, updated, or superseded from time to time ("EU SCCs"); and (b) the
International Data Transfer Addendum to the EU SCCs issued under section 119A of the UK
Data Protection Act 2018, as may be amended, updated, or superseded from time to time ("UK
Addendum"). For clarity, the official text of the EU SCCs and the UK Addendum is
incorporated by reference into this Addendum and is not reproduced in full herein. Annex 2
(SCC Implementation Schedule), together with Annex 1, Annex 3, the Agreement, any
applicable Order Form or statement of work, and Company’s then-current Sub-processor list,
shall supply the information required to complete the modules, appendices, annexes, and tables
of the Standard Contractual Clauses, to the extent applicable.
1.1.14 "Sub-processor" means any person or entity (including any third party or any Company
Affiliate, but excluding an employee of Company or any of its subcontractors) appointed by or
on behalf of Company or any Company Affiliate to Process Client Personal Data on behalf of
any Client Group Member in connection with the Agreement, including, where applicable, a
"service provider" or "contractor" as defined under the CCPA or other applicable U.S. Privacy
Laws.
1.2 The terms, "Controller", "Processor", "Data Subject", "Member State", "Personal Data", "Personal Data
Breach", "Processing", and "Supervisory Authority" shall have the meanings given under the EU GDPR,
and where another Data Protection Law applies, the closest equivalent meaning under that law. As
applicable, references in this Addendum to: (a) "Controller" include "Business," "organization," and similar
terms; (b) "Processor" include "Service Provider" and "Contractor"; (c) "Data Subject" include "Consumer"
and "individual"; (d) "Personal Data" include "personal information" and similar terms, and, with respect
to the Swiss FADP, references to "Supervisory Authority" shall include the FDPIC and references to
"Member State" or "EU/EEA" shall be interpreted as including Switzerland where required for purposes of
cross-border transfers, data subject rights, or mandatory local-law adaptations.
1.3 For purposes of the Swiss FADP, references in this Addendum to "special categories of personal data" shall
be interpreted, where relevant, to include the equivalent concept of sensitive personal data under the Swiss
FADP.
1.4 The word "include" shall be construed to mean include without limitation, and cognate terms shall be
construed accordingly.
1.5 Any reference in this Addendum to an annex, schedule, appendix, exhibit, or similar attachment, including
any description of Processing, technical and organizational measures, Sub-processor list, or Standard
Contractual Clauses and related tables or appendices, shall be deemed incorporated by reference and may
be completed or satisfied using the information set out in the Agreement, applicable order forms or
statements of work, Company’s then-current Sub-processor list, and Company’s then-current security or
privacy documentation made available to Client, as updated from time to time in accordance with the
Agreement and this Addendum; provided that, for purposes of the Standard Contractual Clauses, Annex 1
shall provide the information required for Annex I thereto, Annex 2 shall provide the parties’ SCC
implementation elections and directions, and Annex 3 shall provide the information required for Annex II
thereto, in each case to the extent applicable.
2. Authority
Company warrants and represents that, before any Company Affiliate Processes any Client Personal Data
on behalf of any Client Group Member, Company's entry into this Addendum as agent for and on behalf of
that Company Affiliate will have been duly and effectively authorised (or subsequently ratified) by that
Company Affiliate.
3. Roles and Processing of Client Personal Data
3.1 Roles.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 3
3.1.1 As between the parties, with respect to Client Personal Data, Client is a Controller or Processor,
as applicable, and Company is a Processor acting on behalf of Client in connection with
the Services.
3.1.2 Where Client is a Processor acting on behalf of another Controller, Client represents and
warrants that it is authorized to: (a) enter into this Addendum on behalf of the relevant
Controller; (b) provide instructions to Company on behalf of the relevant Controller; and (c)
otherwise exercise the rights and fulfill the obligations of a Controller under this Addendum
on behalf of the relevant Controller.
3.1.3 Company Business Operations Data is not Client Personal Data. As between the parties,
Company and Company Affiliates act as independent Controllers with respect to Company
Business Operations Data, and Company shall Process Company Business Operations Data in
accordance with Applicable Laws and Company’s applicable privacy notice, and not pursuant
to Client’s instructions under this Addendum.
3.2 Processing. Company and each Company Affiliate shall:
3.2.1 comply with all applicable Data Protection Laws in the Processing of Client Personal Data;
3.2.2 not Process Client Personal Data other than on the relevant Client Group Member’s
documented instructions unless Processing is required by Applicable Laws to which the
relevant Contracted Processor is subject, in which case Company or the relevant Company
Affiliate shall, to the extent permitted by Applicable Laws, inform the relevant Client Group
Member of that legal requirement before the relevant Processing of that Client Personal Data
unless Applicable Laws prohibit such notification on important grounds of public interest;
3.2.3 to the extent Company Processes Client Personal Data subject to applicable U.S. Privacy Laws,
act as a Service Provider and/or Contractor, as applicable, and not: (a) Sell or Share Client
Personal Data; (b) retain, use, or disclose Client Personal Data for any purpose other than for
the specific business purposes and services described in the Agreement and this Addendum,
including providing the Services; (c) retain, use, or disclose Client Personal Data outside of the
direct business relationship between Client and Company; or (d) combine Client Personal Data
received from, or on behalf of, Client with personal information received from, or on behalf of,
another person, or collected from Company’s own interaction with an individual, except as
permitted by applicable U.S. Privacy Laws;
3.2.4 to the extent required by applicable U.S. Privacy Laws, certify that it understands and will
comply with the restrictions set forth in this Addendum, provide Client with information
reasonably necessary to demonstrate such compliance, and notify Client if Company
determines that it can no longer meet its obligations under such laws; and
3.2.5 to the extent Company makes AI Features available as part of the Services, any Processing of
Client Personal Data through such AI Features shall be subject to this Addendum to the same
extent as other Processing of Client Personal Data under the Services. Company shall not use
Client Personal Data to train, fine-tune or improve AI models except as expressly permitted in
the Agreement.
