Snapshot 4279
Normalized text
Scripts and page chrome removed; this is what change detection compares.
IRONSCALES – DATA PROCESSING ADDENDUM
Updated: January 1, 2025
This Data Processing Addendum (“DPA”) forms an integral part of the End User License Agreement (“Agreement”) between
Customer and Ironscales. Customer and Ironscales may also be referred to herein each as a “Party” and collec�vely as the
“Par�es”.
Customer shall qualify as the “Data Controller” and Ironscales shall qualify as the “Data Processor”, as these terms are
defined in Sec�on 1 below. All capitalized terms not defined herein shall have the meaning set forth in the Agreement.
1. Defini�ons
a. "Data Controller" (which includes “business” as defined in CCPA), "Data Processor" (which includes “service
provider” and “contractor” as defined in CCPA), "Personal Data" (or “personal data”, both of which include similar
terms in Data Protec�on Law, such as “personal informa�on”), "Personal Data Breach", "data subject" (which
includes other terms in Data Protec�on Law intended to refer to the individual person whose Personal Data are
being processed), "process", "processing" shall have the meanings ascribed to them in the Data Protec�on Law.
b. "EEA" means those countries that are members of the European Economic Area.
c. "Data Protec�on Law" means, individually or collec�vely, the data protec�on and privacy laws and regula�ons that
are in force and applicable to a Party’s processing of Personal Data pursuant or in rela�on to the Agreement,
including, where applicable, GDPR, EU/UK Data Protec�on Law, and CCPA; “GDPR” means Regula�on 2016/679 of
the European Parliament and of the Council on the protec�on of natural persons with regard to the processing of
Personal Data and on the free movement of such data (General Data Protec�on Regula�on), and any applicable
laws of the European Union, their Member States, Switzerland and the United Kingdom, applicable to the
Processing of Personal Data under the Agreement; “CCPA” means the California Consumer Privacy Act of 2018, the
California Privacy Rights Act of 2020 and any binding regula�ons promulgated thereunder, in each case, as may be
amended from �me to �me.
d. “Services” mean the Pla�orm and any other ancillary services and products provided by Ironscales to Customer
pursuant to an Order.
e. "Security Measures" mean commercially reasonable security-related policies, standards, and prac�ces
commensurate with the nature, size and complexity of Ironscales’ business and the level of sensi�vity of the data
collected, handled and stored, including those set forth in Exhibit B of this DPA.
f. "Standard Contractual Clauses" and “SCCs” mean, as applicable to the processing, (i) the standard contractual
clauses for the transfer of personal data to third countries pursuant to Regula�on (EU) 2016/679 of the European
Parliament and of the Council from June 4th 2021, currently found at htps://ec.europa.eu/info/law/law-
topic/data-protec�on/interna�onal-dimension-data-protec�on/standard-contractual-clauses-scc_en (“EU SCCs”)
and (ii) the UK Interna�onal Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued
by the Informa�on Commissioner’s Office under s.119(A) of the UK Data Protec�on Act 2018, currently found at
htps://ico.org.uk/media/for-organisa�ons/documents/4019539/interna�onal-data-transfer-addendum.pdf (“UK
Addendum”).
g. "Sub-Processors" and “Subprocessors” mean any affiliate, agent or assignee of Ironscales that may process
Personal Data pursuant to the terms of the Agreement, and any unaffiliated processor engaged by Ironscales.
1
2. Compliance with Laws
a. Each Party shall comply with its respec�ve obliga�ons under the Data Protec�on Law. Without limi�ng the
preceding sentence, Customer represents and warrants that it has obtained from Data Subjects and will maintain
throughout the term of the Agreement all consents and permissions required by Data Protec�on Law for Ironscales’
processing of such Data Subjects’ Personal Data in accordance with the Agreement.
b. Ironscales shall provide reasonable coopera�on and assistance to Customer in rela�on to Ironscales’ processing of
Personal Data in order to allow Customer to comply with its obliga�ons as a Data Controller under the Data
Protec�on Law.
c. Ironscales agrees to no�fy Customer promptly if it becomes unable to comply with the terms of this DPA and take
reasonable and appropriate measures to remedy such non-compliance.
