Snapshot 233195
Normalized text
Scripts and page chrome removed; this is what change detection compares.
SHIFT – END USER LICENSE AGREEMENT
This End User License Agreement (the “Agreement” or "EULA") is owned or licensed by Shift. If Customer provides any feedback (such
made effective as of the date you click to accept, access, or use the as suggested improvements or a like regarding the Services)
Services (the “Effective Date”), by and between Shift Cyber Security (collectively, “Feedback”) Customer hereby grants to Shift a non-
Inc., a Delaware corporation, and its affiliates (“Shift”), and you exclusive, perpetual, irrevocable, transferable, royalty-free and
(“Customer”) (each, a “Party”, and together, the “Parties”). BY worldwide right, with the right to grant and authorize sublicenses, to
CLICKING TO ACCEPT, ACCESSING, OR USING THE use and benefit from such Feedback to provide and improve the
SERVICES, CUSTOMER AGREES TO BE BOUND BY THIS Platform and/ or the Services and Shift ’s business without any
AGREEMENT. IF YOU DO NOT AGREE TO THESE TERMS, compensation or credit due to Customer.
PLEASE DO NOT ACCESS OR USE THE SERVICES. 3. Customer Data, Privacy and Security
3.1. Customer warrants that as between the Parties,
1. Subscription.
Customer solely owns and retains all rights, title and interest in and to
1.1. Shift hereby grants Customer during the Term, a Customer Data including all Intellectual Property Rights embodied in
limited, revocable, non-exclusive, non-sublicensable, non-transferable Customer Data. "Customer Data" means any data or information
right for Customer and its employees who are permitted access to the associated with the Customer that the Platform automatically accesses,
Services by Shift ("Authorized Users") to access and use Shift collects, processes and/or hosts when monitoring, and communicating
proprietary cloud-based platform (“Platform”) in accordance with with Customer’s information technology systems or in accessing
Shift ’s instructions and technical documentation ("Documentation"), Services. Customer hereby grants to Shift , during the Term, a non-
solely for Customer’s internal business purposes, and under the terms exclusive, worldwide royalty-free right store, use and otherwise process
set forth in an applicable order form mutually approved by the Parties the Customer Data solely to the extent necessary to perform its
("Order Form") which is hereby incorporated into this Agreement. obligations under this Agreement.
The access and use of the Platform shall be also referred to as the
3.2. In providing the Services, Shift will (i) store, process
“Services”.
and access Customer Data only to the extent reasonably necessary to
1.2. Shift shall use commercially reasonable efforts to provide Customer the Services; and (ii) implement and maintain
make the Platform available in accordance with Shift SLA, attached commercially reasonable technical, physical and organizational
hereto as Exhibit A, as may be updated by Shift from time to time. measures to protect the security, confidentiality and integrity of
1.3. Restrictions on Use. Customer shall not use the Customer Data hosted by Shift or Shift ’s authorized third party service
Services in any manner or for any purpose other than as expressly providers, from unauthorized access, use, alteration or disclosure.
permitted in the Agreement. Customer may not, directly or indirectly, 3.3. To the extent Customer Data contains any personal
and may not authorize any third party to attempt to: (i) copy, modify, data as defined under the applicable data protection law ("Personal
alter, tamper with, repair, or otherwise create derivative works of or Data"), Shift will process such Personal Data in accordance with the
distribute any part of the Platform or Services; (ii) sell, license (or sub- data processing addendum (“DPA”) attached hereto as Exhibit B, and
license), lease, assign, transfer, pledge, or share Customer's rights under applicable data protection law. Customer acknowledge and agree that
this Agreement, with any third party; (iii) reverse engineer, Shift may use aggregated and/or anonymized Customer Data to
disassemble, or decompile the Platform or the Services, or attempt to improve the Services.
discover the Platform's source code or underlying algorithms; (iv) use,
4. Confidential Information.
remove or alter any Shift 's or any third party's logos, trademarks or any
other or other proprietary rights affixed to or provided as part of the 4.1. Each party (the “Receiving Party”) may have access
Platform or the Services; (v) disturb or disrupt the Platform or the to certain non-public and/or proprietary information of the other party
Services, directly or indirectly, or transmit or activate viruses or any (the “Disclosing Party”), in any form or media, including confidential
other unlawful material in connection with the Platform or the Services; trade secrets and other information related to the products, software,
or (vii) use the Platform or the Services in a manner that would violate technology, data, know-how, or business of the Disclosing Party,
applicable laws, or is outside the scope of the rights granted in this whether written or oral, and any such other information that, regardless
Agreement. Customer must promptly notify Shift in writing if it of the manner in which it is furnished and given the totality of the
becomes aware of, or has reason to believe, that any of the prohibitions circumstances, a reasonable person or entity should have reason to
listed in this Section has been breached by Customer or any Authorized believe is proprietary, confidential, or competitively sensitive (the
User. “Confidential Information”). The Receiving Party shall take
reasonable measures, at least as protective as those taken to protect its
2. Rights and Title.
own confidential information, but in no event less than reasonable care,
2.1. All title, ownership rights, and intellectual property to protect the Disclosing Party's Confidential Information from
rights (including all copyrights, patents, trade secret rights and disclosure to a third party. The Receiving Party shall not use or disclose
trademarks) evidenced by or embodied in, attached, extracted from, the Confidential Information of the Disclosing Party except as
connected, and/or related to the Services and the various practices, expressly permitted under this Agreement. All right, title and interest in
materials, methodologies, tools, and templates used with respect thereto and to Confidential Information are and shall remain the sole and
(and all improvements enhancements, corrections, modifications, exclusive property of the Disclosing Party.
alterations, revisions, extensions and updates and derivative works
4.2. Notwithstanding the foregoing, the parties agree that
thereof) are and shall remain solely in Shift , and/or its licensors, if any.