3.3 Each Client Group Member:
3.3.1 instructs Company and each Company Affiliate (and authorises Company and each Company
Affiliate to instruct each Sub-processor) to:
3.3.1.1 Process Client Personal Data; and
3.3.1.2 in particular, transfer or disclose Client Personal Data outside the jurisdiction in
which it was collected or from which it is disclosed, including outside the EEA,
the UK, Canada, Australia, Switzerland, and the United States,
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 4
as reasonably necessary for the provision of the Services and consistent with the Agreement
and subject to Section 12 hereof; and
3.3.2 warrants and represents that it is and will at all relevant times remain duly and effectively
authorised to give the instruction set out in Section 3.3.1 on behalf of each relevant Client
Affiliate.
3.4 The description of Processing required under Article 28(3) of the EU GDPR and equivalent requirements
under other applicable Data Protection Laws (including, as applicable, categories of data subjects,
categories of Client Personal Data, nature and purpose of Processing, duration of Processing, and the
parties’ roles) shall be as set out in Annex 1 or equivalent documentation incorporated by reference pursuant
to Section 1.5. Client may make reasonable amendments to such information by written notice to Company
from time to time; provided that any such amendment shall be limited to information reasonably necessary
to meet applicable legal requirements and shall not materially alter the parties’ rights or obligations, or
impose material additional costs or burdens on Company, without the parties’ prior written agreement.
Nothing in such description (including as amended pursuant to this Section 3.4) confers any right or imposes
any obligation on any party to this Addendum beyond those expressly set out herein. To the extent the
Swiss FADP applies, such description shall also be deemed to include the information reasonably necessary
for Client to document cross-border disclosures, assess appropriate safeguards, and comply with
transparency obligations under applicable Swiss law. For purposes of the Standard Contractual Clauses,
Annex 1 shall constitute Annex I thereto and Annex 3 shall constitute Annex II thereto, in each case as
supplemented by Annex 2 and the documents incorporated by reference under Section 12, to the extent
applicable.
4. Company and Company Affiliate Personnel
Company and each Company Affiliate shall take reasonable steps to ensure the reliability of any employee,
agent or contractor of any Contracted Processor who may have access to the Client Personal Data, ensuring
in each case that access is strictly limited to those individuals who need to know or access the relevant
Client Personal Data, as strictly necessary for the purposes of the Agreement. The Company and each
Company Affiliate shall ensure that all such individuals are subject to confidentiality undertakings or
professional or statutory obligations of confidentiality.
5. Security
5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and
purposes of Processing, as well as the risks of varying likelihood and severity to the rights and freedoms of
natural persons and other risks contemplated by applicable Data Protection Laws, Company and each
Company Affiliate shall implement and maintain appropriate technical, administrative, physical, and
organizational measures to protect Client Personal Data against accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, Client Personal Data, including, as applicable, measures
referred to in the applicable Data Protection Laws, and as further described in Annex 3 or equivalent
security documentation incorporated by reference pursuant to Section 1.5; provided that Company may
update such measures and documentation from time to time so long as such updates do not materially
decrease the overall security of the Services during the term of the Agreement.
5.2 In assessing the appropriate level of security, Company and each Company Affiliate shall take account in
particular of the risks that are presented by Processing, in particular from a Personal Data Breach.
6. Sub-processing
6.1 Each Client Group Member authorises Company and each Company Affiliate to appoint (and permit each
Sub-processor appointed in accordance with this section 6 to appoint) Sub-processors in accordance with
this section 6 and any restrictions in the Agreement.
6.2 Company and each Company Affiliate may continue to use those Sub-processors already engaged by
Company or any Company Affiliate as at the date of this Addendum, subject to Company and each
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 5
Company Affiliate in each case as soon as practicable meeting the obligations set out in section 6.4.
6.3 A complete list of Sub-processors will be maintained on Company’s support site
(https://support.absorblms.com/hc/en-us/articles/115015958127-Subprocessors, the "Support Site"). Any
changes to this list will be made thirty (30) days prior to data being exchanged with the Sub-processor. By
subscribing to the Support Site, Client will receive notification of these changes and will have thirty (30)
days from receipt of such notice to object in writing on reasonable data protection grounds. If Client so
objects, Company shall work with Client in good faith to make available a commercially reasonable change
in the provision of the Services which avoids the use of that proposed Sub-processor, if available. If
Company is unable to make available such change within a reasonable period of time, Client may terminate
the affected Services or applicable Order Form(s) with respect only to those Services that cannot be
provided without the use of the objected-to Sub-processor, and Company shall refund any prepaid fees
covering the remainder of the then-current term for such terminated Services. Failure to object will signify
acceptance of the changes.