3. Processing Purpose and Instruc�ons
a. The subject-mater of the processing, dura�on of the processing, the nature and purpose of the processing, the
type of Personal Data and categories of data subjects, shall be as set out in Exhibit A to Appendix 1 of this DPA.
b. The dura�on of the processing under the Agreement is determined by the Par�es, as set forth in the Agreement.
c. Ironscales shall process Personal Data only to deliver the Services in accordance with Customer’s writen
instruc�ons (including Customer’s Pla�orm se�ngs), the Agreement, the Documenta�on and the Data Protec�on
Law, unless Ironscales is otherwise required by law to which Ironscales is subject (and in such a case, Ironscales
shall inform Customer of that legal requirement before processing, unless that legal requirement prohibits such
informa�on disclosure).
d. Processing any Personal Data outside the scope of the Agreement will require prior writen agreement between
Ironscales and Customer by way of writen amendment to the Agreement which may include addi�onal fees that
may be payable by Customer to Ironscales for carrying out such instruc�ons.
e. The obliga�ons in this Sec�on 3e apply with respect to Personal Data that is subject to CCPA. To the extent that
there is disclosure of Personal Data by Customer to Ironscales, including via the Services, the Par�es agree that:
(1) the Personal Data is provided by Customer only for the limited and specified purposes set out in the
Agreement; (2) Ironscales shall comply with applicable obliga�ons under CCPA and provide the same level of
privacy protec�on as is required of Customer by CCPA; (3) Customer has the right to take reasonable and
appropriate steps to help ensure that Ironscales uses the Personal Data in a manner consistent with Customer’s
obliga�ons under CCPA; (4) Ironscales shall no�fy Customer if it makes a determina�on that it can no longer
meet its obliga�ons under CCPA; and (5) Customer has the right, upon writen no�ce, to take reasonable and
appropriate steps to stop and remediate unauthorized use of the Personal Data by Ironscales. Customer shall
inform Ironscales of any consumer (as defined in CCPA) request requiring Ironscales to stop or modify its
processing of that consumer’s Personal Data in connec�on with the Agreement. Upon no�ce of such a request,
Ironscales shall promptly cease or modify its processing in accordance with CCPA’s requirements. Where
Ironscales is a service provider under CCPA, Ironscales agrees and cer�fies that it will not: (i) sell or share the
Personal Data; (ii) retain, use, or disclose the Personal Data for any purpose, including a commercial purpose,
other than the business purpose of performing the Services as set forth in the Agreement or as otherwise
permited by CCPA and the Agreement; (iii) retain, use, or disclose the Personal Data outside of the direct
business rela�onship between Customer and Ironscales; or (v) combine the Personal Data with Personal Data
that Ironscales receives from or on behalf of another person, or collects from its own interac�on with consumers,
provided that Ironscales may combine Personal Data to perform any business purpose permited by the CCPA
and the Agreement.
2
4. Reasonable Security and Safeguards
a. Ironscales shall maintain the Security Measures for the protec�on of the security, confiden�ality and integrity of
the Personal Data, and shall demonstrate compliance with such Security Measures upon Customer’s writen
request within a reasonable �me period and reasonable means. Upon Customer’s request, Ironscales will assist
Customer in ensuring compliance with the obliga�ons pursuant to the informa�on security requirements of Data
Protec�on Law, taking into account the nature of the processing and the informa�on available to Ironscales.
b. The Security Measures are subject to technical progress and development and Ironscales may update or modify
the Security Measures from �me to �me provided that such updates and modifica�ons do not result in the
degrada�on of the overall security of Ironscales’ pla�orm.
c. Ironscales shall take reasonable steps to ensure the reliability of its staff and any other person ac�ng under its
supervision who have access to and process Personal Data. Ironscales shall ensure that persons authorized to
process Personal Data have commited themselves to confiden�ality or are under an appropriate statutory
obliga�on of confiden�ality.
5. Coopera�on and Assistance
a. If Ironscales receives any requests from data subjects or applicable data protec�on authori�es rela�ng to the
processing of Personal Data hereunder, including requests from individuals seeking to exercise their rights under
Data Protec�on Law, Ironscales will promptly redirect the request to Customer unless required to do otherwise by
Data Protec�on Law. Ironscales will not respond to such communica�on directly without Customer's prior writen
approval, unless legally compelled to do so. If Ironscales is required to respond to such a request, Ironscales will
promptly no�fy Customer and provide Customer with a copy of the request, unless legally prohibited from doing
so.
b. If Ironscales receives a legally binding request for the disclosure of Personal Data which is subject to this DPA,
Ironscales shall (to the extent legally permited) no�fy Customer upon receipt of such order, demand, or request.