Confidential Information will not include any information that the
Shift expressly reserves all rights to the foregoing, and except for the
Receiving Party has documentation to demonstrate such information:
limited grant of rights expressly set forth herein, Shift does not grant
(i) is or becomes publicly known or is or becomes part of the public
the Customer any right, title, or interest in any intellectual property
domain through no fault of the Disclosing Party; (ii) the Disclosing
Party authorizes in writing to be disclosed; (iii) is rightfully received by (Consideration), 8 (Warranty Disclaimer), 9 (Limitation of Liability),
the Receiving Party from a third party without restriction on disclosure 10 (Indemnification), and 1212 (Miscellaneous) shall survive
and without breach of this Agreement; (iv) is known to the Receiving termination of this Agreement.
Party on the Effective Date from a source other than the Disclosing 8. Representations of the Parties.
Party, and not subject to a confidentiality obligation. Notwithstanding
8.1. Each Party represents and warrants that it is duly
anything to the contrary in this Agreement, if vulnerabilities are
organized, validly existing and in good standing under the laws of its
detected in Customer systems by Shift in its performance of the
jurisdiction of incorporation or organization; and that the execution and
Services, Shift may use such information solely for its own internal
performance of this Agreement will not conflict with other agreements
purposes, including the development the Platform or any other products
to which it is bound or violate applicable law.
and services, and to inform the performance of services for other
customers, provided that such information is only utilized and disclosed 8.2. Shift represents and warrants that (1) it and its
once it is irreversibly aggregated and anonymized in a manner such that personnel shall have, and shall maintain throughout the Term, the
it cannot be used to identify or re-identify Customer. capability, skills, experience, licenses, and means required (in
accordance with applicable law) to perform the Services; (2) Shift will
5. Consideration.
perform the Services in accordance with the cloud resilience
5.1. Fees. The Services are conditioned on Customer's professional standards, know-how, processes, procedures and work
payment in full and in advance of the applicable fees set forth in each methods of Shift , as maybe updated by Shift from time to time.
Order Form.
8.3. Customer represents and warrants that: (1) Customer
5.2. All fees are non-refundable and exclusive of tax. Fees grants Shift access to Customer's computer systems, including but not
shall be payable within thirty (30) days of the date of the invoice issued limited to Customer's digital assets (collectively, "Customer
by Shift. Payment of Fees shall be made by wire transfer or ACH to the Systems"), to the extent required by Shift from time to time for the sole
account designated by Shift from time to time. All amounts payable purpose of the performance of the Services. Customer further confirms
under each Order Form are exclusive of all sales, use, value-added, that the provision of the Services are not in violation of any agreement
withholding, and other direct or indirect taxes, charges, levies and to which the Customer is a party, with any third party, or any regulation
duties. Customer shall bear all value added, state, local, withholding, or law applicable to the Customer; (2) Customer acknowledges that
and other taxes or other charges applicable to the Services. In the event Shift will not detect, identify, address or correct any errors or defects
that Customer is required by law to deduct and/or withhold any amounts in Customer's Systems, whether or not due to imprecise or ambiguous
from any payments due hereunder, it shall gross-up and increase the entry, storage, interpretation or processing or reporting of data. Shift
amounts to be paid to Shift so that the actual net amount to be paid to will not be responsible for any defect or problem arising out of or
Shift shall equal the fees that would have been due to Shift without such related to data processing in any system (including Customer Systems).
deduction or withholding. Moreover, Shift will not conduct a review to detect fraud or illegal acts.
6. Term and Termination. The Services are advisory in nature. None of the Services or any reports
6.1. Term. This Agreement shall be in effect as of the will constitute any legal opinion or advice; (3) In the event Shift
Effective Date and shall remain in effect as long as there is an Order proposes recommendations for Customer's consideration and
Form which is in effect, unless terminated earlier in accordance with implementation in connection with the Services, Customer
the terms hereof (the "Term"). acknowledges that Customer has final approval over recommendations
made by Shift and is responsible for all management decisions relating
6.2. Termination
to the implementation of Services, and decisions resulting from the use
6.2.1. Material Breach. Either party may terminate or implementation of the output of the Services; (4) Shift shall base any
this Agreement with immediate effect upon written notice to the other comments or recommendations as to the functional or technical
party if the other party materially breaches this Agreement and such capabilities of any products in use or being considered by Customer
breach remains uncured (to the extent that the breach can be cured) solely on information provided by Customer's vendors, through
thirty (30) days after having received written notice thereof. In the event Customer, or which is generally made available by such vendors. Shift
Customer terminates this Agreement due to Shift ’s uncured material does not assume any responsibility for any third-party products,
breach, Shift will promptly refund the pro-rata portion of any fees paid programs or services, their performance or compliance with Customer's
by Customer attributable to the date of the breach through the end of specifications or otherwise.
the Term.
