Snapshot 256668
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Device Type: Skip to Main Content Skip to Main Content Data Processing Addendum Effective date: May 4, 2026 DPA v5 This Data Processing Addendum (“DPA”) is incorporated into the services agreement between the Vonage Group entity with whom the customer (“Customer”) has entered into a services agreement (“Agreement”) and governs the processing of Customer Personal Data in connection with the Services (as defined below) by Vonage. “Vonage” shall mean the Vonage Group entity that is the service provider to Customer under such Agreement. 1. Definitions. All capitalized terms used but not otherwise defined in this DPA shall have the meaning ascribed to such terms in the Agreement. The following definitions and rules of interpretation apply to this DPA: “Applicable Data Protection Law(s)” means all laws, regulations, rules, or other binding instrument applicable to Vonage’s processing of Customer Personal Data under the Agreement, including without limitation the following, in each case as applicable and in force from time to time, and as amended, consolidated, re-enacted or replaced from time to time: (a) the General Data Protection Regulation 2016/679 (the “GDPR”); (b) the Privacy and Electronic Communications Directive 2002/58/EC; (c) the UK Data Protection Act 2018 (“UK Act”), the UK General Data Protection Regulation as defined by the UK Act as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (together with the UK Act, the “UK GDPR”), and the Privacy and Electronic Communications Regulations 2003; (d) the Swiss Federal Act on Data Protection (“FADP”); (e) U.S. state laws including but not limited to the California Consumer Privacy Act, including as amended by the California Privacy Rights Act; and (f) all laws, regulations, rules or other binding instrument applicable in relation to the processing of Customer Personal Data or Telecommunication Network API Data, in each case as applicable and in force from time to time, and as amended, consolidated, re-enacted or replaced from time to time. “Controller,” “processor,” “data subject,” “processing” (and “process”), “business”, “service provider,” or words of similar import have the meanings given in accordance with Applicable Data Protection Law. “Customer Personal Data” means any Personal Data provided by Customer or End User to Vonage in connection with the Services. Customer Personal Data includes: (a) “Customer Account Data” defined as (i) Personal Data that relates to Customer’s relationship with Vonage, including the names, phone numbers, shipping address, payment data, username, password, and/or contact information of individuals authorized by Customer to access Customer’s Vonage account and/or use the Services and billing information; and (ii) in relation to the Network API Services and/or Registration Data; (b) “Customer Content" defined as Personal Data exchanged by use of the Services, such as text, call recording, message bodies, subject lines, conversation transcriptions, voicemail recordings, voicemail transcription, video recording, video files, images and sound, or any Personal Data transmitted by Customer through Network API Services; and (c) “Service Usage Data” defined as Personal Data processed by Vonage for the purposes of: (i) storing, transmitting, or exchanging Customer Content, or (ii) providing the Services, both of which may include data used to trace and identify the source and destination of a communication, such as individual data subjects’ telephone numbers, device type and ID, IP address, data on the location of the device generated in the context of providing the Services, the routing, date, time, duration, type, and other circumstances of communication and data provided by the channels used by the Customer to communicate with their customers. “Data Privacy Framework” means, as relevant, (i) the EU-US Data Privacy Framework as administered by the US Department of Commerce and approved by the European Commission as ensuring an adequate level of protection for Personal Data for the purposes of Article 45 GDPR; (ii) the UK Extension to the EU-US Data Privacy Framework approved by the competent authority of the United Kingdom as ensuring an adequate level of protection for Personal Data for the purposes of Article 45 UK GDPR; and (iii) the Swiss-US Data Privacy Framework approved by the competent authority of Switzerland as providing an adequate level of protection for Personal Data under the FADP. “End User” means individuals or businesses who contact or are contacted by the Customer using the Services, and/or the individual or business whose information the Customer requests for validation by a communication service provider. “Network API Services” means a class of APIs that expose 4G/5G/6G network capabilities from communications service providers to application developers. “Personal Data” or “personal data” means any information relating to an identified or identifiable natural person where an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. “Registration Data” means, to the extent applicable, any Personal Data provided by the Customer to Vonage for the purposes of registering for a Service such as completing the registration for Network API Services, including, but not limited to, name and email address of Customer data protection officer and/or privacy manager. “Security Incident” means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, or as otherwise defined in Applicable Data Protection Law. “Sensitive Personal