Notwithstanding the foregoing, Ironscales will, to the extent permited by applicable law, i)( cooperate with
Customer with respect to any ac�on taken pursuant to such order, demand or request, and (ii) ensure hat t
confiden�al treatment will be accorded to such disclosed Personal Data.
c. Upon reasonable no�ce, Ironscales shall provide reasonable assistance to Customer in:
i. allowing data subjects to exercise their rights under the Data Protec�on Law;
ii. ensuring compliance with any no�fica�on obliga�ons of Personal Data Breaches to the supervisory
authority, as required under Data Protec�on Law;
iii. Ensuring compliance with its obliga�on to carry out Data Protec�on Impact Assessments (“DPIA”) or
prior consulta�ons with data protec�on authori�es with respect to the processing of Personal Data.
Any assistance to Customer with regard to DPIA or prior consulta�ons will be solely at Customer's cost and
expense.
6. Use of Sub-Processors
a. Customer provides a general authoriza�on to Ironscales to appoint (and permit each Sub-Processor appointed in
accordance with this sec�on to appoint) Sub Processors in accordance with this sec�on.
b. Ironscales may con�nue to use those Sub Processors already engaged by Ironscales as at the date of this Agreement,
subject to Ironscales in each case as soon as prac�cable mee�ng the obliga�ons set out in this sec�on. A list of
Ironscales' current Sub Processors can be viewed at List of Sub-Processors.
3
c. Ironscales may appoint new Sub-Processors provided that Ironscales provides seven (7) days' prior no�ce (email
and Pla�orm no�ces sufficing) and the Customer does not legi�mately object to such changes within that
�meframe. Legi�mate objec�ons must contain reasonable grounds rela�ng to the appointment of the Sub-
Processor, specifically any non-compliance with Data Protec�on Law. In the event of such objec�ons, Ironscales
shall either refrain from using such Sub-Processor in the context of the processing of Personal Data or shall no�fy
Customer of its inten�on to con�nue to use the Sub-Processor. Where Ironscales no�fies Customer of its inten�on
to con�nue to use the Sub-Processor in these circumstances, Customer may, by providing writen no�ce to
Ironscales, terminate the Agreement immediately.
d. With respect to each Sub-Processor, Ironscales shall ensure that the engagement between Ironscales and the Sub
Processor is governed by a writen contract including terms which offer at least the same level of protec�on as
those set out in this DPA and meet the requirements of Data Protec�on Law pertaining to Ironscales use of Sub-
Processors.
e. Ironscales will be responsible for any acts, errors or omissions by its Sub-Processors which cause Ironscales to
breach any of its obliga�ons under this Addendum. Where the preceding sentence is inconsistent with or would
cause a viola�on of the terms of any Data Protec�on Law, it shall be interpreted to be modified to the minimum
extent necessary to avoid such inconsistency or viola�on.
7. Personal Data Breach
a. Within any no�fica�on period prescribed by applicable law (but in any case within two (2) business days of
becoming aware of a Personal Data Breach), Ironscales will no�fy Customer of the Personal Data Breach and will
provide relevant informa�on rela�ng to the Personal Data Breach as reasonably requested by Customer.
b. Ironscales shall make reasonable efforts to iden�fy the cause of such Personal Data Breach and take those steps as
Ironscales deems necessary and reasonable in order to remediate the cause of such a Personal Data Breach.
Furthermore, Ironscales will cooperate and assist the Customer in mi�ga�ng, where possible, the adverse effects
of any Personal Data Breach.
8. Security Assessments and Audits
a. Subject to Sec�on 8b, Ironscales shall, no more than once a year, upon Customer’s writen request and subject to
obliga�ons of confiden�ality, allow its data processing procedures and documenta�on to be inspected by Customer
(or its designee) during regular business hours in order to ascertain compliance with this DPA; and (ii) Ironscales
shall cooperate in good faith with audit requests by providing access to relevant knowledgeable personnel and
documenta�on. Notwithstanding anything to the contrary, nothing in this DPA will require Ironscales either to
disclose to Customer (and/or its authorized auditors), or provide access to: (i) any data of any other customer of
Ironscales; (ii) Ironscales’ internal accoun�ng or financial informa�on; (iii) any trade secret of Ironscales; or (iv) any
informa�on that, in Ironscales’ sole reasonable discre�on, could compromise the security of any of Ironscales’ or
its customers’ or suppliers’ informa�on, systems or premises or cause Ironscales to breach obliga�ons under any
applicable law or its obliga�ons to any third party.
b. Where sufficient to sa�sfy the purpose of a Customer request under Sec�on 8a, Ironscales may sa�sfy the
requirements set out in this sec�on by providing Customer with a copy of a writen report so that Customer can
reasonably verify Ironscales’ compliance with its obliga�ons under this DPA.
