Snapshot 4190
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Data Processing Agreement Between Intermedia and Service Provider This Data Processing Agreement, including its Schedules and Exhibits (collectively, this “Agreement”), forms part of the service agreement (the “Principal Agreement”) between the service provider identified as “Service Provider” on the signature page hereof (“Service Provider”) and Intermedia.net, Inc. (collectively, with its affiliates, subsidiaries and branches, “Intermedia”). This Agreement regulates the Processing of Personal Data of Data Subjects subject to Data Protection Law for the Purposes (as defined in Exhibit C to Schedule 1) by the parties in the context of the Services. The terms used in this Agreement have the meaning set forth in this Agreement. Capitalized terms not otherwise defined herein have the meaning given to them in the Principal Agreement. Except as modified below, the terms of the Principal Agreement remain in full force and effect. The Schedules and Exhibits to this Agreement form an integral part of this Agreement. The Agreement contains the following sub-sections, Schedules and Exhibits set forth below: Data Protection Terms: Section 1: Definitions Section 2: Roles of the Parties Section 3: Compliance with Data Protection Law Section 4: Service Provider’s Obligations Section 5: Security of the Processing, Confidentiality, and Personal Data Breach Notification Section 6: International Data Transfers Section 7: Service Provider’s Sub-Processing Section 8: Data Protection and Security Audit Section 9: Liability Towards Data Subject Section 10: Applicable Law and Jurisdiction Section 11: List of Schedules Section 12: Modification of this Agreement Section 13: Termination Section 14: Invalidity and Severability Schedule 1: EEA Region Specific Terms: Exhibit A: Standard Contractual Clauses (“SCCs”) Exhibit B: Annex I(A) to SCCs (List of Parties) Exhibit C: Annex I(B) to SCCs (Description of Transfer) Exhibit D: Annex I(C) to SCCs (Competent Supervisory Authority) Exhibit E: Annex II to SCCs (Technical and Organizational Measures) Exhibit F: Annex III to SCCs (List of Sub-Processors) Schedule 2: California Consumer Privacy Act (“CCPA”) Specific Terms Schedule 3: United Kingdom Specific Terms How to Execute this Agreement. This Agreement, as incorporated by reference into the Principal Agreement between Intermedia and the Service Provider, is legally binding and automatically applies to the Service Provider; provided, however, to the extent that the Service Provider requires an executed version of the Agreement for statutory purposes, the Service Provider may submit a separate request to Intermedia to electronically sign this Agreement in a manner provided by Intermedia (which may be in the form of an invitation sent by Intermedia or a link to an electronically executable version of this Agreement made available by Intermedia). Definitions. The following terms have the meanings set out below for this Agreement: “CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, as amended by the California Privacy Rights Act, and as may be otherwise amended or superseded from time to time. “Confidential Data” means all data provided to Service Provider by Intermedia or Intermedia’s customers pursuant to the terms set forth in the Principal Agreement. “Controller” means the entity which determines the purposes and means of the Processing of Personal Data as defined by applicable Data Protection Law. “Data Protection Law” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including without limitation the laws and regulations of the European Union, the EEA and their member states, Switzerland, the United Kingdom, Canada, Australia, Japan, and the United States and its states, as they each may be amended from time to time. “Data Subject” means the identified or identifiable person to whom Personal Data relates. “EEA” means the European Economic Area. “Europe” means the EEA, the United Kingdom and Switzerland. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as it may be amended from time to time. “International Data Transfer” means any transfer of Personal Data from a country whose laws restrict international data transfers (the “Transferring Country”) to an international organization or to a country outside of the Transferring Country (the “Receiving Country”), and includes any onward transfer of Personal Data from the international organization or the Receiving Country to another international organization or to another country outside of the Receiving Country. “Personal Data” means any information relating to an identified or identifiable natural person. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, misuse, or unauthorized disclosure of, access, collection, retention, storage, or transfer of Personal Data while processed by Service Provider or its Sub-Processor(s). “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Processor” means the entity which Processes Personal Data on behalf of the Controller. “Standard Contractual Clauses” or “SCCs” mean the standard data protection clauses adopted by the European Commission for personal data transfer between controllers or processors in the EEA and controllers or processors outside the EEA. Standard contractual clauses adopted by the European Commission are a transfer tool under the GDPR, as per Article 46(2)(c) and (5) of GDPR. “Sub-Processor” means the entity engaged by the Processor or any further sub-contractor to Process Personal Data on behalf of and under the instructions of the Controller. “Supervisory Authority” means an independent public authority which is established by a government agency pursuant to a Data Protection Law for the purposes of supervising, auditing and/or enforcing the protections to Personal Data provided by the applicable Data Protection Law. “UK Standard Contractual Clauses” means International Data Transfer Addendum to the European Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office under S119A(1) Data Protection Act 2018. Roles of the Parties. In the context of the Agreement, the parties agree that: Intermedia acts as Controller, or as Processor (or Sub-Processor) acting on behalf, directly or indirectly, of customers of Intermedia’s Services, who act as Controllers. Intermedia appoints Service Provider as (a) Processor acting on behalf of Intermedia, or as (b) Sub-Processor acting on behalf of Intermedia’s customers (with respect to clause (b), for the Processing of Personal Data of customers of Intermedia’s Services), in either case for the purpose of providing the Services specified in the Principal Agreement. In that context, Intermedia, as Controller, or Processor (or Sub-Processor) acting on behalf of its customers, has the sole and exclusive authority to provide instructions to Service Provider regarding the Processing of Personal Data for the Purposes. Service Provider will Process Personal Data only on behalf of and for the benefit of Intermedia, or of Intermedia’s customers, and only to carry out its obligations under the Principal Agreement and Intermedia’s written instructions. Service Provider shall not share, transfer, transmit, disclose or otherwise provide access to or make available any Personal Data to any third party unless Intermedia has authorized Service Provider to do so in writing. Compliance with Data Protection Law. Service Provider shall comply with Data Protection Law when Processing Personal Data in the context of the Services. Service Provider’s Obligations. Service Provider agrees and warrants that it will: Notify Intermedia when any law or legal requirement prevents Service Provider (i) from fulfilling its obligations under this Agreement or Data Protection Law, or (ii) from complying with the instructions received from Intermedia. In both situations, Intermedia is entitled to suspend the Processing of Personal Data by Service Provider, and to terminate any further Personal Data Processing and this Agreement, if doing so is required to comply with Data Protection Law or with Intermedia’s customers’ instructions. Ensure that any Personal Data received hereunder is Processed in accordance with the terms of this Agreement. Further, Service Provider agrees and warrants that the categories of Data Subjects and Personal Data, nature and purpose of Processing, and period for which the Personal Data will be retained, as specified in Exhibit C to Schedule 1 to this Agreement (Description of Data Processing), are true, complete and accurate. Maintain Records of Processing Activities of all Processing conducted on Intermedia’s or on Intermedia’s customers’ behalf, which shall include at a minimum the categories of information required under Data Protection Law, and provide them to Intermedia upon request. Immediately and in writing inform Intermedia of the following, as long as it relates to any Personal Data Processed in the context of the Services: (i) any Data Subjects’ requests in relation to the Processing of their Personal Data, including requests relating to their rights of (a) access, (b) rectification, (c) erasure, (d) data portability, (e) restriction of Processing, (f) objection to the Processing, and (g) the rights related to automated decision making and profiling, each such request referenced in Section 4.4(i) herein, being a “Data Subject Request”; (ii) any request or complaint received from Intermedia’s customers, consumers, employees or from any other individual; (iii) any question, complaint, investigation or other inquiry from Supervisory Authorities; and (iv) any public authority requesting disclosure of or information about the Personal Data that are Processed by Service Provider. Service Provider agrees and warrants that it will provide a copy of any such request within 48 hours to Intermedia and that it will respond to such requests only with Intermedia’s prior written authorization and in accordance with Intermedia’s prior written instructions. Cooperate with Intermedia, at Service Provider’s expense, to comply with Data Protection Law, this Agreement, and Intermedia’s customers’ instructions when Intermedia acts as Processor, and will assist Intermedia to fulfill its own obligations under Data Protection Law and as applicable Intermedia’s customer’s instructions, including complying with Data Subject Requests to exercise their rights, replying to complaints from Data Subjects, replying to investigations and inquiries from Supervisory Authorities, and conducting data protection impact assessments and prior consultations with Supervisory Authorities in accordance with Data Protection Law. Dispose of the Personal Data obtained by Service Provider in connection with the Services using a method that prevents any recovery of the data in accordance with industry best practices when it is no longer required for the purpose of the Principal Agreement or upon termination of the Principal Agreement, whichever occurs earlier. Upon Intermedia’s request to delete or return Personal Data, Service Provider shall comply with Intermedia’s request, and delete existing copies, with proof of such destruction, within thirty (30) days unless Data Protection Law or other applicable law requires storage of the Personal Data (in which case Service Provider will protect the confidentiality of the Personal Data, will segregate such stored data from other customer data to the extent practicable, and will continue to comply with this Agreement). Security of the Processing, Confidentiality, and Personal Data Breach Notification. Service Provider agrees and warrants that: It has implemented and maintains a comprehensive written information security program that complies with Data Protection Law and Exhibit E to Schedule 1 of this Agreement, including appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which includes at the minimum the security