Data” means Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person's sex life or sexual orientation, or any other data that falls within the definition of “special categories of data”, “sensitive data”, or “protected health information” or other similar definitions under Applicable Data Protection Law. “Services” means all products, services, and platforms provided by Vonage or its affiliates, as applicable, including all updates, modifications, or improvements thereto, that Customer purchases or otherwise uses and includes Network API Services. “Standard Contractual Clauses” or “SCC” means: (a) for the transfer of Customer Personal Data subject to the GDPR, the standard contractual clauses for the transfer of personal data to Third Countries approved by the European Commission in the decision (EU) 2021/914 of 4 June 2021 (“SCCs”); and/or (b) for the transfer of Customer Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022 (“UK International Data Transfer Addendum”); and/or (c) with respect to transfers of Customer Personal Data, subject to the FADP, the SCCs apply with the following amendments: (1) references to a “member state” or to the “EU” will be deemed to include Switzerland, (2) references to the GDPR will be deemed to be references to equivalent provisions of the FADP, (3) Clause 13: the Swiss Federal Data Protection and Information Commissioner will be the sole or, where both the FADP and the GDPR or the UK GDPR apply, one of the competent data protection authorities, and (4) Clause 17: where only the FADP applies to a transfer, the governing law shall be Swiss law, in each case as amended, updated or replaced from time to time. “Sub-processor” means any processor engaged by Vonage for the purpose of providing Services under the Agreement. “Telecommunication Network API Data” means, to the extent applicable, Personal Data sent by a third-party communications service provider through the Network API Services and which may include (but are not limited to) the status/results of such Services and other identifiers. For the avoidance of doubt, Telecommunications Network API Data shall not be considered Customer Personal Data. “Third Country” means (i) in relation to Customer Personal Data transfers subject to the GDPR, any country or territory outside of the scope of the data protection laws of the European Economic Area, excluding countries or territories approved as providing adequate protection for Personal Data by the European Commission from time to time; (ii) in relation to Customer Personal Data transfers subject to the UK GDPR, any country or territory outside of the scope of the data protection laws of the UK, excluding countries or territories approved as providing adequate protection for Personal Data by the relevant competent authority of the UK from time to time; (iii) in relation to Customer Personal Data transfers subject to the FADP, any country or territory outside of Switzerland, excluding countries or territories approved as providing adequate protection for Personal Data by the Swiss Federal Council from time to time; and (iv) in relation to Customer Personal Data transfers subject to any other Applicable Data Protection Laws, any country or territory that is not approved as providing adequate protection for Personal Data by the relevant competent authority or under such Applicable Data Protection Laws. “Vonage Group” means the corporate entities that, from time to time, control, are controlled by, or are under common control of Vonage Holdings Corp. 2. Roles of the Parties when processing Customer personal data 2.1 The parties acknowledge and agree that Vonage is a processor or sub-processor (in each case, acting on behalf of the Customer) when processing Customer Personal Data, except where Vonage processes Customer Personal Data as a controller as set out in the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/ or as otherwise permitted under Applicable Data Protection Law. 2.2 The parties acknowledge and agree that Customer may act as a controller or processor on behalf of its End Users of Customer Personal Data. 3. Vonage as Processor 3.1 The terms of this Section 3 only apply to the extent Vonage processes Customer Personal Data as a processor on behalf of the Customer, as set out in Section 2.1. For the avoidance of doubt, Section 3 shall not apply where Vonage is a controller of Customer Personal Data. 3.2 Scope. Vonage shall process Customer Personal Data, as further set out in Schedule 2: (i) for the performance of the Services in accordance with Customer’s instructions as set forth in the Agreement and this DPA and in accordance with Applicable Data Protection Law, unless required to do so by applicable law to which Vonage is subject; in such a case, Vonage shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (ii) as otherwise necessary to provide the Services; (iii) as requested or directed by Customer through the use of the Services; and (iv) as further instructed by the Customer in writing. 