4
9. Interna�onal Data Transfers
a. Ironscales may transfer and process Personal Data of Data Subjects ("Transfer") anywhere in the world where
Ironscales, its Affiliates, or their respec�ve Sub-Processors maintain data processing opera�ons, subject to the
following: (i) the Transfer is for the purpose of Ironscales carrying out its obliga�ons under the Agreement, or is
required under applicable laws; and (ii) the Transfer is done in accordance with this Sec�on 9 and Data Protec�on
Law.
b. Neither Party shall transfer or permit to be transferred any Personal Data that is (i) subject to GDPR, EU/UK Data
Protec�on Law, or other Data Protec�on Law that imposes requirements on the interna�onal transfer of Personal
Data governed by such law; and (ii) provided by or on behalf of the other Party to a territory outside of the European
Economic Area (EEA), the UK, or other applicable jurisdic�on unless it has taken such measures as are necessary to
ensure the transfer complies with EU Data Protec�on Law or other appliable Data Protec�on Law. Such measures
may include transferring the Personal Data to a recipient in a country that the European Commission or UK has
decided provides adequate protec�on for Personal Data, or to a recipient in the United States that has cer�fied
compliance with, as applicable to the Personal Data being transferred, the EU-U.S. Data Privacy Framework (“DPF),
UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, or transfer frameworks promulgated by other applicable Data
Protec�on Law (collec�vely, “Transfer Frameworks”), or to a recipient with whom the Party has established
appropriate alterna�ve transfer mechanisms such as entering into Standard Contractual Clauses deemed adequate
under EU/UK Data Protec�on Law.
c. With respect to EU/UK Data Protec�on Law, currently (and subject to change as described in Sec�on 9.a), Ironscales
transfers Personal Data to and processes Personal Data in the following countries outside of the European Economic
Area and the UK pursuant to the following transfer mechanisms:
Ironscales En�ty Import Countries Statutory Mechanism for Transfers by
Import Country
Ironscales, Inc. (US United States of America
Delaware corpora�on) State of Israel
United Kingdom
US: Ironscales adherence to the Transfer
Frameworks (see Ironscales’ DPF lis�ng at
Ironscales Global Ltd. (UK United Kingdom
htps://www.dataprivacyframework.gov/list)
en�ty) State of Israel
Israel: EU adequacy decision 2011/61/EU
United States of America
UK: EU adequacy decision 2021/1772
Ironscales Ltd. (Israeli State of Israel
company) United States of America
United Kingdom
Sub-Processor En��es See List of Sub-Processors As stated in data privacy agreements with
Sub-Processors
d. If a Transfer Framework is determined to be inadequate or unlawful for any reason, with the Par�es will implement
a lawful alterna�ve mechanism that will ensure such Transfers are lawful, including, where EU/UK Data Protec�on
5
Law applies, the appropriate Standard Contractual Clauses. Customer will cooperate with Ironscales as necessary
to ensure any such lawful alterna�ve Transfer mechanism is implemented in accordance with Data Protec�on Law.
Without limi�ng the preceding sentence, if the DPF is determined to be inadequate or unlawful for any reason, the
Par�es shall be deemed to enter into the Standard Contractual Clauses, as supplemented and interpreted in
Appendix 1, in which event the Customer shall be deemed to be the Data Exporter and Ironscales shall be deemed
to be Data Importer (as these terms are defined therein), and the Par�es’ signatures to the Agreement shall be
deemed sufficient for purposes of accep�ng their respec�ve obliga�ons under and fulfilling any signature
requirements in the Standard Contractual Clauses.
10. Data Reten�on and Destruc�on
Upon Customer’s writen request, Ironscales will delete all Personal Data in its possession as provided in the
Agreement except to the extent Ironscales is required (in which case Ironscales will implement reasonable measures
to prevent the Personal Data from any further processing that is not required) or permited (in which case Ironscales
will limit its processing to such permited purposes) under applicable law to retain the Personal Data. The terms of this
DPA will con�nue to apply to such retained Personal Data for as long as it is retained.