6.4 With respect to each Sub-processor, Company or the relevant Company Affiliate shall:
6.4.1 before the Sub-processor first Processes Client Personal Data (or, where relevant, in accordance
with section 6.2), carry out adequate due diligence to ensure that the Sub-processor is capable
of providing the level of protection for Client Personal Data required by the Agreement;
6.4.2 ensure that the arrangement between on the one hand (a) Company, (b) the relevant Company
Affiliate, or (c) the relevant intermediate Sub-processor; and on the other hand the Sub-
processor, is governed by a written contract that imposes data protection and security
obligations on the Sub-processor that are no less protective of Client Personal Data than those
set out in this Addendum and that satisfy applicable Data Protection Laws; and
6.4.3 provide to Client, upon written request, information reasonably necessary to demonstrate
compliance with this Section 6, which may include summaries or, where reasonably necessary
and available, copies or relevant excerpts of the Contracted Processors’ agreements with Sub-
processors (in each case subject to redaction to remove sensitive or confidential commercial
information, information that could compromise security, information relating to other
customers, or other information not relevant to the requirements of this Addendum).
6.5 Company shall remain fully responsible to the Client for the performance of the Sub-processor's obligations.
7. Data Subject Rights
7.1 Taking into account the nature of the Processing, Company and each Company Affiliate shall assist each
Client Group Member by implementing appropriate technical and organisational measures, insofar as
possible, for the fulfilment of the Client Group Members’ obligations, as reasonably understood by Client,
to respond to requests from Data Subjects, Consumers, or other individuals seeking to exercise rights under
applicable Data Protection Laws.
7.2 Company shall:
7.2.1 notify Client without undue delay, and in any event no later than five (5) business days after
receipt, if any Contracted Processor receives a request from a Data Subject, Consumer, or other
individual under any Data Protection Law in respect of Client Personal Data; and
7.2.2 ensure that the Contracted Processor does not respond to such request except on the
documented instructions of Client or the relevant Client Affiliate, or as required by Applicable
Laws to which the Contracted Processor is subject, in which case Company shall, to the extent
permitted by Applicable Laws, inform Client of that legal requirement before the Contracted
Processor responds to the request.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 6
8. Personal Data Breach
Company shall notify Client without undue delay upon Company or any Sub-processor becoming aware of
a Personal Data Breach affecting Client Personal Data and, where required by applicable Data Protection
Laws, within the time period required thereunder. In such notification, Company shall provide Client with
such information as Company has available at that time regarding the Personal Data Breach to assist each
Client Group Member in meeting any obligations to investigate, report, notify, remediate, or otherwise
address the Personal Data Breach under applicable Data Protection Laws. Company shall cooperate with
Client and each Client Group Member and take reasonable steps to contain, investigate, mitigate, and
remediate each such Personal Data Breach.
9. Data Protection Impact Assessment and Prior Consultation
Company and each Company Affiliate shall provide reasonable assistance to each Client Group Member,
at Client’s expense, with any data protection impact assessments, privacy impact assessments, transfer
impact assessments, and prior consultations with Supervisory Authorities, privacy commissioners,
regulators, or other competent authorities, which Client reasonably considers to be required under the
applicable Data Protection Laws, in each case solely in relation to the Processing of Client Personal Data
by, and taking into account the nature of the Processing and information available to, the Contracted
Processors.
10. Deletion or return of Client Personal Data
10.1 Subject to section 10.2, Client may, on expiration or termination of the Agreement, elect one of the
following options with respect to Client Personal Data:
10.1.1 during the Service Term, export Client Personal Data using the self-service export functionality
made available through the Services at no additional cost;
10.1.2 if Client requires access to export Client Personal Data after expiration or termination of the
Agreement, submit a written request to Company prior to such expiration or termination to
extend administrative access to the Services on a read-only, export-only basis for up to thirty
(30) days following expiration or termination, solely for purposes of exporting Client Personal
Data, after which Company shall delete and procure the deletion of all remaining copies of
Client Personal Data Processed by any Contracted Processor, except as otherwise provided in
Section 10.2; or
10.1.3 request that Company provide one complete copy of Client Personal Data to Client by secure
electronic transfer in a reasonably available format, subject to a one-time fee of US$3,000 for
such managed export services, after which Company shall delete and procure the deletion of
all remaining copies of Client Personal Data Processed by any Contracted Processor, except as
otherwise provided in Section 10.2.
Absent a timely written request under subsection 10.1.2, Client acknowledges that access to the Services
will be suspended or terminated in accordance with Company’s standard offboarding procedures, and
Company shall have no obligation to re-enable access solely for purposes of export except as agreed under
subsection 10.1.3. For clarity, the fee in subsection 10.1.3 applies only to Company-managed export
services and not to Client’s use of the self-service export functionality under subsection 10.1.1 or the
temporary export access described in subsection 10.1.2.