measures listed in Exhibit E to Schedule 1 hereof and as appropriate: (a) the pseudonymization (or anonymization) and/or encryption of Personal Data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services; (c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing. In assessing the appropriate level of security, Service Provider must take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects and the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise Processed. Service Provider’s information security program must, among other things, include regular testing or otherwise monitoring of the effectiveness of Service Provider’s information safeguards. Service Provider undertakes to notify Intermedia of any technical, operational, organizational or other change having a material impact on the security, confidentiality or protection of Personal Data, no less than 15 working days prior to implementing any such change. Service Provider agrees to submit its information security program in the context of a Data Protection and Security Audit provided under Section 8. Service Provider shall (a) treat Personal Data and Confidential Data as confidential and (b) require screening of its personnel who may have access to Personal Data and shall require such personnel (i) to Process Personal Data in accordance Intermedia’s instructions as set forth in this Agreement, (ii) to receive appropriate training on their responsibilities regarding the handling and safeguarding of Personal Data; and (iii) to be subject to duly enforceable contractual or statutory confidentiality obligation. Service Provider will inform Intermedia in writing, without undue delay, and no later than 48 hours after having become aware of a Personal Data Breach. Service Provider will assist Intermedia in complying with Intermedia’s own obligations or with Intermedia’s customers’ obligations under Data Protection Law to notify a Personal Data Breach. Service Provider must document all Personal Data Breaches, including the facts relating to the Personal Data Breach, its effects and the remedial actions taken. Service Provider must promptly take all necessary corrective actions (at its sole cost and expense), and must cooperate fully with Intermedia, acting as a Controller or a Processor on behalf of its customers, in all reasonable and lawful efforts to mitigate the effects of the Personal Data Breach. Except to the extent prohibited by applicable legal, regulatory or law enforcement requirements, Service Provider must obtain the approval of Intermedia prior to the publication or communication of any filings, communications, notices, press releases or reports related to any Personal Data Breach that expressly mention Intermedia or its affiliates. Service Provider acknowledges and agrees that a violation of this clause, or the occurrence of any Personal Data Breach, may cause immediate and irreparable harm to Intermedia for which money damages may not constitute an adequate remedy. Therefore, Service Provider agrees that Intermedia may seek injunctive or other equitable relief for any such violation or incident, in addition to its remedies at law, without proof of actual damages. International Data Transfers. Where Service Provider Processes Personal Data from the EEA on behalf of Intermedia, such International Data Transfers shall be made pursuant to Schedule 1 to this Agreement. For any country outside of the EEA, Service Provider shall not transfer Personal Data from any such country without Intermedia’s prior written consent unless permitted under Data Protection Laws. Service Provider’s Sub-Processing. Intermedia authorizes Service Provider to sub-contract its Personal Data Processing operations performed on behalf of Intermedia under this Agreement to a Sub-Processor. Service Provider shall provide Intermedia with a list of Sub-Processors upon execution of this Agreement. Service Provider will notify Intermedia prior to any changes to the list of Sub-Processors and provide Intermedia with an updated list at any time upon request. Intermedia is entitled to object to the addition or replacement of Sub-Processors within sixty (60) days. If Intermedia does not object within such period, the respective Sub-Processor may Process Intermedia’s Personal Data. If Intermedia objects to the addition of a Sub-Processor and Service Provider cannot reasonably accommodate Intermedia’s objection, Service Provider will notify Intermedia. Intermedia may terminate the affected services, the Principal Agreement and/or this Agreement by providing Service Provider with a written notice within one month of Service Provider’s notice. Service Provider will refund a prorated portion of any pre-paid charges for the period after such termination date. Where Service Provider sub-contracts any of its Processing of Personal Data under this Agreement, it must only do so by way of a written agreement with the Sub-Processor which imposes the same or substantially similar obligations on the Sub-Processor as are imposed on Service Provider under this Agreement. Prior to any Sub-Processing, Service Provider must carry out adequate due diligence to ensure that the Sub-Processor is capable of complying with the same obligations as are imposed on Service Provider under this Agreement. Notwithstanding Service Provider’s sub-contracting of any of its Processing of Personal Data under this Agreement, Service Provider will remain fully liable towards Intermedia for the performance of the Sub-Processor's obligations under such Agreement. Data Protection and Security Audit. Upon request by Intermedia and subject to Intermedia’s reasonable discretion, Service Provider allows Intermedia or Intermedia’s customers (or an independent third party auditor or an inspection body composed of independent members selected by Intermedia or Intermedia’s customers, and which possess the required professional qualifications) to audit and review