11. General
a. Any claims brought under this DPA will be subject to the terms and condi�ons of the Agreement, including the
exclusions and limita�ons set forth in the Agreement.
b. In the event of a conflict or inconsistency among the Agreement (and any document referred to therein), this DPA,
and, if applicable, the Standard Contractual Clauses, the order of precedence in respect of the Processing of
Customer Personal Data shall be: the SCCs, the DPA, and then the Agreement.
c. Any changes to this DPA shall be done upon the mutual writen agreement of Customer and Ironscales, provided
that neither party shall unreasonably withhold its agreement to such change, if the change is required to comply
with Data Protec�on Law, a court order or guidance issued by a governmental regulator or agency, and further
provided that such change does not: (i) seek to alter the categoriza�on of Ironscales as the Data Processor; (ii)
expand the scope of, or remove any restric�ons on, either Party’s rights to use or otherwise process Personal Data;
or (iii) have a material adverse impact on Customer.
d. Interpreta�on. In this DPA, its Appendix, and the Exhibits and Annexes to the Appendix, unless the context requires
otherwise:
1. any reference to any statute, regula�on, instrument or statutory provision shall be construed as a reference to
the same as from �me to �me replaced, amended, extended, re-enacted, or implemented in local legisla�on;
2. any reference to a "person" includes any individual, company, corpora�on, partnership, limited partnership,
limited liability partnership, firm, joint venture, associa�on, organiza�on, trust, state or state agency (in each
case whether or not having separate legal personality);
3. the headings used in this DPA are for convenience only and shall not be used for purposes of construc�on or
interpreta�on;
4. references to "Appendices", “Exhibits”, “Annexes”, “Sec�ons”, and "clauses" are, unless otherwise stated,
references to the Appendices, Exhibits, Annexes, Sec�ons, and clauses to this DPA, as applicable;
5. any word following the terms "including", "include", "in par�cular", “such as”, "for example" or any similar
expression shall be construed as illustra�ve and shall not limit the sense of the words, descrip�on, defini�on,
phrase or term preceding those terms;
6
6. if any provision in this DPA is ineffec�ve or void, this shall not affect the remaining provisions. The par�es shall
replace the ineffec�ve or void provision with a lawful provision that reflects the business purpose of the
ineffec�ve or void provision. In case a necessary provision is missing, the par�es shall add an appropriate one
in good faith; and
7. if applicable, the Appendices and its Exhibits form part of this DPA and will have the same force and effect as
if expressly set out in the body of this DPA.
Appendix 1
EU/UK/Swiss to US Data Transfer Clauses
Preamble: This Appendix 1 shall only apply under the condi�ons specified in Sec�on 9.d of the DPA.
1. Applica�on and Interpreta�on of the Standard Contractual Clauses
(A) Subject to the Preamble above, for any Transfers of Customer Personal Data from the European Economic Area
and its member states, the United Kingdom and/or Switzerland (collec�vely, “Restricted Countries”) to Ironscales
in a country which does not ensure an adequate level of protec�on (within the meaning of and to the extent
governed by the Data Protec�on Laws of the Restricted Countries) (collec�vely, “Third Country”), such transfers
shall be governed by this Appendix 1. For clarity, for transfers from the United Kingdom and Switzerland, references
in the SCCs shall be interpreted to include applicable terminology for those jurisdic�ons (e.g., “Member State”
shall be interpreted to mean “United Kingdom” for transfers from the United Kingdom).
(B) Where the valid Transfer Framework is the Standard Contractual Clauses, Ironscales is entering into the
Standard Contractual Clauses with Customer as set out in this Sec�on 1 and in accordance with the applicable
terms of this Sec�on 1. The following terms of this Sec�on 1(B) shall apply to all SCCs applicable to the par�es.
a. Each Party agrees to transfer and process Customer Personal Data from the Restricted Countries in
accordance with the EU SCCs and UK Addendum respec�vely and as applicable, which are incorporated
into this DPA by reference. Each Party is deemed to have executed the applicable SCCs by entering into the
DPA, and the details set forth in this Sec�on 1 and Exhibit A, shall apply for the purposes of Table 1 of the
UK Addendum.