10.2 Each Contracted Processor may retain Client Personal Data to the extent required by Applicable Laws and
only to the extent and for such period as required by Applicable Laws. In addition, residual copies of Client
Personal Data contained in routine backup, archival, or disaster recovery systems may be retained until
deleted or overwritten in the ordinary course, provided that such retained Client Personal Data remains
subject to the confidentiality, security, and restricted-processing obligations of this Addendum. Company
and each Company Affiliate shall ensure the confidentiality of all such retained Client Personal Data and
shall ensure that such Client Personal Data is Processed only (a) as required by Applicable Laws, (b) for
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 7
backup, archival, business continuity, or disaster recovery purposes, or (c) as reasonably necessary to
establish, exercise, or defend legal claims, and for no other purpose. Upon expiration of the applicable
retention period, or in the case of backup, archival, or disaster recovery copies, in the ordinary course of
Company’s retention and overwrite processes, Company shall delete or render inaccessible such Client
Personal Data.
11. Audit rights
11.1 Company and each Company Affiliate shall make available to each Client Group Member on request
information reasonably necessary to demonstrate compliance with this Addendum, including, in the first
instance, Company’s then-current third-party audit and assurance materials, such as SOC 2 Type II or
similar certifications, independent assessment reports, penetration test executive summaries, security
documentation, and responses to reasonable written security questionnaires, in each case to the extent
relevant to the Services and subject to redaction of trade secrets, information that could compromise
security, information relating to other customers, and other confidential information not relevant to the
requirements of this Addendum. Provision of such materials shall satisfy Company’s obligation to make
information available in the first instance. Company shall immediately inform Client if, in its opinion, an
instruction pursuant to this section 11 (Audit Rights) infringes applicable Data Protection Laws.
11.2 The information and materials provided under Section 11.1 shall satisfy Company’s obligations under this
Section 11 in the first instance. If, after reviewing such materials, Client reasonably determines that
additional verification is necessary to confirm Company’s compliance with this Addendum or applicable
Data Protection Laws, Client may request one (1) additional audit or assessment in any rolling twelve (12)
month period, to be conducted by Client or its designated independent third-party auditor, at Client’s
expense, except to the extent applicable Data Protection Laws require otherwise; provided that such audit
or assessment shall be conducted remotely in the first instance unless an on-site inspection is required by
applicable Data Protection Laws or a competent authority, or Client reasonably demonstrates that a remote
audit or assessment would be insufficient.
11.3 Client or the relevant Client Affiliate undertaking an audit shall give Company or the relevant Company
Affiliate reasonable notice of any audit or inspection to be conducted under section 11.2 and shall make,
and ensure that each of its mandated auditors makes, reasonable endeavours to avoid causing, or, if it cannot
avoid, to minimise, any inconvenience, damage, injury or disruption to the Company’s or Company
Affiliates’ premises, equipment, personnel and business, as applicable, while its personnel are on those
premises in the course of such an audit or inspection. Any auditor retained by Client shall be subject to
written confidentiality obligations no less protective than those set out in the Agreement. Any such audit
shall be limited in scope to matters relevant to the Processing of Client Personal Data under the Agreement
and this Addendum, shall be conducted during normal business hours, and shall not include penetration
testing, vulnerability scanning, social engineering, source-code review, or access to information relating to
other customers, except to the extent required by applicable Data Protection Laws or a competent authority.
12. Restricted Transfers
12.1 Subject to section 12.2, the parties agree that the official text of the Standard Contractual Clauses is
incorporated by reference into this Addendum and is not attached in full as an exhibit or annex.