Warranty Disclaimer. TO THE FULLEST EXTENT PERMITTED
6.2.2. Distress Event. In the event that either party BY APPLICABLE LAW, EXCEPT FOR THE EXPRESS
becomes liquidated, dissolved, bankrupt or insolvent, whether WARRANTIES SET FORTH ABOVE IN THIS SECTION, EACH
voluntarily or involuntarily, or shall take any action to be so declared, PARTY HEREBY EXPRESSLY DISCLAIMS ALL WARRANTIES,
the other party shall have the right to immediately terminate this WHETHER EXPRESS OR IMPLIED, INCLUDING THE
Agreement. WARRANTIES OF MERCHANTABILITY, TITLE, NON-
7. Effect of Termination. INFRINGEMENT, NON-INTERFERENCE, ACCURACY,
7.1. General. Upon termination of this Agreement, (1) CONDITION, AND FITNESS FOR A PARTICULAR PURPOSE
Customer shall immediately discontinue all access and use of the (WHETHER OR NOT SUCH PARTY KNOWS, HAS REASON TO
Platform and Additional Services and shall promptly delete all copies KNOW, HAS BEEN ADVISED, OR IS OTHERWISE AWARE OF
of the Documentation in Customer’s or any of its representatives’ ANY SUCH PURPOSE). WITHOUT LIMITING THE FOREGOING,
possession or control; (2) Shift will delete Customer Data and Platform SHIFT DOES NOT WARRANT THAT (A) THE USE OF THE
account access. SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR
(B) THE SERVICES WILL DETECT, PREVENT, OR PROTECT
7.2. Survival. This Section 7 and Sections 1.3 (Restrictions
AGAINST ALL POSSIBLE THREATS WHETHER KNOWN OR
on Use), 22 (Rights and Title),4 (Confidential Information) 35
UNKNOWN. CUSTOMER ACKNOWLEDGES AND AGREES
2
THAT THE SERVICES MAY INCORPORATE AND UTILIZE including any purchase order (“Partner Order Form”), then, as
ARTIFICIAL INTELLIGENCE ("AI") AND MACHINE LEARNING between Customer and Shift, this Agreement shall prevail. Any rights
ALGORITHMS ("MACHINE LEARNING") TO ENHANCE granted to Customer in such Partner Order Form which are not
FUNCTIONALITY, EFFICIENCY, AND USER EXPERIENCE. contained in this Agreement, apply only in connection with such
CUSTOMER UNDERSTANDS AND AGREES THAT WHILE AI Partner. In that case, Customer must seek redress or realization or
AND MACHINE LEARNING CAN PROVIDE SUBSTANTIAL enforcement of such rights solely with such Partner and not Shift.
BENEFITS, THEY ARE BASED ON CURRENT TECHNOLOGIES
AND PRACTICES WHICH ARE EVOLVING AND THAT SHIFT
12. Miscellaneous. This Agreement shall constitute the full
MAKES NO WARRANTIES OR REPRESENTATIONS ABOUT
Agreement between the Parties with respect to its subject matter and
THE ACCURACY, RELIABILITY, OR EFFECTIVENESS OF AI
shall supersede any and all prior agreements and understandings
AND MACHINE LEARNING INCORPORATED INTO THE
relating thereto. Shift reserves the right to modify, amend, or update this
SERVICES. CUSTOMER FURTHER ACKNOWLEDGES THAT
Agreement at any time by providing Customer with at least thirty (30)
THE USE OF AI AND MACHINE LEARNING IN THE SERVICES
days' prior written notice, which may be delivered via email to the
DOES NOT GUARANTEE ANY SPECIFIC OUTCOMES, AND
address provided in the Order Form, by posting the revised Agreement
THAT THE PERFORMANCE OF THE SERVICES MAY VARY.
on Shift's website, or through in-platform notification. The updated
SHIFT DISCLAIMS ANY LIABILITY FOR ANY ERRORS,
Agreement will become effective at the end of such thirty (30) day
OMISSIONS, OR INACCURACIES THAT MAY ARISE FROM
notice period. Customer's continued access to or use of the Services
THE USE OF AI AND MACHINE LEARNING IN THE SERVICES.