Service Provider’s information security program, data processing facilities, and data protection compliance program to verify compliance with this Agreement, Data Protection Law, and as applicable with Intermedia’s customers’ instructions or own obligations (“Data Protection and Security Audit”). The parties will mutually agree upon the scope, timing, and duration of the Data Protection and Security Audit, in which case Service Provider will make available to Intermedia, or where applicable to Intermedia’s customer or the relevant auditor or inspection body, the result of the audit. Service Provider agrees to fully cooperate with such Data Protection and Security Audit and implement all commercially reasonable changes to its information security program, data processing facilities and data protection compliance program that, as a result of the Data Protection and Security Audit, are required to ensure Service Provider’s compliance with this Agreement, Data Protection Law, and as applicable with Intermedia’s customers’ instructions or own obligations. Service Provider’s failure to allow or cooperate with any Data Protection and Security Audit or implement any required changes to its information security program, data processing facilities or data protection compliance program shall entitle Intermedia to suspend the Processing of Personal Data by Service Provider, and to terminate any further Personal Data Processing and to terminate the affected services, the Principal Agreement and/or this Agreement, if doing so is required to comply with this Agreement, Data Protection Law, and as applicable with Intermedia’s customers’ instructions or own obligations. Liability Towards Data Subject. The parties agree that they will be held liable for violations of Data Protection Law towards Data Subjects as follows: Service Provider is fully liable to Intermedia, and as applicable to Intermedia’s customers, for any infringements of Data Protection Law or this Agreement by Service Provider or Sub-Processors. Where Intermedia has paid damages or fines, Intermedia shall be entitled to claim back from Service Provider that part of the compensation, damages or fines, corresponding to Service Provider’s part of responsibility for the damages or fines. Applicable Law and Jurisdiction. The Agreement is governed by (a) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in the EEA, the law of Ireland; (b) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in the United Kingdom, the law of the United Kingdom; and (c) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in any jurisdiction other than the EEA or the United Kingdom, the law of the State of California; provided that, if Data Protection Law requires that the law of another jurisdiction govern the Processing of any particular Personal Data under this Agreement, the Processing of such Personal Data under this Agreement shall be governed by the law required by Data Protection Law. Any disputes between the parties relating to the Processing of Personal Data under this Agreement will be subject to the exclusive jurisdiction of (a) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in the EEA, the courts of Ireland; (b) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in the United Kingdom, the courts of the United Kingdom; and (c) for matters primarily pertaining to the Processing of Personal Data of Data Subjects in any jurisdiction other than the EEA or the United Kingdom, the courts of the County of Santa Clara in the State of California. List of Schedules. The schedules hereto form a part of this Agreement and have been attached hereto as follows: Schedule 1: EEA Region Specific Terms Schedule 2: CCPA Specific Terms Schedule 3: United Kingdom Specific Terms Modification of this Agreement. This Agreement may only be modified by a written amendment signed by each of the parties, except for any amendment designed to comply with any Data Protection Law or applicable industry standards, which amendment may be made unilaterally by Intermedia. Termination. The parties agree that this Agreement is terminated upon Service Provider’s deletion of all remaining copies of Personal Data in accordance with Section 4.6. Invalidity and Severability. If any provision of this Agreement is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, the invalidity or unenforceability of such provision shall not affect any other provision of this Agreement and all provisions not affected by such invalidity or unenforceability will remain in full force and effect. SCHEDULE 1 EEA Region Specific Terms GDPR. Service Provider will Process Personal Data in accordance with the GDPR requirements applicable to Service Provider’s provision of its Services. EEA External Data Transfers. For purposes of this Schedule 1, the term “EEA External Data Transfers” shall mean any transfer of Personal Data from the EEA to an international organization or to a country outside of the EEA and includes any onward transfer of Personal Data from the international organization or the country outside of the EEA to another international organization or to another country outside of the EEA. Intermedia hereby authorizes Service Provider to perform EEA External Data Transfers to countries subject to a current adequacy decision of the European Commission or based on Standard Contractual Clauses. Service Provider must inform Intermedia at least thirty (30) days prior to any intended change of EEA External Data Transfers. All authorizations of EEA External Data Transfers pursuant to Section 2(a) are expressly conditioned upon Service Provider’s ongoing compliance with the requirements of Data Protection Law applicable to EEA External Data Transfers, and any applicable legal instrument for EEA External Data Transfers. If such compliance is affected by circumstances outside of Service Provider’s control, including the amendment, replacement or annulment of applicable legal