12.1.1 For any Restricted Transfer of Client Personal Data subject to the EU GDPR, the EU SCCs are
hereby incorporated by reference into this Addendum and shall apply to such transfer. Unless
otherwise specified in writing or in Annex 2: (a) Module Two (Controller to Processor) shall
apply where Client is a Controller and Company is a Processor; (b) Module Three (Processor
to Processor) shall apply where Client is a Processor and Company is a Processor; (c) Clause
7 (Docking Clause) shall apply; (d) for Clause 9, Option 2 (General Written Authorization)
shall apply, and the notice period for changes to Sub-processors shall be as set out in Section
6.3; (e) the optional language in Clause 11 shall not apply unless otherwise agreed in writing;
(f) for Clause 17, the governing law shall be the laws of Ireland; (g) for Clause 18(b), the courts
of Ireland shall have jurisdiction; and (h) the information required for the appendices and
annexes to the EU SCCs shall be deemed completed using Annex 1, Annex 2, Annex 3, the
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 8
Agreement, any applicable Order Form or statement of work, Company’s then-current Sub-
processor list, and Company’s then-current security documentation. Execution of this
Addendum and/or the Agreement shall constitute execution of the EU SCCs and Annex 2, to
the extent applicable;
12.1.2 For any Restricted Transfer of Client Personal Data subject to the UK GDPR, the UK
Addendum is hereby incorporated by reference into this Addendum and shall apply to the EU
SCCs as incorporated under Section 12.1.1, with the Part 1 Tables of the UK Addendum
completed as set out in Annex 2 and the Appendix Information completed as set out in Annex
1, Annex 3, the Agreement, any applicable Order Form or statement of work, and Company’s
then-current Sub-processor list, to the extent applicable;
12.1.3 For any Restricted Transfer of Client Personal Data subject to the Swiss FADP, the EU SCCs
are hereby incorporated by reference into this Addendum as the recognized standard
contractual clauses, subject to the Swiss-required adaptations and supplements recognized by
the FDPIC from time to time. Unless otherwise specified in writing or in Annex 2, such Swiss
adaptations shall be deemed to include, as applicable: (a) references to Regulation (EU)
2016/679 or the GDPR shall be interpreted as including the Swiss FADP to the extent required
for the relevant transfer; (b) references to "Member State" shall be interpreted as including
Switzerland; (c) references to the "competent supervisory authority" shall, where the Swiss
FADP governs the transfer, include the FDPIC; (d) data subjects in Switzerland shall be able
to exercise rights under the SCCs in Switzerland to the extent required by Swiss law; and (e)
the information required for the appendices and annexes to the EU SCCs shall be deemed
completed using Annex 1, Annex 2, Annex 3, the Agreement, any applicable Order Form or
statement of work, Company’s then-current Sub-processor list, and Company’s then-current
security documentation.
12.1.4 To the extent a Restricted Transfer is covered by an adequacy regulation, adequacy decision,
recognized certification, approved code of conduct, approved binding corporate rules, or
another valid transfer mechanism under applicable Data Protection Laws, the parties may rely
on such mechanism in lieu of, or in addition to, the Standard Contractual Clauses to the extent
legally permitted.
12.1.5 For any cross-border disclosure or transfer of Client Personal Data subject to applicable
Canadian Privacy Laws or applicable Australian Data Protection Laws, the parties
acknowledge that this Addendum, the Agreement, Company’s technical and organizational
measures, and any applicable privacy, security, or transfer documentation incorporated by
reference constitute the parties’ contractual safeguards and documented instructions for such
cross-border Processing to the extent required by such laws, and Company shall implement
reasonable measures and provide reasonable assistance to enable Client to comply with
applicable requirements relating to cross-border Processing under such laws. For clarity, Annex
1 and Annex 3, together with the Agreement and this Addendum, constitute the relevant
description of Processing and safeguards for such purposes, to the extent applicable.
12.2 Upon receipt of written request from the other party, Company and Client shall reasonably cooperate with
each other with a view to implementing, updating, replacing, or executing any additional transfer
mechanism, local addendum, privacy schedule, or other document reasonably necessary under applicable
Data Protection Laws in respect of any Restricted Transfer (or as may otherwise be required by a competent
authority), including any Swiss-specific supplement, transfer impact documentation, or other measure
reasonably required under Articles 16 and 17 of the Swiss FADP, the Swiss DPO, or guidance or
recognition criteria issued by the FDPIC. Any such additional transfer mechanism, local addendum, privacy
schedule, or related implementation document may be incorporated by reference into this Addendum and
reflected in Annex 2, Annex 1, Annex 3, or other applicable documentation without the need to reproduce
the full official text thereof in this Addendum.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 9
13. General Terms
13.1 The parties to this Addendum:
13.1.1 hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any
disputes or claims howsoever arising under this Addendum, including disputes regarding its
existence, validity or termination or the consequences of its nullity; and
13.1.2 agree that this Addendum and all non-contractual or other obligations arising out of or in
connection with it are governed by the laws of the country or territory stipulated for this purpose
in the Agreement,
other than in respect of the Parties' respective obligations under the Standard Contractual Clauses, in which
case the choice of jurisdiction and governing law set out in the relevant Standard Contractual Clauses shall
apply.
13.2 Requests from Public Authorities. If Company or any Company Affiliate receives a legally binding request
from a public authority for disclosure of Client Personal Data, Company shall, unless prohibited by
Applicable Laws, promptly notify Client and, where reasonably possible, direct the requesting public
authority to seek the Client Personal Data directly from Client. If Company is legally compelled to disclose
Client Personal Data, Company shall disclose only the minimum amount of Client Personal Data legally
required and shall use commercially reasonable efforts to challenge or narrow the request where Company
reasonably determines there are grounds to do so.
13.3 Nothing in this Addendum reduces Company's or any Company Affiliate’s, nor Client’s or any Client
Affiliate’s obligations under the Agreement in relation to the protection of Client Personal Data or permits
Company or any Company Affiliate to Process (or permit the Processing of) Client Personal Data in a
manner which is prohibited by the Agreement or applicable Data Protection Laws. In the event of any
conflict or inconsistency between the Agreement, this Addendum and the Standard Contractual Clauses, or
any other mandatory transfer mechanism incorporated under Section 12, the Standard Contractual Clauses
or such other mandatory transfer mechanism shall prevail to the extent of such conflict or inconsistency,
including any Swiss-specific adaptations required for transfers governed by the Swiss FADP, and Annex 2
shall govern solely with respect to the parties’ implementation elections and completion of the Standard
Contractual Clauses.