after the effective date of any modifications constitutes Customer's
9. Limitation of Liability. acceptance of the modified Agreement. If Customer does not agree to
9.1. NEITHER PARTY SHALL BE LIABLE, IN any material modification that adversely affects Customer's rights under
CONTRACT OR TORT, UNDER STATUTE OR OTHERWISE, this Agreement, Customer's sole remedy is to terminate this Agreement
ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, PUNITIVE in accordance with and Section 6.2 hereof, provided such termination
OR SPECIAL DAMAGES IN CONNECTION WITH CLAIMS notice is delivered to Shift prior to the effective date of the
ARISING OUT OF THIS AGREEMENT OR ANY ORDER FORM, modifications and not cured by Shift within 30 days. This Agreement
OR OTHERWISE RELATING TO THE SERVICES, INCLUDING and any rights or obligations hereunder may not be transferred or
ANY AMOUNT FOR LOSS OF PROFIT, DATA OR GOODWILL, assigned by either party without the prior written consent of the other
WHETHER OR NOT THE LIKELIHOOD OF SUCH LOSS OR party, except that either party may assign this Agreement as a whole to
DAMAGE WAS CONTEMPLATED. IN NO EVENT SHALL a successor to all or substantially all of its assets or business related to
EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY this Agreement, without such consent. Subject to the foregoing, this
THIRD PARTY FOR AGGREGATED DAMAGES IN EXCESS OF Agreement shall be binding upon and inure to the benefit of the parties
THE FEES ACTUALLY PAID OR PAYABLE TO SHIFT BY and their successors and assigns. Customer acknowledges that Shift
CUSTOMER (DIRECTLY OR THOUGH A PARTNER) IN THE reserves the right to use Customer's trademarks, logo, and name for any
TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE marketing purposes, including press release, newsletter and social
EVENT GIVING RISE TO LIABILITY. media, however, without compromising any confidential information of
9.2. NOTWITHSTANDING THE FOREGOING, Customer. If any of the terms contained in this Agreement shall, for any
NOTHING HEREIN SHALL LIMIT THE LIABILITY OF EITHER reason, be held to be void or unenforceable, it shall not affect the
PARTY IN ANYWAY FOR LIABILITY OR DAMAGES ARISING validity or enforceability of any other term in this Agreement. This
FROM (A) INTENTIONAL MISCONDUCT, (B) FRAUD OR Agreement does not, and shall not be construed to create any
FRAUDULENT MISREPRESENTATION. NO CLAIM RELATING relationship, partnership, joint venture, employer-employee, agency, or
TO THE SERVICES OR OTHERWISE UNDER THIS AGREEMENT franchisor-franchisee relationship between the Parties. Shift will not be
SHALL BE MADE AFTER THE LAPSE OF 12 MONTHS liable for any delay or failure to provide the Services resulting from
FOLLOWING THE COMPLETION OF A PARTICULAR SERVICE. circumstances or causes beyond the reasonable control of Shift
including, but not limited to on account of strikes, shortages, riots,
10. Indemnification.
insurrection, fires, flood, storms, explosions, acts of God, war,
10.1. Subject to the cap set out in Section 9.1 above, Shift government or quasi-governmental authorities actions, acts of
shall defend, indemnify and hold harmless Customer, from and against terrorism, earthquakes, power outages, pandemic or epidemic (or
any claims, damages, costs, liabilities and expenses (including similar regional health crisis), or any other cause that is beyond the
reasonable attorneys’ fees) arising out of or related to any claim that the reasonable control of Shift. This Agreement shall be governed by and
Platform, Services and/or Documentation infringes any third-party construed under the laws of the State of Delaware without reference to
intellectual property right. Indemnification hereunder shall be principles and laws relating to the conflict of laws. The competent
conditioned upon: (a) Customer notifying Shift of the claim courts of the State of Delaware shall have the exclusive jurisdiction with
immediately upon becoming aware thereof, (b) Customer allowing respect to any dispute and action arising under or in relation to this
Shift to assume full control of the defense and settlement of such claim, Agreement. All notices relating to this Agreement shall be in writing
and (c) Customer reasonably cooperating with Shift in defense and and shall be delivered by: (a) personal delivery; or (b) electronic
settlement of the claim. transmission; or (c) certified or registered mail, return receipt requested
by electronic mail; or (d) recognized overnight courier service. Notices
11. Partner. If Customer has purchased the Services granted shall be sent to the address of the other party set forth in the Order Form
hereunder from a partner, reseller or distributor authorized by Shift and shall be deemed given upon personal delivery, three (3) business
(“Partner”), the terms of Section 5 (Consideration) shall not apply. To days after deposit in the mail, one (1) business day if delivered by
the extent there is any conflict between this Agreement and the overnight courier, or upon acknowledgment of electronic transmission.
agreement entered between Customer and the respective Partner,
3
EXHIBIT A
SHIFT CYBER SECURITY – MAINTENANCE AND SUPPORT PROGRAM
1. Maintenance Services.
a. Shift will provide Customer with remedial and preventive maintenance and support services to the
Platform, as provided in and subject to the terms set forth in Shift's SLA (the “SLA”) as detailed herein
(“Maintenance Services”) to keep the most current release of the Platform in good operating condition,
and subject to the terms of the Shift master subscription agreement or other agreement, entered between
the Customer and Shift (the "Agreement").
b. Shift’s obligation to provide Maintenance Services is dependent upon: (i) the Agreement being in effect;
and (ii) the performance by Customer of all of its obligations set forth in the Agreement and the
obligations set forth herein.
c. Without derogating from the provisions of the SLA, Shift shall not be obligated to provide Maintenance
Services pursuant to this Maintenance and Support Program, that are required as a result of any of the
following: (i) abuse, misuse, accident or neglect; (ii) repairs, alterations, customization and/or
modifications; or (iii) use of materials composed by the Customer which may not comply with Shift’s
requirements; (iv) use of the Platform for other than the intended purpose for which it was licensed; (v)
alternations, modifications or integration of the Platform with third party software (for the avoidance of
doubt Shift shall provide Maintenance Services the Shift in its 'out of the box' configuration); or (vi)
inadequate backups of the Platform by the Customer that prevent Shift from reinstalling the Platform
before or after the reported problem was solved.