instruments, Intermedia and Service Provider will work together in good faith to reasonably resolve such non-compliance. As described by the roles of the parties in Section 2 of the Agreement, Service Provider and Intermedia agree to Module 2 (Controller-to-Processor) and Module 3 (Processor to Processor) (collectively, “Modules”) of the Standard Contractual Clauses, which are linked in Exhibit A to this Schedule 1 and are hereby incorporated into this Agreement and form an integral part hereof: The “data exporter” is Intermedia and the “data importer” is Service Provider; For Docking in Clause 7, the optional docking clause will not apply; For the Use of Sub-Processor in Clause 9(a) of the Modules, the parties agree to Option 2 and include a specified time period for thirty (30) days; For Redress in Clause 11 of the Modules, the optional paragraph has been, and is hereby, struck; For Supervision in Clause 13(a) of the Modules, the parties agree to Paragraph 1; For Governing Law in Clause 17 of the Modules, the parties agree to Option 1 and specify the Ireland as the law governing this Schedule 1; For Choice of Forum and Jurisdiction in Clause 18(b) of the Modules, the parties agree to the courts of Ireland as the jurisdiction governing this Schedule 1; and Annex 1, 2 and 3 to the Modules of the Standard Contractual Clauses are Exhibits B through F to this Schedule 1. The Standard Contractual Clauses will remain in force unless repealed or replaced by the appropriate governing entity, or Service Provider relies on an alternative data transfer mechanism that is recognized under the EEA’s Data Protection Law as adducing adequate safeguards for the transfers of Personal Data outside of the EEA. In any such event, the parties agree that any such changes shall be made in accordance with Section 12 of the Agreement. In case of conflict or inconsistency between the Standard Contractual Clauses and any other current or future agreement between the parties, the Standard Contractual Clauses will prevail. Service Provider’s Obligations of Supplementary Measures. Data Transfer Impact Assessment. Service Provider shall cooperate with Intermedia to complete a data transfer impact assessment, including an assessment with regards to whether the local laws and practices will impinge the effectiveness of the SCCs or other data transfer tools under the GDPR which is applicable to the International Data Transfer. Service Provider shall provide to Intermedia the following types of information, to the best of Service Provider’s knowledge and after having used its best efforts to obtain it: the laws and regulations in the Receiving Country applicable to the importer or its Sub-Processors that would permit access by public authorities to the Personal Data that are subject to the International Data Transfer, in particular in the areas of intelligence, law enforcement, administrative and regulatory supervision applicable to the transferred Personal Data; and in the absence of laws governing the public authorities’ access to data, provide information and statistics based on Service Provider’s experience or reports from various sources (e.g. partners, open sources, national case law and decisions from oversight bodies) on access by public authorities to Personal Data in situations of the kind of the International Data Transfer at hand (i.e. in the specific regulatory area; regarding the type of entities to which Service Provider belongs, etc.). Unauthorized Access to Personal Data. Service Provider certifies that (i) it has not purposefully created back doors or similar programming that could be used to access Service Provider’s system and/or Personal Data processed by Service Provider, (ii) it has not purposefully created or changed its business processes in a manner that facilitates access to Personal Data or systems, and (iii) national law or government policy does not require Service Provider to create or maintain back doors to facilitate access to Personal Data or systems. Service Provider further certifies that it has not in the past received any massive, disproportionate, or indiscriminate data access requests. Should Service Provider breach this Section 3(b), Intermedia is entitled to terminate the Principal Agreement and this Agreement. Notification of Change of Applicable Data Protection Law. Service Provider shall monitor any legal or policy developments applicable to Service Provider that might lead to its inability to comply with its obligations under this Agreement and shall inform Intermedia within thirty (30) days of Service Provider being aware of its inability to comply with this Agreement and, as a result, with the EEA’s Data Protection Law’s required standard of “essentially equivalent level of data protection.” Upon any such change, Intermedia shall be entitled to suspend the International Data Transfer of Personal Data to Service Provider, and/or terminate the Principal Agreement and this Agreement, and/or demand Service Provider’s immediate return or deletion of the Personal Data. SCHEDULE 1 Exhibit A STANDARD CONTRACTUAL CLAUSES The Standard Contractual Clauses, as presented in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, are hereby incorporated herein by reference and Service Provider and Intermedia agree to Module 2 (Controller-to-Processor) and Module 3 (Processor to Processor) (collectively, “Modules”) of the SCCs. SCHEDULE 1 Exhibit B Annex I (A) LIST OF PARTIES to the Standard Contractual Clauses Data Exporter(s): Name of Company: Intermedia.net, Inc. Address: 100 Mathilda Place, Suite 100, Sunnyvale, California 94086 Contact Person’s Name: Jeffrey Eisenberg Contact Person’s Position: Chief Administrative Officer and General Counsel Contact Person’s Email Address: [email protected] Activities Relevant to the Data Transferred Under These Clauses: See Annex I(B) Signature: Date: Role: Intermedia acts as (a) Controller for the Personal Data