b. If a Subprocessor is a Data Importer (as that term is used in the applicable SCCs), Ironscales shall enter into
the appropriate standard contractual clauses with Customer on behalf of such Data Importer. If that is not
possible, Ironscales will inform Customer in wri�ng and will procure such Data Importer’s agreement to
such standard contractual clauses as an addi�onal Data Importer. Customer or Ironscales will, upon
request of a Data Subject, provide the Data Subject with a copy of documenta�on of such mechanism(s)
and this DPA.
c. The Par�es agree that the nature of the Processing is such that Customer is the Controller and Ironscales
is the Processor; therefore, the applicable clauses of the Standard Contractual Clauses shall be those with
general applicability (i.e., those clauses that are not iden�fied as being applicable to any specific
module(s)) and the clauses iden�fied in the EU SCCs as “Module TWO: Transfer controller to processor”
clauses.
d. If the UK SCCs apply to the processing under this DPA, they shall be interpreted in accordance with the UK
Addendum and the applicable details set forth in this Sec�on 1(B). For purposes of Table 2 of the UK
Addendum, the versions of the Approved EU SCCs that apply shall be determined by Sec�on 1(B)c above.
7
(C) The terms in this Sec�on 1(C) apply to the applicable SCCs as described in Sec�ons 1(B) c and d, including (i)
the elec�on of specific terms and/or op�onal clauses as described in more detail in subsec�ons a - i below, and (ii)
for purposes of the UK SCCs (except to the extent the UK SCCs modify them).
a. Where the Standard Contractual Clauses iden�fy a clause as an op�on, the op�onal clause shall apply
(including with respect to Table 2 of the UK Addendum) unless otherwise expressly agreed by Customer
and Ironscales in this Data Protec�on Agreement or its Exhibits.
b. The op�onal Clause 7 in Sec�on I of the SCCs is incorporated, and Ironscales’ Affiliates may accede to this
DPA and the SCCs under the same terms and condi�ons as Ironscales, subject to any varia�ons made by
mutual agreement of Customer and Ironscales. The foregoing shall apply with respect to Table 2 of the UK
Addendum;
c. For purposes of Clause 9 of the SCCs, Op�on 2 (‘General writen authoriza�on’) is selected and the process
and �me period for the addi�on or replacement of Subprocessors shall be as described in Sec�on 6 of the
DPA. The foregoing shall apply with respect to Table 2 of the UK Addendum;
d. For purposes of Clause 13 of the SCCs, Annex I.C to this Appendix 1 shall apply. Ironscales shall maintain
accurate records of the applicable Member State(s) and competent supervisory authority, which shall be
made available to Customer on request;
e. For purposes of Clause 14(c) and 15 of the SCCs, Exhibit A, Annex IV (Addi�onal Safeguards for Third
Countries) applies for each applicable Third Country in which Customer Personal Data is or may be
Processed by Ironscales. Ironscales shall update Exhibit A, Annex IV by no�ce to Customer whenever a
material change to the relevant laws and prac�ces of Third Countries occurs;
f. Except as provided in subpart g below, (i) for purposes of Clause 17, Op�on 1 shall apply and the Par�es
agree that the law of the Republic of Ireland shall govern, and (ii) for purposes of Clause 18(b) of the EU
SCCs, the Member State for purposes of governing law and jurisdic�on shall be the Republic of Ireland.
g. For purposes of the UK Addendum, Part 2, Sec�on 15(m) of the UK Addendum shall apply in lieu of Clause
17 of the EU SCCs, and Part 2, Sec�on 15(n) of the UK Addendum shall apply in lieu Clause 18(b) of the EU
SCCs;
h. Exhibit A of this DPA sets forth the informa�on required for comple�on of the Appendix to the Standard
Contractual Clauses; in par�cular, (List of the Par�es), (Descrip�on of the Transfer), (Competent
Supervisory Authori�es), (Technical and Organisa�onal Measures), and (List of Subprocessors). The
foregoing shall apply with respect to Table 3 of the UK Addendum; and
i. With respect to Table 4 of the UK Addendum, either party may terminate the UK Addendum pursuant to
Sec�on 19 of the UK Addendum if, a�er a good faith effort by the par�es to amend this DPA to account for
the approved changes and any reasonable clarifica�ons to the UK Addendum, the par�es are unable to
come to a mutual agreement.