3.3 Customer Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Laws, and that Vonage’s processing of Customer Personal Data, where done in accordance with Customer’s instructions, will not cause Vonage to violate any applicable law or regulation, including Applicable Data Protection Laws. Each party will notify the other party, to the extent permitted by law, if it becomes aware or reasonably believes that Customer’s data processing instructions would violate Applicable Data Protection Law. 3.4 Employee Access and Confidentiality. Vonage will ensure that the employees authorized to access Customer Personal Data are under statutory or contractual confidentiality obligations to protect such data. 3.5 Security measures. Vonage has implemented and will maintain appropriate administrative, technical, and organizational measures (as set out at https://www.vonage.com/legal/technical-organizational-security-practices/ ) to protect Customer Personal Data from a Security Incident, having regard to the state of technological development and the cost of implementing such measures, as well as the nature, scope, context and purposes of processing and the likelihood and severity of harm to the interests of data subjects that may be expected to result from any such Security Incident. 3.6 Security Incident. Upon becoming aware of a Security Incident affecting Customer Personal Data, Vonage will: (a) to the extent permitted by applicable law, notify Customer of such incident without undue delay, such notice to be delivered in accordance with Section 6 of this DPA; (b) to the extent such Security Incident (i) relates to Customer Personal Data processed by Vonage and (ii) is within Vonage’s control, take reasonable remedial steps to address such Security Incident and prevent any further incidents; and (c) provide the Customer with relevant information in its possession, to assist the Customer in meeting its obligations under Applicable Data Protection Laws, including any notification or reporting obligations to relevant regulatory authorities and data subjects concerning such Security Incident. 3.7 Sub-processors list and notification. Customer grants general authorization to Vonage to appoint its affiliates listed at https://www.vonage.com/legal/subprocessors/applicable-ericsson-affiliates/ and the entities listed at https://www.vonage.com/legal/subprocessors/ (together, the “Sub-processors List”) as Sub-processors, subject to this Section 3.7 and to Section 3.8. To receive notification of any proposed changes to the Sub-processors list for Services used by Customer, Customer must subscribe to the Notification Mechanism by completing the form at https://forms.cloud.microsoft/r/mAQVg7S4UW (the “Notification Mechanism”). Customer acknowledges and agrees that notification of changes to the Sub-processors List will be solely made via email to the Customer’s email address provided through the Notification Mechanism. Where commercially feasible, such notice shall be provided at least 30 calendar days’ prior to changes to the Sub-processors List. Customer may object to Vonage’s appointment and/or replacement of a Sub-processor, provided it reasonably demonstrates that appointing the proposed Sub-processor poses a material risk of non-compliance with applicable Data Protection Laws, by notifying Vonage in writing of such objection within ten (10) calendar days (“Customer Notification Period”) of Vonage’s notice of the change to the Sub-processors List. Upon such objection, if Vonage requires use of such Sub-processor to provide the Services, the Parties will negotiate in good faith to achieve a resolution. If the Parties do not achieve a resolution within ten (10) calendar days after Customer has objected to the appointment or replacement of a Sub-processor, either Party is entitled to terminate with immediate effect only the part of the Services which cannot be provided by Vonage without the use of the objected-to Sub-processor. If no objection is received by Vonage from the Customer within the 30 calendar day notification period, Vonage may proceed with the appointment and/or replacement of the Sub-processor. 3.8 Engagement of Sub-processors. Vonage shall engage Sub-processors under written terms which impose data protection obligations on the Sub-processor that are no less onerous than the terms applicable to Vonage under this Section 3. Vonage shall be liable for its Sub-processors’ processing of Customer Personal Data to the same extent that Vonage would be liable if performing those processing activities itself under the terms of this DPA. 3.9 Legal request for Customer Personal Data. (a) If Vonage receives a civil or criminal subpoena, search warrant, or other official and written request (“Request”) that is legally binding from a third party including a public authority (“Requesting Party”) for disclosure of Customer Personal Data that Vonage processes as a processor or sub-processor on behalf of Customer, Vonage will, insofar as legally permissible, redirect the Requesting Party to request the Customer Personal Data directly from Customer. If this is not possible or Vonage has a legal obligation to respond, Vonage will promptly notify Customer, if legally permitted, about the Request to allow Customer to seek a protective order or other appropriate remedy. (b) If the Request is not redirected to the Customer, Vonage will review the Request to determine whether the Request is valid and if Vonage has a legal requirement to disclose Customer Personal Data. (c) In the event Vonage determines that Customer Personal Data must be provided, Vonage will (a) ensure that the disclosed Customer Personal Data is the minimum required to satisfy the Request; and (b) take all commercially reasonable steps to ensure that such Customer Personal Data is afforded confidential treatment by the authorities. 