2. Updates and New Versions.
a. During the term of the Agreement, Shift shall make available to Customer updates to the Platform,
consisting of one copy of modifications and improvements to the Platform that Shift determines are
required to achieve the specifications established by Shift for the Platform (the “Updates”). For the
avoidance of doubt, Updates shall only include such modules of the Platform licensed by Customer,
under the Agreement. The Updates will be made available to Customer at no additional cost.
b. Shift shall maintain prior versions of the Platform until the earlier of (i) a period not earlier than 18
months from the release of each new version release; or (ii) termination of this Support and Maintenance
Agreement. Upon receipt and installment of Updates, Customer may keep one copy of the previous
version of the Platform for archival purposes only and shall destroy all other copies of the previous
version of the Platform.
3. Service Level Agreement (“SLA”)
a. Shift will support the Customer with problems generated directly by and as part of the Platform, as
defined in this Maintenance and Support Program, including support for technical or installation
problems, implementation and documentation errors. For the purpose of this SLA, the terms technical
problems or installation problems shall be defined herein as defects (“Defects”).
b. Initiating Support Requests.
Support calls shall be initiated by a designated individual nominated by Customer (the
“Representative”) by filing of a Support Request through a designated form in the Platform's help
section, or by an email to support@shift.security.
c. Handling of Support Requests.
(i) The Customer Support Team (SST) shall recreate the Defect reported in Shift's labs using the
relevant 'out of the box' version of the Platform.
(ii) Shift may request the Representatives:
(1) To provide additional information (e.g. screen shots, log information etc).
(2) To perform troubleshooting activities to enable identification of the source of the reported
problem.
(3) To install patches or files that are sent by Shift to be executed accurately in accordance with
Shift's instructions and the results of such installation will be reported back to the SST.
(4) In any case where the Defect was successfully recreated by SST, Shift shall send an
appropriate fix in accordance with the timetables set forth herein below.
(5) Shift will not support or provide solutions to problems (i) that were not generated directly by
or on the Platform, including but not limited to, problems generated by Customer’s database,
network components, operating systems, applications or integration with other systems; or
(ii) in a Platform that has be customized or otherwise modified; or (iii) If the Customer did
not implement any preventive maintenance steps and procedures that will be directed by
Shift.
d. Priority Levels of Defects.
Initial response for Defects will be provided based on the severity of the Defect as follows:
Customer Support for the Platform covers (i) development and production issues for the Platform and
its components, (ii) Informational and implementation questions about the Platform and features; and
(iii) troubleshooting operational problems with the Platform.
e. Response Times and Availability
SST will attempt to respond to cases within these internal time frames. These are targets only and are
not guaranteed. SST does not guarantee resolution times or delivery dates. These times are subject to
change depending on the nature of a case and complexity of the reported case.
Categorization Criteria Initial Response Time Status Update
Level 1/Priority 1 Critical technical issue Within 2 hours 4 Business hours
Critical/Urgent resulting in a total loss (All days)
of core functionality in
the Platform. No
workaround is
available.
Level 2/Priority 2 Major technical issue Within 6 Business hours 1 Business Day
High resulting in severe
performance problems
in the Platform. No
workaround is
available.
Level 3/Priority 3 A minor technical issue 1 Business Day 1 Business week
Normal/Medium/Low where the Customer
can use the Platform
with only slight
inconvenience.
(i) Customer acknowledges that not all Level 3 problems will require a workaround. Shift may,
in its reasonable discretion, respond to a Level 3 problem by making correction of the error a
feature request.
(ii) For Level 1 and Level 2 incidents, Customer shall initiate contact with SST via telephone and
indicate the probable category of the incident. Telephone Support shall be standard business
hours. For Level 3 incidents, Customer may email or telephone the SST.
(iii) SST’s standard business hours are 9:00-18:00, ET.
(iv) Response time is defined as the time between the creation of the case and the first attempt of
a Shift support engineer from SST to contact the Customer who initiated a case.
(v) Above severities apply to systems in production, errors in non-production systems (test,
development, sandbox) will be automatically downgraded one level.
(vi) Problems with the installation of the Platform have Priority/Severity “High” at a maximum.
(vii) When a Customer initiates a case outside standard business hours, then the case will be
handled as if it was initiated at 8 AM the next business day.
(viii) A Shift installation in an environment which is not in compliance with Shift's sizing and
technical recommendations will be automatically downgraded by one level.
(ix) Above response times apply only if e-mail communication is provided via
support@shift.security.