2. The par�es agree that, if authorized to use the Services pursuant to the Agreement, Customer’s Affiliates are,
within the scope of their use of the Services, intended third-party beneficiaries of the SCCs and its provisions will
inure to the benefit of the Customer Affiliates, which will be en�tled to enforce the SCCs as if each were a signatory
to the DPA.
8
EXHIBIT A TO THE STANDARD CONTRACTUAL CLAUSES
The informa�on in this Exhibit A contains the relevant informa�on needed to complete Annexes I – III of the Standard
Contractual Clauses.
Annex I.A of the SCCs (List of the Par�es)
Data exporter: The data exporter is the Customer specified in the Agreement.
Data importer: The data importer is Ironscales as specified in the Agreement.
Annex I.B of the SCCs (Descrip�on of Transfer)
Data subjects: Data subjects whose personal data are transferred include the data exporter’s representa�ves and end-
users and may include (i) individuals atemp�ng to communicate or transfer Personal Data to users of the Ironscales
Services, and (ii) the following types of data subjects:
● Customer’s employees and other users and the businesses and individuals with whom they correspond via
email or other communica�ons processed by Ironscales’ Services;
● Employees, contractors and temporary workers (current, former, prospec�ve) of data exporter or data
controller;
● Dependents of the above;
● Data exporter's or data controller’s collaborators/contact persons (natural persons) or employees,
contractors or temporary workers of collaborators/contact persons (current, prospec�ve, former);
● Users (e.g., customers, clients, visitors, etc.) and other data subjects that are users of data controller’s
products or services; or
● The data exporter’s partners, stakeholders or individuals who communicate or otherwise interact with
employees of the data exporter or data controller and use or interact with communica�on tools provided by
the data exporter where the contents of such communica�ons are processed by the Ironscales Services.
Categories of data: The personal data transferred that is included in e-mail, documents and other data in an electronic
form in the context of the Services. Ironscales acknowledges that, depending on Customer’s use of the Ironscales’ Services,
Customer may elect to include personal data from any of the following categories in the personal data:
● First name
● Last name
● Address
● Phone number
● Email address
● Authentication data (for example, user name, password, security questions and authentication codes, audit
trail);
● Social media identifiers;
● Unique identification numbers and signatures (for example, employee number, student number, patient
number, signature, unique identifiers in non-essential cookies or similar technologies);
9
● Pseudonymous identifiers;
● Location data (for example, mobile ID, geo-location network data, location by start call/end of the call. Location
data derived from use of wifi access points);
● Device identification (for example IMEI-number, SIM card number, MAC address);
● HR and recruitment data (for example declaration of employment status, recruitment information (such as
curriculum vitae, employment history, education history details), job and position data, including worked hours,
assessments and salary, work permit details, availability, terms of employment, tax details, payment details,
insurance details and location and organizations);
● Education data (for example education history, current education, grades and results, highest degree achieved,
learning disability);
● Citizenship and residency information (for example citizenship, naturalization status, marital status, nationality,
immigration status, passport data, details of residency or work permit);
● Email content and correspondence, including:
o Headers
o Links
o Attachments
o Photos
o Videos
o Audio and other files
o Metadata
o IP addresses
o Payment information
o Business information;
or
● Any other personal data identified in Article 4 of GDPR or special categories of personal data (aka sensitive data)
identified in Article 9 of GDPR that Customer provides to Ironscales for processing by the Services.
Sensitive data transferred: Any special categories of data provided by Customer in the course of its usage of the Services,
in particular such special categories of data as may be included in the contents of email communications processed by the
Services. With respect to such sensitive data, data importer shall take the safeguards specified in its technical and
organisational measures set forth in the DPA.
Processing operations: The personal data transferred will be subject to the following processing ac�vi�es, which apply to
Ironscales’ Subprocessors unless stated otherwise:
a. Duration and Frequency of Personal Data Processing. The duration of the personal data processing shall be for
the term designated under the Agreement and the DPA. The frequency of the personal data processing is continuous
during the term of the Agreement.
b. Nature and Purpose of the Personal Data Processing. The scope, nature and purpose of the data importer’s
processing of personal data are described in the Agreement and this DPA.
10
e. Customer Personal Data Retention, Deletion or Return. Upon expiration or termination of the Agreement or this
DPA, data importer shall provide all Customer data including personal data to Customer in a format reasonably
acceptable to Customer and data importer will delete Customer data including personal data, each in accordance
with the terms of the Agreement and the DPA.