13.4 Subject to Section 13.3, with regard to the subject matter of this Addendum, in the event of inconsistencies
between the provisions of this Addendum and any other agreements between the parties, including the
Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the
parties) agreements entered into or purported to be entered into after the date of this Addendum, the
provisions of this Addendum shall prevail.
13.5 Client or Company may:
13.5.1 by at least 30 (thirty) calendar days' written notice to the other party from time to time make
any variations to the Standard Contractual Clauses, UK Addendum, or any other transfer
mechanism or local privacy addendum incorporated under Section 12, to the extent required as
a result of any change in, or decision of a competent authority under, applicable Data Protection
Laws to allow relevant transfers or Processing activities to be made (or continue to be made)
without breach of such Data Protection Laws; and
13.5.2 propose any other variations to this Addendum which Client or Company reasonably considers
to be necessary to address the requirements of any Data Protection Law.
13.6 If Client or Company gives notice under section 13.5:
13.6.1 If Client or Company give notice under section 13.5.1, the party receiving such notice shall not
unreasonably withhold or delay agreement to any consequential variations to this Addendum
proposed by the other party to protect the Client Group Members or Contracted Processors
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 10
against additional risks associated with the variations made under section 13.5.1.
13.6.2 If Client or Company give notice under section 13.5.2, the parties shall promptly discuss the
proposed variations and negotiate in good faith with a view to agreeing and implementing those
or alternative variations designed to address the requirements identified in the notice as soon
as is reasonably practicable.
13.7 Neither Client nor Company shall require the consent or approval of any Client Affiliate or Company
Affiliate to amend this Addendum pursuant to this section 13 or otherwise.
13.8 The liability of each party and its Affiliates arising out of or relating to this Addendum, whether in contract,
tort, or under any other theory of liability, shall be subject to the exclusions, limitations, and caps on liability
set out in the Agreement. For the avoidance of doubt, any reference in the Agreement to the liability of a
party shall mean the aggregate liability of that party and its Affiliates under the Agreement and this
Addendum combined, and this Addendum shall not be construed to expand, increase, or separately apply
any liability cap or exclusion under the Agreement.
13.9 Subject to Section 13.3, should any provision of this Addendum be invalid or unenforceable, then the
remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall
be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’
intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or
unenforceable part had never been contained therein.
13.10 Notwithstanding any expiration or termination of the Agreement, this Addendum shall remain in effect
until, and shall automatically expire upon, the deletion or return of all Client Personal Data by Company in
accordance with this Addendum, except to the extent earlier termination is required by applicable Standard
Contractual Clauses or Applicable Laws.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 11
ANNEX 1: DETAILS OF PROCESSING OF CLIENT PERSONAL DATA
This Annex 1 includes certain details of the Processing of Client Personal Data as required by Article 28(3) of the
EU GDPR and equivalent requirements under other applicable Data Protection Laws. For purposes of the Standard
Contractual Clauses, this Annex 1 provides the information required for Annex I thereto, as supplemented by Annex
2 and the other documents incorporated by reference under Section 12.
Data Exporter Name: As set out in the Addendum, Agreement, or applicable Order Form
for the relevant Client Group Member.
Address: As set out in the Addendum, Agreement, or applicable Order Form
for the relevant Client Group Member.
Contact person’s name, position and contact details: As set out in Addendum,
Agreement, or applicable Order Form for the relevantClient Group Member
Activities relevant to the data transferred under these Clauses: Receipt of the
Services under the Agreement.
Signature and date: Execution of the Addendum and/or the Agreement shall
constitute execution of this Annex 1, Annex 2, and, where applicable, Annex
I to the EU SCCs and the corresponding tables of the UK Addendum.
Role: Controller or Processor, as applicable.
Data Importer Name: The Company legal entity identified in the Agreement
Address: As set out in the Agreement for the applicable Company entity
Contact person’s name, position and contact details:
Jean Hernandez
Information Security Officer
privacyofficer@absorblms.com
Activities relevant to the data transferred under these Clauses: Provision of
the Services under the Agreement.
Signature and date: Execution of the Addendum and/or the Agreement shall
constitute execution of this Annex 1, Annex 2, and, where applicable, Annex
I to the EU SCCs and the corresponding tables of the UK Addendum.
Role: Processor
Categories of data Personal data transferred may include, but is not limited to:
subjects whose personal
data is transferred • Users, including any current, former, or prospective employee,
agent, contractor, consultant, temporary worker, approved third
party, instructor, trainer, manager, supervisor, administrator, or other
individual authorized by Client to use the Services; or
• other individuals whose Personal Data is submitted to or made
available through the Services by or on behalf of Client.
Categories of personal The personal data transferred may include, but is not limited to, the
data transferred following categories of data:
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 12
• Name including first and last names;
• Contact information, including residential and work mailing
addresses and telephone numbers and e-mail addresses, and
emergency contact information;
• Personal details including date of birth;
• Employment information including hire date; place of executing
the employment; department of employment; job title; job category;
job status and supervisor;
• Education and training information, including education,
certifications, training, course participation, course completion, and
assessment results;
• Authentication and account data, such as usernames, login
credentials, user profile information, and account preferences, where
applicable;
• Technical and usage-related data contained in or associated with
the Services, to the extent such data constitutes Client Personal
Data;
• Any other Personal Data that Client or its Users choose to submit
to or make available through the Services.