(x) If SST determines that an issue is fixed in a released patch, SST may require the Customer to
apply this patch before commencing troubleshooting.
f. Resolved Queries.
An issue is considered resolved when (i) the issue is solved; (ii) the source of the issue is determined to
lie with a third party; or (iii) Customer does not respond to a request from Shift within seven (7)
consecutive days after Shift’s request.
g. Solutions to Defects may include workarounds, patches or new versions.
5
EXHIBIT B
DATA PROCESSING ADDENDUM
1. Applicability.
This Data Processing Addendum (“DPA”) shall apply to the services agreement (“Services Agreement”) by and between Shift and Customer
to the extent that Shift processes Personal Data (as defined below).
2. Definitions.
2.1. Terms used in this DPA but not defined herein (whether or not capitalized) shall have the meanings assigned to such terms in the
Applicable Data Protection Laws.
2.2. ”Applicable Data Protection Laws“ shall mean, to the extent applicable to Shift 's processing of Personal Data hereunder (with respect
to each data subject): (i) General Data Protection Regulations (European Parliament and Council of European Union (2016) Regulation
(EU) 2016/679) (EU GDPR); (ii) EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European
Union (Withdrawal) Act 2018 and UK Data Protection Act 2018 (UK GDPR) ; (iii) California Consumer Privacy Act of 2018 (CCPA)
and the California Privacy Rights Act of 2020 (CPRA); (iv) Protection of Privacy Law (Israel); (vi) any similar laws to any of the
foregoing in any jurisdiction that may be enacted from time to time; and (vii) any rules or regulations that amend and/or replace any of
the aforementioned Data Protection Laws.
2.3. ”Personal Data“ refers to the definition of that term or any other similar term defined under the Applicable Data Protection Laws.
2.4. “Standard Contractual Clauses or SCCs” shall mean: where the EU GDPR applies, the standard contractual clauses pursuant to the
EU Commission's Implementing Decision 2021/914 of 4 June 2021 currently set out at: https://eur-
lex.europa.eu/eli/dec_impl/2021/914/oj (“EU SCCs”); (ii) where the UK GDPR applies, the EU SCCs together with the UK Information
Commissioner’s Office addendum, under S119A(1) of the Data Protection Act 2018 (“UK Addendum”); or any other Standard
Contractual Clauses which amended and/or replace such Standard Contractual Clauses in accordance with Applicable Data Protection
Law.
3. Processing of Personal Data on behalf of Client.
3.1. Shift acts as a processor/service provider for Client, and performs processing operations on behalf of Client and upon the instructions of
Client as a controller/business, as set forth herein, in the Services Agreement, and any additional agreement entered into between Client
and Shift (collectively, the ”Terms“), pursuant to which Client may provide Personal Data to Shift (“Contracted Business Purpose”).
3.2. Sensitive Data. The Parties agree that the provision of the services under the Agreement is not intended for the processing of Sensitive
Data. For the avoidance of doubt, this DPA will not apply to Sensitive Data and Shift shall have no liability whatsoever for Sensitive
Data, whether in connection with a Personal Data Breach or otherwise.
4. Client Representations.
Client sets forth the details, including the purpose, the means and the ways in which Shift shall process Personal Data, as required by Applicable
Data Protection Laws in Appendix A (Details of Processing of Processed Personal Data), attached hereto, and Client represents and warrants
that:
4.1. It complies with personal data security and other obligations prescribed by Applicable Data Protection Laws for controller/business, and
that the provision of Personal Data to Shift is in strict compliance with Applicable Data Protection Laws;
4.2. It only processes Personal Data that has been collected in accordance with the Applicable Data Protection Laws;
4.3. It has in place procedures in case an individual whose Personal Data is collected, wishes to exercise the individual’s rights in accordance
with the Applicable Data Protection Laws;
4.4. It provides Personal Data to Shift for the Contracted Business Purpose in accordance with the representations Client makes to individuals
in Client's privacy policy, and Client does not sell Personal Data to Shift;
4.5. It shall have the sole responsibility for the accuracy, quality, and legality of such Client’s Personal Data;
4.6. It shall provide Shift as a processor/service provider, or otherwise have Shift (or anyone on its behalf) process such Personal Data which
is explicitly permitted under Applicable Data Protection Laws (“Permitted Personal Data“). Solely Client shall be liable for any data
which is made available to Shift in excess of the Permitted Personal Data (“Non-Permitted Data”). Shift 's obligations under the Terms
shall not apply to any such Non-Permitted Data;
4.7. It is and will remain duly and effectively authorized to give the instruction set out herein and any additional instructions as provided
pursuant to the Terms, at all relevant times and at least for as long as the Terms are in effect and for any additional period during which
Shift is lawfully processing Personal Data.