3.10 Assistance. To the extent required by Applicable Data Protection Law, Vonage shall provide reasonable assistance to Customer (taking into account the nature of processing and the information available to Vonage) at Customer's expense with respect to any mandatory data protection impact assessments or consultations with supervisory authorities that may be required as a result of processing Customer Personal Data. 3.11 Data subject rights. As part of certain Services, and subject to provisions under Section 3.13, Vonage may provide Customer with self-service features to delete, retrieve or restrict use of Customer Personal Data, which the Customer may use to comply with its obligations under Applicable Data Protection Law with respect to responding to requests from data subjects to exercise their rights under such laws. Upon request and to the extent not available to Customer through self-service features, Vonage will provide reasonable additional and timely assistance to assist Customer in complying with its data protection obligations to respond to requests by data subjects to exercise their rights under Applicable Data Protection Law. In the event an End User or other type of data subject makes a request to Vonage to exercise such rights, Vonage will redirect the data subject to Customer. 3.12 Audit. Upon Customer’s written request, no more than once per year, except where a confirmed Security Incident has occurred, from the Effective Date of this DPA and subject to adequate confidentiality provisions, Vonage shall, in accordance with Applicable Data Protection Laws, make available to Customer such reasonable information in Vonage’s possession or control to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Law (“Audit”). The Customer may conduct an additional Audit where reasonably required in response to a Security Incident or regulatory request. Audits shall be at the Customer’s expense, unless the Audit indicates that Vonage is not compliant with this DPA which the parties agree materially affects the processing of Customer Personal Data, in which case Vonage shall bear its own reasonable costs of the Audit. 3.13 Deletion of Customer Personal Data. Upon Customer’s written request, Vonage will promptly arrange for the deletion or return of Customer Personal Data on expiry or termination of the Agreement, unless otherwise agreed by the parties in writing. Notwithstanding anything to the contrary in this Section 3.13, Vonage may retain Customer Personal Data or any portion of it if required by applicable law or government authority, in which case, Vonage shall comply with such applicable law regarding the deletion and retention of such data. 4. Further Provisions Regarding Communications Sent Through the Services and Payment Gateways 4.1 Customer acknowledges that Vonage uses communication service providers, aggregators and payment gateway suppliers to provide the Services. In particular, Customer acknowledges and instructs Vonage to use payment gateways and to transmit Customer’s communications (which may contain Customer Personal Data) through communications networks and suppliers via third parties who may not have contracts with Vonage and/or Customer, in order to provide the Services. 5. Data Transfer 5.1 To the extent the parties’ processing of Customer Personal Data or Telecommunication Network API Data pursuant to this DPA or the Agreement, involves the transfer of such data to a Third Country, each party shall ensure that an adequate data transfer mechanism is put in place for their respective transfer, in accordance with Applicable Data Protection Laws and, to the extent applicable, as further set out in Schedule 3. 6. Notification 6.1 All notices given by Vonage to Customer in connection with this DPA shall be validly served by email. Except in relation to notices of changes to the Sub-Processor List, which shall be sent to the email address provided by the Customer through the Notification Mechanism as per Section 3.7 above, all other notices given by Vonage to Customer shall be sent to Customer’s email address associated with their Vonage account or as stated on the last Service order executed by Customer; and any notice given by Customer to Vonage with regard to this DPA or relating to Customer Personal Data or Telecommunication Network API Data shall be sent to privacy@vonage.com. 7. Miscellaneous 7.1 General Compliance. Each party shall comply with its respective obligations under Applicable Data Protection Law in connection with the processing of Customer Personal Data and Telecommunication Network API Data pursuant to the Agreement and this DPA. 7.2 Customer Compliance. Customer represents and warrants that it has provided all required notices and obtained all necessary rights, consents, and authorisations under Applicable Data Protection Law to enable Vonage to process Customer Personal Data in accordance with the Agreement, this DPA, and the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/, and shall maintain such notices and authorisations throughout the term. Where Customer acts as a processor on behalf of an End User in relation to Customer Personal Data, Customer shall procure that such End User provides equivalent notices and authorisations to enable Vonage to process Customer Personal Data in accordance with the Agreement, this DPA, and the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/. 