Sensitive data None. The Services are not intended for the Processing of Sensitive Personal
transferred (if Data or special categories of Personal Data, and Client is prohibited under the
applicable) and applied Agreement from submitting, uploading, storing, or otherwise making available
restrictions or safeguards such data through the Services. Accordingly, no Sensitive Personal Data or
in respect of special special categories of Personal Data are intended to be transferred to Company
category data under the Agreement, this Addendum, or the Standard Contractual Clauses.
The frequency of the
transfer (e.g. whether the • one-time, intermittent, periodic, or continuous transfers in connection
data is transferred on a with commencement and use of the Services;
one-off or continuous • Regular and irregular transfer of Client Personal Data initiated by
basis). Client, its Users, or integrated systems; or
• Continuous or occasional remote access to Client Personal Data by
Company personnel or Sub-processors as necessary to provide,
support, secure, maintain, and improve the Services in accordance with
the Agreement and Addendum.
Nature of the processing The nature of the Processing may include, as necessary to provide the
Services and perform Company’s obligations under the Agreement and
Addendum, collection, receipt, recording, organization, structuring, storage,
hosting, retrieval, consultation, use, transmission, disclosure by making
available, alignment, combination, restriction, deletion, destruction,
provisioning, administration, configuration, support, troubleshooting,
monitoring, maintenance, migration, import, export, backup, disaster
recovery, security, and other service-related Processing activities.
Purpose(s) of the data The purpose of the transfer and Processing of Client Personal Data is to provide
transfer and further the Services under the Agreement, including implementation, hosting,
processing operation, support, maintenance, security, and related service functionality, and
to otherwise perform Company’s obligations under the Agreement and
Addendum.
The period for which the Client Personal Data will be retained for the duration of the Agreement and
personal data will be thereafter in accordance with the Addendum, including Section 10, and
retained, or, if that is not Company’s applicable retention and deletion practices, as may be further
possible, the criteria used described in Company’s then-current documentation. Where exact retention
to determine that period periods cannot be stated in advance, the criteria used to determine the retention
period shall include: (a) the duration of the Agreement and any post-
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 13
termination export or transition period; (b) the need to retain the data for
purposes of providing the Services and completing deletion or return
obligations; and (c) any retention required by Applicable Laws.
Competent supervisory For purposes of the EU SCCs, the competent supervisory authority shall be
authority determined in accordance with the EU SCCs and Annex I.C thereto. For
purposes of the UK Addendum, Clause 13(a) and Part C of Annex I to the EU
SCCs are not used, and references to the competent supervisory authority shall
be read in accordance with the UK Addendum, including as referring to the
Information Commissioner, where applicable. For purposes of Swiss transfers,
references to the competent supervisory authority shall include the Swiss
Federal Data Protection and Information Commissioner, where applicable.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 14
ANNEX 2: STANDARD CONTRACTUAL CLAUSES IMPLEMENTATION SCHEDULE
This Annex 2 sets out the parties’ implementation of the Standard Contractual Clauses referenced in Section 12.
For clarity, the official text of the EU SCCs and, where applicable, the UK Addendum is incorporated by reference
into the Addendum and is not reproduced in full in this Annex 2.
1. EU SCCs
1.1. Where Client is a Controller and Company is a Processor with respect to the relevant Restricted Transfer,
Module Two (Controller to Processor) of the EU SCCs applies.
1.2. Where Client is a Processor and Company is a Processor with respect to the relevant Restricted Transfer,
Module Three (Processor to Processor) of the EU SCCs applies.
1.3. Clause 7 (Docking Clause) applies.
1.4. For Clause 9, Option 2 (General Written Authorization) applies, and the notice period for changes to Sub-
processors shall be as set out in Section 6.3 of the Addendum.
1.5. The optional language in Clause 11 shall not apply unless otherwise agreed in writing.
1.6. For Clause 17, the governing law shall be the laws of Ireland.
1.7. For Clause 18(b), the courts of Ireland shall have jurisdiction.
1.8. Annex 1 to the Addendum shall constitute Annex I to the EU SCCs, Annex 3 to the Addendum shall
constitute Annex II to the EU SCCs, and Company’s then-current Sub-processor list shall constitute or
supplement Annex III to the EU SCCs to the extent required.
1.9. The Agreement, the Addendum, Annex 1, Annex 3, any applicable Order Form or statement of work,
Company’s then-current Sub-processor list, and Company’s then-current security documentation shall be
used to complete and interpret the appendices and annexes to the EU SCCs, to the extent applicable.
2. UK Addendum
2.1. Where the UK GDPR applies to a Restricted Transfer, the UK Addendum applies to the EU SCCs as
incorporated pursuant to Section 12 and this Annex 2.