6
5. Shift Obligations.
5.1. Shift carries out the processing of Personal Data on Client's behalf.
5.2. Pursuant to the provisions of Article 28 of the GDPR, to the extent applicable with respect to each data subject, Shift agrees that it will:
5.2.1. process Personal Data solely on Client's behalf and in compliance with Client's instructions, including instructions in this DPA
and all Terms, unless required to do so by EU or applicable Member State law;
5.2.2. implement appropriate technical and organizational measures to provide an appropriate level of security, including, as appropriate
and applicable, the measures referred to in Article 32(1) of the GDPR;
5.2.3. take reasonable steps to ensure that access to the processed Personal Data is limited on a need to know/access basis, and that all
Shift personnel receiving such access are subject to confidentiality undertakings or professional or statutory obligations of
confidentiality in connection with their access/use of Personal Data;
5.2.4. it shall provide reasonable assistance to Client with any data protection impact assessments or prior consultations with supervising
authorities in relation to processing of Personal Data by the processor/service provider, as required under any Applicable Data
Protection Laws, at the written request of the Client, and at Client's sole expense; and
5.3. Pursuant to the CCPA, to the extent applicable with respect to each data subject, Shift agrees that:
5.3.1. Shift is acting solely as a service provider with respect to Personal Data;
5.3.2. Shift shall not retain, use or disclose Personal Data for any purpose other than for the Contracted Business Purpose;
5.3.3. Shift may de-identify or aggregate Personal Data as part of performing the services specified in the Terms; and
5.3.4. Shift will limit personal information collection, use, retention, and disclosure to activities reasonably necessary and proportionate
to achieve the Contracted Business Purposes or another compatible operational purpose.
6. Sub-Processing.
6.1. Client authorizes Shift to appoint sub-processors in accordance with the provision of the Terms. Any sub-processor used must qualify
as a service provider under the Applicable Data Protection Laws and Shift cannot make any disclosures to a subcontractor that the CCPA
would treat as a sale.
6.2. Shift may continue to use those sub-processors already engaged by Shift as of the date of this DPA. Client acknowledges and agrees
that as of the date of this DPA Shift uses certain sub-processors; a list of such sub-processors is attached hereto in Appendix A.
6.3. Shift may appoint new sub-processors and shall give reasonable notice of the appointment of any new sub-processor. Client's continued
use of the applicable services after such notification constitutes Client's acceptance of the new sub-processor.
7. Data Subjects' Rights.
7.1. Client shall be solely responsible for compliance with any statutory obligations concerning requests to exercise data subject rights under
Applicable Data Protection Laws (e.g., for access, rectification, deletion of processed Personal Data, etc.). Shift shall reasonably
endeavor to assist Client insofar as feasible, to fulfil Client's said obligations with respect to such data subject requests, as applicable, at
Client's sole expense.
7.2. Shift shall (i) without undue delay notify Client if it receives a request from a data subject under any Applicable Data Protection Laws
in respect of processed personal data; and (ii) not respond to that request, except on the written instructions of Client or as required by
Applicable Data Protection Laws, in which case Shift shall, to the extent permitted by Applicable Data Protection Laws, inform Client
of that legal requirement before it responds to the request.
8. Personal Data Breach.
8.1. Shift shall notify Client without undue delay upon Shift becoming aware of any personal data breach within the meaning of Applicable
Data Protection Laws relating to Personal Data of the Client which may require a notification to be made to a supervisory authority or
data subject under Applicable Data Protection Laws “Personal Data Breach”).
8.2. At the written request of the Client and at Client's sole expense, Shift shall provide reasonable co-operation and assistance to Client in
respect of Client's obligations regarding the investigation of any Personal Data Breach and the notification to the supervisory authority
and data subjects in respect of such a Personal Data Breach.
9. Deletion or Return of Processed Personal Data.
9.1. Subject to the terms hereof, Shift shall promptly and in any event within up to sixty (60) days (unless a sooner time period is required
by Applicable Data Protection Laws) return and then destroy the Personal Data, except such copies as authorized including under this
DPA or required to be retained in accordance with Applicable Data Protection Laws.
9.2. Shift may retain Personal Data to the extent authorized or required by Applicable Data Protection Laws, provided that Shift shall ensure
the confidentiality of such Personal Data and shall ensure that it is only processed for such legal purpose(s).
7
9.3. Upon Client's prior written request, Shift shall provide written certification to Client that it has complied with this Section 9.
10. Audit Rights
10.1. Not more than once a year, at the cost of Client, upon reasonable prior notice and mutual coordination, Shift shall allow for audits by a
reputable auditor mandated by the Client in relation to the processing of the Personal Data by Shift , provided that such third-party
auditor shall be subject to confidentiality obligations in favor of Shift . In such an audit Shift shall make available relevant information
reasonably necessary to demonstrate compliance with this DPA.
10.2. Client shall use (and ensure that its mandated auditor uses) its best efforts to avoid causing any damage, injury or disruption in the course
of such an audit.