7.3 Network API Services. To the extent the Customer uses Network API Services, the Customer shall, in addition to the terms of this DPA, comply with the provisions set out in Schedule 1 of this DPA. 7.4 Data Anonymization and Aggregation. Vonage may take steps to anonymize and/or aggregate Customer Personal Data such that it does not constitute Personal Data under Applicable Data Protection Law. Such anonymized and/or aggregated data will not be subject to this DPA. 7.5 Governing Law and Jurisdiction. This DPA shall be governed by and construed in accordance with the law and the jurisdiction of the country or territory which governs the Agreement, except as otherwise specified in this DPA, including its Schedules, or required by Applicable Data Protection Law. 7.6 Jurisdiction Specific Terms. To the extent Vonage processes Customer Personal Data protected by Applicable Data Protection Laws in a jurisdiction listed in Schedule 4, then the terms specified in Schedule 4 (“Jurisdiction Specific Terms”) apply in addition to the terms set out in this DPA and in case of any conflict between the Jurisdiction Specific Terms and any term of this DPA, the applicable Jurisdiction Specific Terms will take precedence. 7.7 Updates. Vonage may update the terms of this DPA from time to time and shall provide reasonable, and no less than 30 calendar days’, notice prior to making any material change to the provisions of this DPA. Updates will take effect on the date specified in any notice issued by Vonage, or otherwise from the date on which the updated version of this DPA is made available to the Customer. 7.8 Relationship with the Agreement. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Agreement, the terms of this DPA shall prevail solely with respect to the subject matter of this DPA. Schedule 1 ADDITIONAL TERMS APPLICABLE TO THE USE OF NETWORK API SERVICES 1. Customer Compliance Where the Customer uses Network API Services, the Customer warrants and ensures that: (a) it provides transparency information to its customers and End Users to fulfil the requirements of Applicable Data Protection Law, including providing adequate notice of Vonage’s and communication service provider’s (“CSP”) processing activities for which Vonage and/or CSPs act as a controller when providing the Network API Services; (b) it complies with Applicable Data Protection Laws and has, and will continue to have, consent (where required) and/or a lawful basis under applicable laws in order to process the data, and the right to transfer, process, or provide access to, its customers’ Personal Data and End Users’ Personal Data (including Sensitive Personal Data) to Vonage, its partners, vendors and the CSP for processing in accordance with the terms of the Agreement and this DPA, including to receive and transmit Personal Data to and from CSPs as specified under Section 2 of this Schedule 1; (c) where it relies on consent from End Users as its lawful basis for data processing including for data sharing, it (i) has procured all such necessary consents from End Users before sharing their Personal Data with Vonage; (ii) records, retains and maintains such consents; and (iii) complies with the additional instructions for obtaining consent as may be set out in the Agreement or related Service schedules, as updated from time to time; (d) any Registration Data provided to Vonage is accurate and complete; (e) it only uses the Telecommunication Network API Data to (i) receive the Network API Services and in conformity with the purpose and scope as approved by the relevant CSP; (ii) not process, disclose or store Telecommunication Network API Data (or any aggregations, summaries or data derived thereof) for any other purpose; and (iii) retain the Telecommunication Network API Data only for as long as necessary for this purpose, subject to any statutory or mandatory retention periods; (f) it will comply with its mandatory requirements under Applicable Data Protection Laws, including fulfilling any data subject rights requests that Customer receives regarding its processing activities as a controller (or equivalent in Applicable Data Protection Laws) within the mandatory time periods under Applicable Data Protection Laws, and having in place the necessary technical and organizational measures to fulfil such requests; (g) it shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk when processing Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of processing; and (h) provide information, documents, assistance and cooperation to Vonage, its partners and/or CSP, without undue delay upon reasonable request from Vonage, its partners and/or CSP, to fulfil the CSP’s obligations under Applicable Data Protection Laws, with regards to: (i) substantiating compliance with the provisions contained in this Schedule 1, and validating Customer’s compliance with Section 1(e) of this Schedule 1 and conformity of their use with the CSP-approved purpose and scope, in response to CSP inquiries via Vonage and/or its partners; (ii) responding to queries, complaints or requests from a data subject or authorities within the time limits imposed by Applicable Data Protection Law; and (iii) supporting Vonage and/or CSPs, in responding to data subject rights requests Vonage and/or CSP receives from data subjects regarding the processing of their Personal Data in accordance with Applicable Data Protection Laws; (i) notify Vonage of any suspected Security Incidents or other security risks involving Telecommunication Network API Data without undue delay and prior to any notification made to the appropriate supervisory authorities and complies with its legal obligations to report Security Incidents to the appropriate supervisory authorities and (where applicable) data subjects in accordance with and within the time limits imposed by Applicable Data Protection Laws; (j) it does not combine Personal Data (including Telecommunication Network API Data) received