2.2. The Part 1 Tables of the UK Addendum, which apply only to UK Restricted Transfers, shall be completed
as follows:
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 15
Table 1: Parties
Start date The effective date of the Addendum or, if later, the date on which the relevant
Restricted Transfer begins.
Exporter (who sends the Restricted Importer (who receives the
The Parties
Transfer) Restricted Transfer)
Parties’ details Full legal name, Trading name (if Full legal name, Trading name (if
different), Main address (if a different), Main address (if a company
company registered address), Official registered address), Official registration
registration number (if any): each, as number (if any): as set out in the
set out in the Addendum, Agreement, Agreement for the applicable Company
and/or applicable Order Form for the entity.
relevant Client Group Member.
Key Contact Full Name (optional), Job Title, Full Name (optional): Jean Hernandez
Contact details including email: each,
as set out in the Addendum, Job Title: Information Security
Agreement, and/or applicable Order Officer
Form for the relevant Client Group
Member. Contact details including email:
privacyofficer@absorblms.com
Signature (if required Execution of the Addendum and/or Execution of the Addendum and/or the
for the purposes of the Agreement shall constitute Agreement shall constitute execution of
Section 2) execution of the UK Addendum. the UK Addendum.
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs The Approved EU SCCs are Commission Implementing Decision (EU) 2021/914
of 4 June 2021, as incorporated by reference into the Addendum together with the
Appendix Information.
Module Module Clause 7 Clause Clause 9a Clause 9a Is personal data received from
in (Docking 11 (Prior (Time the Importer combined with
operation Clause) (Option) Authorisation period) personal data collected by the
or General Exporter?
Authorisation)
2 Yes Yes No General written 30 days No.
authorization
3 Yes Yes No General written 30 days No.
authorization
Linked Agreement: The Agreement, as supplemented by the Addendum.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 16
Table 3: Appendix Information
"Appendix Information" means the information which must be provided for the selected modules as set out in
the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Annex I.A: List of Parties: Annex 1 of the Addendum
Annex I.B: Description of Transfer: Annex 1 of the Addendum
Annex II: Technical and organisational measures including technical and organisational measures
to ensure the security of the data: Annex 3 of the Addendum
Annex III: List of Sub processors (Modules 2 and 3 only): Not applicable, as Clause 9(a) Option 2
(general written authorization) applies.
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum when the Neither Party may end this Addendum as set out in Section
Approved Addendum changes 19 of the UK Addendum.
3. Swiss Transfers
3.1. Where the Swiss FADP applies to a Restricted Transfer, the EU SCCs apply subject to the Swiss
adaptations described in Section 12.1.3 and any additional Swiss-specific requirements reflected in the
Addendum or this Annex 2.
3.2. References to Annex I and Annex II to the EU SCCs shall, for Swiss transfers, be completed using Annex
1, this Annex 2, Annex 3, the Agreement, any applicable Order Form or statement of work, Company’s
then-current Sub-processor list, and Company’s then-current security documentation, to the extent
applicable.
4. Execution. Execution of the Addendum and/or the Agreement shall constitute execution of the Standard
Contractual Clauses, including this Annex 2, to the extent applicable.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 17
ANNEX 3 TECHNICAL AND SECURITY MEASURES
This Annex 3 describes the technical and organizational measures implemented by Company in accordance with
the Addendum. For purposes of the Standard Contractual Clauses, this Annex 3 provides the information required
for Annex II thereto, to the extent applicable.
Company and Company Affiliates have implemented a wide range of technical and organizational measures as
follows:
1. Hosting infrastructure: Absorb LMS infrastructure architecture is designed for resilience and high
availability, spread over two AWS availability zones (i.e. two physical data centres), enabling a hot/hot data centre
strategy.
2. Physical security (data processing facilities excluding data centers): All data processing facilities including
office areas are secured with controlled access enforced at all entry points. Access rights as well as access logs are
reviewed on a regular basis.
3. Physical security (data centers): Absorb LMS is hosted in AWS and relies on AWS for physical security.
AWS has implemented a wide range of controls for physical security which can meet the most stringent
requirements in the industry.
4. Roles and responsibilities: Roles and responsibilities for security and privacy are defined and established.
5. Security/privacy/GDPR awareness training: All personnel are required to take the training upon hire and
on an annual basis.
6. Policies and procedures. Policies and procedures are in place and reviewed on an annual basis.
7. Access management: Access control rules are enforced at hypervisor, network, system, storage, application,
and data layers. Principles for segregation of duties and least privilege are implemented. Users and access
permissions are reviewed on a regular basis.
8. Data encryption. Data is encrypted at rest (AES-256) and in transit (TLS 1.2) to ensure data confidentiality
and integrity.
9. Data transfer. Where GDPR applies, data transfer to outside EEA is governed by GDPR data transfer rules.
10. Data minimalization. The use of data including data sharing is limited to what is necessary for the specific
purposes.
11. Third parties: Process for managing and monitoring third party access including subprocessing has been
established. Absorb has data processing addendum in place with all subprocessors.
12. Backup and recovery: Procedures are documented and implemented, and recovery tests are performed on a
regular basis.
Absorb Global Data Processing Addendum v2.0 CONFIDENTIAL 18