11. International Data Transfers
11.1. To the extent that Shift transfers Personal Data to countries outside of the European Economic Area and/or outside of the United
Kingdom (UK), which do not provide an adequate level of data protection, as determined by the European Commission pursuant to
Article 45 of GDPR, and by the Secretary of State, pursuant to Section 17A of the United Kingdom Data Protection Act 2018,
respectively, or other adequate authority as determined by the EU and the UK (“Adequacy Decisions”), and to the extent applicable
with respect to each data subject, such transfer of Client’s Personal Data to other countries, where the application of the SCCs is required
under Applicable Data Protection Laws shall be subject to: (i) Adequacy Decisions; (ii) exemptions under Article 49 of the GDPR; or
(iii) the Standard Contractual Clauses are incorporated into this DPA by reference, which shall be implemented as follows:
11.1.1. In the case of transfer of Personal Data between Client to Shift , the parties shall implement Module II - “Controller to Processor”,
of the Standard Contractual Clauses, with modifications detailed under this Section 11.1.1, in which case Shift shall be deemed
as a "Data Importer" and Client shall be deemed as a "Data Exporter". The parties are deemed to have accepted and executed the
SCCs, including the associated Exhibites. The contents of Exhibit I of the SCCs are included within Appendix A to this DPA.
The contents of Exhibit II of the SCCs are included within Appendix B to this DPA. The parties further agree to the following
implementation choices under the SCCs:
11.1.1.1. The Parties agree that for the purpose of transfer of Personal Data between Shift (Data Importer) and the Client (Data
Exporter), the following shall apply:
11.1.1.2. Clause 7: shall not be applicable.
11.1.1.3. Clause 9(a): The parties choose Option 2, “General Written Authorization” and specify a time period of thirty (30) days.
Appendix C shall be updated accordingly.
11.1.1.4. Clause 11: The parties choose not to include the optional language relating to the use of an independent dispute resolution
body.
11.1.1.5. Clause 17: The parties select Option 1 and specify the law of Ireland.
11.1.1.6. Clause 18(b): The parties specify the courts of Ireland.
11.1.2. In the case of transfer of Personal Data between Shift and its Sub-Processors for the purposes of carrying out specific Processing
activities (on behalf of Client) the Partis will enter into Module III (“Processor-to-Processor”) of the Standard Contractual Clauses.
For the purpose of such engagement, Shift shall be deemed as the Data Exporter and the Sub-Processor shall be deemed as the
Data Importer; all other Modules are not applicable.
11.1.3. If the applicable Data Exporter, under Section 11.1.1 or 11.1.2, is transferring Personal Data governed by the UK GDPR, the
parties agree to implement the applicable SCCs, as modified by the UK Addendum. The information required by Table 1 of the
UK Transfer Addendum appears within Appendix A to this DPA. In addition, the parties adopt the SCCs, as modified by the UK
Transfer Addendum, as to applicable international transfers of UK Personal Data in exactly the same manner set forth in Section
11.1 above, subject to the following:
11.1.3.1. Clause 13: The UK Information Commissioner’s Office (“ICO") shall be the competent supervisory authority.
11.1.3.2. Clause 17: The SCCs, as modified by the UK Transfer Addendum, shall be governed by the laws of England and Wales.
11.1.3.3. Clause 18: The parties agree that any dispute arising from the SCCs, as modified by the UK Transfer Addendum, shall be
resolved by the courts of England and Wales. A UK Data Subject may also bring legal proceedings against the Data
Exporter and/or Data Importer before the courts of any country in the UK. The parties agree to submit themselves to the
jurisdiction of such courts.
11.2. Appendixes A, B, and C attached to this DPA shall also apply in connection with the processing of Personal Data, subject to Applicable
Data Protection Law.
11.3. Shift reserves the right to adopt an alternative compliance standard to the SCCs for the lawful transfer of Personal Data, provided it is
recognized under Data Protection Law. Shift will provide 30 days’ advance notice of its adoption of an alternative compliance standard.
8
12. General Terms.
12.1. Governing Law and Jurisdiction. All disputes with respect to this DPA shall be determined in accordance with the governing law
provisions set forth in the Services Agreement.
12.2. Conflict. In the event of any conflict or inconsistency between this DPA and any other agreements between the parties, including
agreements entered into after the date of this DPA, the provisions of this DPA shall prevail.
12.3. Changes in Applicable Data Protection Laws. Client may by at least forty-five (45) calendar days' prior written notice to
processor/service provider, request in writing any changes to this DPA, if they are required, as a result of any change in any Applicable
Data Protection Law, regarding the lawfulness of the processing of Personal Data. If Client provides its modification request, Shift shall
make commercially reasonable efforts to accommodate such modification request, and Client shall not unreasonably withhold or delay
agreement to any consequential changes to this DPA to protect the Shift against any additional risks, and/or to indemnify and compensate
Shift for any further costs associated with the changes made hereunder.
12.4. Severance. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in
force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while
preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or
unenforceable part had never been contained therein.
9
Appendix A
1. The subject matter and duration of the processing of processed personal data are set forth in the Terms.
2. The nature and purpose of the processing of personal data is rendering services, as detailed and defined in the Terms.
3. The types of personal data to be processed (if any) pursuant to the Services Agreement may include: email addresses and names
4. The categories of data subjects to whom the processed personal data relates are as follows:
Customer employees and Customer contractors and vendors.
5. The obligations and rights of Customer are as set forth in the Terms, herein and in the GDPR.
6. Shift ’s sub-processors engaged for the purpose of processing personal data: AWS (US East-1), Microsoft Azure.
10
Appendix B
Technical and Organizational Measures to Ensure the Security of the Data
Shift Maintains SOC2 and ISO 27001 Certifications
11