that Intermedia provides to Service Provider in connection with the internal operation of Intermedia’s business (including without limitation human resources, procurement and other administrative functions), or (b) Processor (or Sub-Processor) while acting on behalf, directly or indirectly, of customers of Intermedia’s Services, who act as Controllers. Intermedia is engaged in the business of providing communications services (such as unified communications (including, without limitation, Voice over Internet Protocol (VoIP) telecommunications), video conferencing and webinar service, hosted contact center, file sync and share, email, archiving, encryption, backup, storage, and other communications services) to business customers, both directly and indirectly through resellers of such services. In connection with the provision of such services, as well as the performance of other business activities ancillary thereto and the internal operation of Intermedia’s business (including without limitation human resources, procurement and other administrative functions), Intermedia has engaged the services of Service Provider and will provide Personal Data to Service Provider for Processing, as described in the Principal Agreement and the schedules and exhibits incorporated therein. Data Importer(s): Name: Address: Contact Person’s Name: Contact Person’s Position: Contact Person’s Phone Number: Contact Person’s Email Address: Activities Relevant to the Data Transferred Under These Clauses: See Annex I(B) Signature: Date: Role: Service Provider is Processor acting on behalf of Intermedia, or a Sub-Processor acting on behalf of Intermedia’s customers. Service Provider will Process Personal Data to provide the Services, which include services to support, and/or services to support Intermedia’s business activities that are ancillary to, (a) the delivery of one or more of Intermedia’s communications services (such as unified communications (including, without limitation, Voice over Internet Protocol (VoIP) telecommunications), video conferencing and webinar service, hosted contact center, file sync and share, email, archiving, encryption, backup, storage, and other communications services), as described in the Principal Agreement and the schedules and exhibits incorporated therein, or (b) provision of the Services as described in the Principal Agreement and the schedules and exhibits incorporated therein (including without limitation the Processing of data of Intermedia’s employees, service providers and website visitors). SCHEDULE 1 Exhibit C Annex I (B) DESCRIPTION OF TRANSFER to the Standard Contractual Clauses Categories of Data Subjects Whose Personal Data is Transferred Service Provider may Process Personal Metadata (as defined below) relating to any users, senders or recipients of communications or files through the Services, as well as Account-Level User Information (as defined below) relating to any users of Intermedia’s services. In addition, Service Provider may Process Personal Data (a) regarding any data subjects regarding whom Intermedia, its resellers and Intermedia’s and the resellers’ customers and end users transmit, receive, store, encrypt and/or copy Personal Data in their use of Intermedia’s services; and/or (b) regarding data subjects (including without limitation Intermedia employees, contractors, service providers and vendors) in connection with Service Provider’s services in support of the operation of Intermedia’s business (including without limitation human resources, procurement and other administrative functions), as described in the Principal Agreement and the schedules and exhibits incorporated therein. Categories of Personal Data Transferred Service Provider may Process any Personal Data that Intermedia, its resellers and Intermedia’s and the resellers’ customers and end users transmit, receive, store, encrypt and/or copy in their use of Intermedia’s services, as well as Personal Data provided to Service Provider for Processing in connection with the provision of services in support of the operation of Intermedia’s business (including without limitation human resources, procurement and other administrative functions), as described in the Principal Agreement and the schedules and exhibits incorporated therein. In addition, Service Provider may Process any Personal Data that is included as metadata (such as user names, email addresses, IP addresses and the like) in any communications or files that Service Provider Processes in its delivery of the Services (“Personal Metadata”), as well as any Personal Data that is included in Intermedia’s account-level business records, such as billing information and history, user account identifiers, access logs and other business operation information (“Account-Level User Information”). The Frequency of the Transfer (e.g. whether the data is transferred on a one-off or continuous basis) The Personal Data is transferred on a continuous basis. Nature of the Processing Service Provider will Process Personal Data for the purpose of providing the Services and any associated tools and services, including technical support or other support services. Purpose(s) of the Data Transfer and Further Processing Service Provider will Process Personal Data solely for the purpose of: providing the Services and any associated tools and services providing support and troubleshooting (preventing, detecting and repairing problems); and ongoing improvement (installing the latest updates and making improvements to user productivity, reliability, efficacy, and security) The Period for Which the Personal Data Will be Retained, or, If That is Not Possible, the Criteria Used to Determine that Period Service Provider will Process Personal Data only for as long as necessary to provide the Services and as permitted under the Principal Agreement and this Agreement. For Transfers to (Sub-)Processors, also Specify Subject Matter, Nature