from Vonage or a CSP with internal or external information or Personal Data, unless required to use the Network API Services; (k) it does not use the Personal Data (including Telecommunication Network API Data) received from Vonage or a CSP in combination with technologies or processing in such a way that Customer could access or store information in or from an end user’s terminal equipment; (l) it does not share, or make available any Personal Data (including Telecommunication Network API Data) received from Vonage or a CSP with third parties, except those processors of Customer who need to process such Personal Data and subject to the Applicable Data Protection Laws; (m) it does not process Personal Data (including Telecommunication Network API Data) in such a way that would result in Vonage, its partners, or a CSP becoming a joint controller with Customer or its affiliates, aggregators or resellers of the Network API Services; (n) it does not use Network API Service and Telecommunication Network API Data for profiling the End Users nor to take decisions based solely on automated processing which produces legal effects, or similarly significant effects, concerning the End User or third parties, as set out in the Applicable Data Protection Laws; (o) it will ensure compliance for international transfer of Personal Data (including Telecommunication Network API Data) received from Vonage or a CSP to the extent required under Applicable Data Protection Laws, including where necessary, entering into appropriate SCCs or rely on other approved transfer mechanism with the recipient of the such Personal Data, as further set out, to the extent applicable, in Schedule 3; (p) it will comply with any additional privacy or security requirements imposed on it by Vonage, its partners and/or CSP in relation to the use of the Network API Services; and (q) it will, upon Vonage’s written request, subject to adequate confidentiality provisions, make available to Vonage such reasonable information in Customer’s possession or control to demonstrate compliance with its obligations under this Section. 2. Communications sent through the Network API Services Customer acknowledges that Vonage may use CSPs to provide the Network API Services. In particular, Customer acknowledges that: (a) Customer instructs Vonage to transmit certain Customer Personal Data to CSPs for the sole purpose of providing and maintaining the requested Network API Services to Customer, with such CSP receiving this data as an independent controller; and (b) Customer shall receive Telecommunication Network API Data from the CSP via Vonage (acting as a processor for the CSP) and Customer shall receive this data as an independent controller and shall only use such Telecommunication Network API Data to receive Network API Services. Schedule 2 Processing Details / Description of Transfer 1. Nature and Purpose of Processing / Transfer Vonage will process Customer Personal Data for the purposes set out in Section 2 of this DPA. Customer will process Telecommunication Network API Data as set out in Schedule 1. 2. Duration of Processing / Transfer 2.1 Vonage as processor. Vonage will process Customer Personal Data as a processor for the duration of the Agreement outlined in Section 3.13 of this DPA. 2.2 Vonage as controller. Vonage will process Customer Personal Data as a controller for as long as needed to fulfill the purposes for which the data was collected. Upon termination of the Agreement, Vonage may retain such Customer Personal Data (a) for the purposes set out in the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/; or (b) as required by law. Vonage will promptly delete or anonymize such Customer Personal Data when Vonage no longer requires it for the purposes set out in the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/ or as required by applicable law. 2.3 Customer as controller. Customer will process Telecommunication Network API Data as a controller as provided for in Schedule 1. 3. Frequency of transfer Customer Personal Data and Telecommunication Network API Data will be transferred continuously. 4. Categories of Personal Data processed/transferred 4.1 Vonage processes Customer Personal Data as defined in Section 1 of this DPA. 4.2 Customer processes Telecommunication Network API Data as defined in Section 1 of this DPA. 5. Categories of Data Subjects whose personal data is processed/transferred 5.1 Customer Personal Data. Customer Personal Data may concern the following categories of data subjects: (a) Customer’s employees and agents; (b) Customer’s authorized users; and (c) Customers and End Users. 5.2 Telecommunication Network API Data. Telecommunication Network API Data may concern the following categories of data subjects: (a) Customers and End Users. Schedule 3 Data Transfers 1. Scope. This Schedule applies to the extent Customer Personal Data and/or Telecommunication Network API data subject to the GDPR, UK GDPR or FADP is transferred and processed by the parties in a Third Country, pursuant to the provision of the Services. 2. Data Privacy Framework. Subject to Section 3 of this Schedule 3, to the extent Vonage processes Customer Personal Data in the United States, such Customer Personal Data shall, to the extent possible, be transferred to the United States pursuant to the Data Privacy Framework, and Vonage confirms that it has all relevant, valid and current Data Privacy Framework certifications which apply to such processing. Vonage shall comply with its obligations under the Data Privacy Framework and its relevant certification, and shall maintain and keep such certification effective and valid for the duration of this DPA. 3. Standard Contractual Clauses. This Schedule 3 applies to the extent (i) the Data Privacy Framework is invalidated; (ii) Vonage no longer holds a valid Data Privacy Framework certification; or (iii) the transfer of Customer Personal Data is not subject to the Data Privacy Framework (including if the transfer is to a Third Country other than the United States). 