and Duration of the Processing Sub-processors shall Process Personal Data only as necessary, and for as long as necessary, to provide the Services in accordance with the applicable agreement with Service Provider. SCHEDULE 1 Exhibit D Annex I (C) COMPETENT SUPERVISORY AUTHORITY to the Standard Contractual Clauses Identify the Competent Supervisory Authority/ies in Accordance with Clause 13 Dutch Data Protection Supervisory Authority (Autoriteit Persoonsgegevens) SCHEDULE 1 Exhibit E ANNEX II TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA to the Standard Contractual Clauses This Annex forms part of the Clauses, and, by signing the Agreement, the parties agree to the terms referenced herein. Description of the technical and organisational security measures implemented by the data importer in accordance with Clause 8 (or document/legislation attached): Service Provider will, at a minimum, implement the following types of security measures: Physical access control Technical and organizational measures to prevent unauthorized persons from gaining access to the data processing systems available in premises and facilities (including databases, application servers and related hardware), where Personal Data are Processed, include: Establishing security areas, restriction of access paths; Establishing access authorizations for employees and third parties; Access control system (ID reader, magnetic card, chip card); Key management, card-keys procedures; Door locking (electric door openers etc.); Security staff, janitors; Surveillance facilities, video/CCTV monitor, alarm system; and Securing decentralized data processing equipment and personal computers. Virtual access control Technical and organizational measures to prevent data processing systems from being used by unauthorized persons include: User identification and authentication procedures; ID/password security procedures (special characters, minimum length, change of password); Automatic blocking (e.g., password or timeout); Monitoring of break-in-attempts and automatic turn-off of the user ID upon several erroneous passwords attempts; Creation of one master record per user, user-master data procedures per data processing environment; and Encryption of archived data media. Data access control Technical and organizational measures to ensure that persons entitled to use a data processing system gain access only to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorization, include: Internal policies and procedures; Control authorization schemes; Differentiated access rights (profiles, roles, transactions and objects); Monitoring and logging of accesses; Disciplinary action against employees who access Personal Data without authorization; Reports of access; Access procedure; Change procedure; Deletion procedure; Encryption; and Pseudonymisation. Disclosure control Technical and organizational measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Personal Data are disclosed, include: Encryption/tunneling; Logging; and Transport security. Entry control Technical and organizational measures to monitor whether Personal Data have been entered, changed or removed (deleted), and by whom, from data processing systems, include: Logging and reporting systems; and Audit trails and documentation. Control of instructions Technical and organizational measures to ensure that Personal Data are Processed solely in accordance with the instructions of the Controller include: Unambiguous wording of the contract; Formal commissioning (request form); and Criteria for selecting the Processor. Availability control Technical and organizational measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical) include: Backup procedures; Mirroring of hard disks (e.g. RAID technology); Uninterruptible power supply (UPS); Remote storage; Anti-virus/firewall systems; Disaster recovery plan; and Business Continuity plan. Separation control Technical and organizational measures to ensure that Personal Data collected for different purposes can be Processed separately include: Separation of databases; “Internal client” concept / limitation of use; Segregation of functions (production/testing); and Procedures for storage, amendment, deletion, transmission of data for different purposes. Management control Technical and organizational measures to ensure that Personal Data accessed, processed, and/or stored are monitored and managed in line with industry standards, including the security controls and assurance activities under SSAE18 (SOC 2 Type 2), ISO 27001 or similar certification or audits: Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing; Regularly application and network security testing; Internal IT and IT security governance and management; Measures for ensuring system configuration; and Measures for certification/assurance of processes and products. Data Management control Technical and organizational measures to ensure that Personal Data accessed, processed, and/or stored are monitored and managed pursuant to the Data Protection Law and include: Measures for ensuring data minimization; Measures for ensuring data quality; Measures for ensuring limited data retention; and Measures for allowing data portability and ensuring erasure. For transfers to (Sub-) Processors, also describe the specific technical and organisational measures to be taken by the (Sub-) Processor to be able to provide assistance to the Controller and, for transfers from a Processor to a Sub-Processor, to the Data Exporter. The specific technical and organizational measures by Sub-Processors shall be described in the documentation regarding such Sub-Processor provided by Service Provider to Intermedia. SCHEDULE 1 Exhibit F ANNEX III – LIST OF SUB-PROCESSORS to the Standard Contractual Clauses To support delivery of Intermedia’s services, Intermedia has authorised the use of the Sub-Processors listed in Sub-Processor List provided by Service Provider. Entity Name Purpose of Processing Location of Processing Additional Details SCHEDULE 2 CCPA Specific Terms Definitions. For the purposes of this Schedule 2: The capitalized terms used in this Schedule 2 and not otherwise defined in this Schedule 2 shall have the definitions set forth under the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”). Roles and Scope. In furtherance of obligations under the CCPA, this Schedule 2 applies only to the Collection, retention, use, disclosure, and Sale of Personal Information provided by Intermedia to, or which is Collected on behalf of Intermedia by, Service Provider to provide Services to Intermedia pursuant to the Agreement or to perform a Business Purpose (“Intermedia Personal Information”). The parties acknowledge and agree that Intermedia is a Business and appoints Service Provider to process Intermedia Personal Information on behalf of Intermedia. Restrictions on Processing. Except as otherwise permitted by the CCPA, Service Provider is prohibited from (i) retaining, using, or disclosing Intermedia Personal Information for any purpose other than for the specific purpose of performing the Services specified in the Agreement for Intermedia, as set out in this Schedule 2 and (ii) further Collecting, Selling, or using Intermedia Personal Information except as necessary to perform the Services. Consumer Rights. Service Provider shall provide commercially reasonable assistance to Intermedia for the fulfillment of Intermedia’s obligations to respond to CCPA-related Intermedia rights requests regarding Intermedia Personal Information. Upon direction by Intermedia, and in any event no later than 30 days after receipt of a request from Intermedia, Service Provider shall promptly delete Intermedia Personal Information as directed by Intermedia. Service Provider shall not be required to delete any Intermedia Personal Information to comply with a Consumer’s request directed by Intermedia if it is necessary to maintain such information in accordance with Cal. Civ. Code 1798.105(d), in which case Service Provider shall promptly inform Intermedia of the exceptions relied upon under 1798.105(d) and Service Provider shall not use Intermedia Personal Information retained for any other purpose than provided for by that exception. Deidentified Information. In the event that either Party shares Deidentified Information with the other Party, the receiving Party warrants that it: (i) has implemented technical safeguards that prohibit reidentification of the Consumer to whom the information may pertain; (ii) has implemented business processes that specifically prohibit reidentification of the information; (iii) has implemented business processes to prevent inadvertent release of Deidentified Information; and (iv) will make no attempt to reidentify the information. SCHEDULE 3 United Kingdom Specific Terms Service Provider will Process Personal Data in accordance with the applicable Data Protection Law of the United Kingdom (“UK”), including UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018 (collectively, “UK Data Protection Law”), for Service Provider’s provision of its Services in the UK. UK External Data Transfers. For purposes of this Schedule 3, the term “UK External Data Transfers” shall mean any transfer of Personal Data from the UK to an international organization or to a country outside of the UK and includes any onward transfer of Personal Data from the international organization or the country outside of the UK to another international organization or to another country outside of the UK. Intermedia hereby authorizes Service Provider to perform UK External Data Transfers to countries subject to a current adequacy decision of the UK or based on the UK Standard Contractual Clauses. Service Provider must inform Intermedia at least thirty (30) days prior to any intended change of UK External Data Transfers. All authorizations of UK External Data Transfers pursuant to Section 2(a) are expressly conditioned upon Service Provider’s ongoing compliance with the requirements of UK Data Protection Law applicable to UK External Data Transfers, and any applicable legal instrument for UK External Data Transfers. If such compliance is affected by circumstances outside of Service Provider’s control, including the amendment, replacement or annulment of applicable legal instruments, Intermedia shall have the right to terminate Services with the Service Provider. As described by the roles of the parties in Section 3 of the Agreement, Intermedia and Service Provider agree to the UK Standard Contractual Clauses, which are hereby incorporated into this Agreement and form an integral part hereof: “Annex 1A: List of Parties” is Exhibit B to Schedule 1 of this Agreement. “Annex 1B: Description of Transfer” is Exhibit C to Schedule 1 of this Agreement. “Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data” is Exhibit E to Schedule 1 of this Agreement. “Annex III List of Sub processors” is Exhibit F of this Agreement. Under Table 4, the parties agree that the Exporter may end this Schedule 3 pursuant to Section 19 of the UK Standard Contractual Clauses. As referenced in Part 2 of the UK Standard Contractual Clauses, the parties agree to the Mandatory Clauses. The UK Standard Contractual Clauses will remain in force unless repealed or replaced by the appropriate governing entity, or Service Provider relies on an alternative data transfer mechanism that is recognized under the UK’s Data Protection Law as adducing adequate safeguards for the transfers of Personal Data outside of the UK. In any such event, the parties agree that any such changes shall be made in accordance with Section 12 of the Agreement. In case of conflict or inconsistency between the UK Standard Contractual Clauses and any other current or future agreement between the parties, the UK Standard Contractual Clauses will prevail for UK External Data Transfers.