3.1 Transfer of Customer Personal Data to Vonage - Standard Contractual Clauses. To the extent Vonage processes Customer Personal Data in a Third Country, the following Modules of the SCCs shall apply, depending on the respective roles of the parties as set out in Section 2 of the DPA: (a) Module One (Controller to Controller) of the SCCs, where Customer is a controller and Vonage is an independent controller; (b) Module Two (Controller to Processor) of the SCCs, where Customer is a controller and Vonage is a processor; and/or (c) Module Three (Processor to Processor) of the SCCs, where Customer is a processor and Vonage is a sub-processor. 3.2 Transfer of Telecommunication Network API Data to Customer - Standard Contractual Clauses. To the extent Customer processes Telecommunication Network API Data in a Third Country, the following Module of the SCCs shall apply: (a) Module Four (Processor to Controller) of the SCCs apply where Vonage is a processor and Customer is a controller. 3.3 Where the SCCs apply, Vonage and Customer shall comply with their respective obligations under the SCCs as exporter and/or importer and the above SCCs are hereby incorporated into and form part of this DPA and completed in accordance with Section 3.6 of this Schedule 3. 3.4 If agreed between the parties, the parties shall take such alternative or additional steps required in order to ensure that any transfers or processing of Customer Personal Data and Telecommunication Network API Data takes place in accordance with the requirements of Applicable Data Protection Laws. 3.5 In the event of any conflict or inconsistency between the SCCs and the terms of this DPA, the SCCs shall prevail. 3.6 The Parties agree that the SCCs are completed as follows: (a) if applicable, for the purposes of: (i) Clause 7 of the SCCs - the optional docking clause will not apply; (ii) Clause 9 of the SCCs - Option 2 will apply and the time period for prior notice of sub-processor changes will be as set forth in Section 3.7 of this DPA; (iii) Clause 11 (a) of the SCCs - the optional language will not apply; (iv) Clause 13 and Annex I.C of the SCCs – the competent supervisory authority shall be the Dutch Data Protection Authority; (v) Clause 17 of the SCCs - Option 1 will apply and the Clauses will be governed by the law of the Netherlands; (vi) Clause 18 of the SCCs - disputes will be resolved before the courts of the Netherlands; and (v) Part 1 of the UK International Data Transfer Addendum, both parties may terminate the UK International Data Transfer Addendum pursuant to Section 19 of the UK International Data Transfer Addendum; (b) for the purposes of Annex I.A or Part 1 (as relevant) of the SCCs: (i) in relation to the transfer of Customer Personal Data, the Data Exporter is the Customer and the Data Importer is Vonage; (ii) in relation to the transfers of Telecommunication Network API Data, the Data Exporter is Vonage and the Data Importer is the Customer; and (iii) the name, address, registration number, contact person’s details, relevant activities, and role for each of them is as set out in this DPA, and the Start Date is the Effective Date of this DPA; (c) if applicable, for the purposes of Part 1 of such SCCs, the relevant Addendum SCCs (as such term is defined in the applicable SCCs) are the standard contractual clauses for the transfer of Personal Data to Third Countries set out in Commission Decision 2021/914 of 4 June 2021 as incorporated into this DPA by virtue of this Section 3.6; (d) for the purposes of Annex I.B or Part 1 (as relevant) of such SCCs, the details of transfer are as set out in Schedule 2 of this DPA; and (e) for the purposes of Annex II or Part 1 (as relevant) of such SCCs, the security measures set out in Section 3.5 of this DPA and Section 1(g) of Schedule 1 shall apply respectively, and the data importer may update its security document from time to time provided that there is no degradation to the security and/or privacy of the services. Schedule 4 JURISDICTION SPECIFIC TERMS 1. General (a) To the extent applicable telecommunication law or other applicable law consider Vonage to be a telecommunication services provider for certain Services and such law sets forth specific rights and obligations in relation to Vonage’s provision of the respective Services, the terms relating to Vonage in its capacity as a processor, as set out in this DPA, will not apply. (b) To the extent paragraph 1(a) of this Schedule 4 applies, Section 7.2 of the DPA shall be replaced entirely with the following provision: “Customer Compliance. Customer warrants and represents that it has provided all notices and has obtained, and shall maintain throughout the term of this DPA, all necessary rights, consents, and authorizations required under Applicable Data Protection Law, including documented consent (where required), a documented waiver of the secrecy of telecommunications, and a valid legal basis under applicable laws, to transfer, process, or provide access to Customer Personal Data, its customers' Personal Data, and End Users' Personal Data (including, where applicable, Sensitive Personal Data), as well as traffic data, location data, and communication content, to Vonage for processing in accordance with the terms of the Agreement, this DPA and the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/ and shall maintain such notices and authorisations throughout the term. Where Customer acts as a processor on behalf of an End User in relation to Customer Personal Data, Customer shall procure that such End User provides equivalent notices and authorisations to enable Vonage to process Customer Personal Data in accordance with the Agreement, this DPA, and the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/.” 2. United States: 2.1 California: (a) The definition of “Applicable Data Protection Law” includes the California Consumer Privacy Act (CCPA), including as amended by the California Privacy Rights Act (CPRA) (collectively “CCPA”). (b) The definition of “Personal Data” includes “Personal Information” as defined under the CCPA. (c) The definition of “data subject” includes “Consumer” as defined under Applicable Data Protection Law. (d) The definition of “controller” includes “Business” as defined under Applicable Data Protection Law. (e) The definition of “processor” includes “service provider” as defined under Applicable Data Protection Law. (f) The following provisions apply where Vonage processes Customer Personal Data on behalf of Customer as a service provider: (i) Vonage will: (i) process, retain, use, and disclose Customer Personal Data for the limited and specific purposes described in Section 3.1 and Section 3.2 of this DPA, and at all times in compliance with this DPA and Applicable Data Protection Law; (ii) provide the same level of privacy protection as is required by Applicable Data Protection Law; and (iii) notify Customer without undue delay if Vonage makes a determination that it can no longer meet its obligations under this DPA or Applicable Data Protection Law. (ii) Vonage agrees not to: (i) “sell” or “share” (as those terms are defined under the CCPA) Customer Personal Data; (ii) retain, use, or disclose Customer Personal Data for any commercial purpose other than providing the Services; or (iii) retain, use, or disclose Customer Personal Data outside of the scope of the Agreement. (iii) Vonage shall not combine Customer Personal Data that it receives from Customer, or on behalf of Customer, with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with a consumer, provided that Vonage may combine Customer Personal Data to perform any business purpose as defined in the regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, of the CCPA except as provided for in paragraph (6) of subdivision (e) of the CCPA and in regulations adopted by the California Privacy Protection Agency. (iv) Upon notice, including if Vonage notifies the Customer that it can no longer meet its obligations under the CCPA or this DPA, Customer will have the right to take reasonable and appropriate steps in accordance with the Agreement to stop and remediate unauthorized use of Customer Personal Data. (g) The following provisions apply where Vonage processes Customer Personal Data received from Customer for one of the purposes set forth in the Privacy Notice, where each Party acts as a Business: (i) Where such sharing of Customer Personal Data constitutes a “sale” or “share” (as such terms are defined under the CCPA), Customer will provide End Users with the opportunity to opt-out of such sharing in compliance with the CCPA or otherwise ensure that a relevant exception to “sale” or “share” applies. (h) Where such sharing constitutes a “sale” or “share” and no exception to “sale” or “share” applies, Vonage will: (i) Only use Customer Personal Data for the specific and limited purpose of providing or facilitating the provision of the Services, comply with applicable obligations under the CCPA and provide the same level of privacy protection as is required of businesses by the CCPA, and notify Customer without undue delay if Vonage makes a determination that it can no longer meet its obligations under the CCPA; and (ii) Grant Customer the right to (i) take reasonable and appropriate steps to help ensure that Vonage uses Customer Personal Data in a manner consistent with Customer’s obligations under the CCPA, and (ii) upon reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of the Customer Personal Data. 2.2 Other US States (a) The definition of “Applicable Data Protection Law” includes, as applicable and in force from time to time, the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Data Privacy Act, New Jersey Data Privacy Law, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act, and any similar law of any other state related to the processing of Customer Personal Data. (b) The definition of “data subject” includes “Consumer” as defined under Applicable Data Protection Law. (c) The following provisions apply where Vonage processes Customer Personal Data received from Customer for one of the purposes set forth in the Vonage Privacy Notice at https://www.vonage.com/legal/privacy-policy/, where each Party acts as a controller: Where such sharing of Customer Personal Data constitutes a “sale” (as such term is defined under Applicable Data Protection Law), Customer will provide End Users with the opportunity to opt-out of such sharing in compliance with Applicable Data Protection Law or otherwise ensure that a relevant exception to “sale” applies. Wed Nov 11 2026 17:53:33 GMT+0000 (Coordinated Universal Time)