Subprocessors: For purposes of Annex IB of the SCCs and solely in accordance with the Clause 9 of the SCCs, the data
importer may use the Subprocessors identified in the DPA to provide services that process personal data on data
importer’s behalf.
Annex I.C of the SCCs
Competent supervisory authority: the supervisory authority that shall act as competent supervisory authority shall be
determined in accordance with the terms of Clause 13(a) of the Clauses, taking account of the facts and circumstances of
the data exporter’s establishment and the data exporter’s appointment of a representa�ve, if any, pursuant to Ar�cle 27(1)
of Regula�on (EU) 2016/679.
Annex II to the Standard Contractual Clauses (Technical and Organisa�onal Measures)
Description of the technical and organizational security measures implemented by the data importer, including for
purposes of Annex II of the SCCs (Technical and Organisational Measures of the data importer):
1. Personnel. Data importer’s personnel will not process Customer personal data without authorization. Personnel are
obligated to maintain the confidentiality of any such Customer personal data and this obligation continues even after their
engagement ends.
2. Technical and Organization Measures. The data importer has implemented and will maintain appropriate technical and
organizational measures, internal controls, and information security routines intended to protect Customer data and
personal data in accordance with the requirements of the DPA, against accidental loss, destruction, or alteration;
unauthorized disclosure or access; or unlawful destruction as follows: The technical and organizational measures, internal
controls, and information security routines set forth Exhibit B of the DPA.
Annex III to the Standard Contractual Clauses (Subprocessors)
Ironscales is authorized to engage Subprocessors in accordance with the Agreement and the DPA. Where required for
purposes of Annex III of the SCCs (List of Subprocessors), the list of Subprocessors is set forth in Section 6 of the DPA, as
updated from time to time.
Annex IV to the Standard Contractual Clauses (Addi�onal Safeguards)
By the terms of this Annex IV, Ironscales provides additional safeguards to Customer and additional redress to the data
subjects to whose personal data processed by Customer and Ironscales relates.
This Annex supplements and is made part of, but is not in variation or modification of, the Standard Contractual Clauses.
1. Challenges to Orders. In the event Ironscales receives an order from any third party for compelled disclosure of
any personal data that has been transferred under the Standard Contractual Clauses, Ironscales shall:
a. use reasonable efforts to redirect the third party’s request, order or demand directly to Customer;
11
b. promptly notify Customer, unless prohibited under the law applicable to the requesting third party, and, if
prohibited from notifying Customer, use all lawful efforts to obtain the right to waive the prohibition in order to
communicate as much information to Customer as soon as possible; and
c. use all lawful efforts to challenge the order for disclosure on the basis of any legal deficiencies under the laws of
the requesting party or any relevant conflicts with the law of the European Union or applicable Member State
law.
For purpose of this section, lawful efforts do not include actions that would result in civil or criminal penalty such as
contempt of court under the laws of the relevant jurisdiction.
2. Indemnification of Data Subjects. Subject to Sections 3 and 4, Ironscales shall indemnify a data subject for any
material or non-material damage to the data subject caused by Ironscales’ disclosure of personal data of the data
subject that has been transferred under the Standard Contractual Clauses in response to an order from a non-EU/EEA
government body or law enforcement agency (a “Relevant Disclosure”). Notwithstanding the foregoing, Ironscales shall
have no obligation to indemnify the data subject under this Section 2 to the extent the data subject has already received
compensation for the same damage, whether from Ironscales or otherwise.
3. Conditions of Indemnification. Indemnification under Section 2 is conditional upon the data subject
establishing, to Ironscales’ reasonable satisfaction, that:
a. Ironscales engaged in a Relevant Disclosure;
b. the Relevant Disclosure was the basis of an official proceeding by the non-EU/EEA government body or law
enforcement agency against the data subject; and
c. the Relevant Disclosure directly caused the data subject to suffer material or non-material damage.
The data subject bears the burden of proof with respect to condi�ons a. though c.
Notwithstanding the foregoing, Ironscales shall have no obligation to indemnify the data subject under Section 2 if
Ironscales establishes that the Relevant Disclosure did not violate its obligations under Chapter V of the GDPR.
4. Scope of Damages. Indemnification under Section 2 is limited to material and non-material damages as provided
in the GDPR and excludes consequential damages and all other damages not resulting from Ironscales’ violation of the
GDPR.
5. Exercise of Rights. Rights granted to data subjects under this Annex may be enforced by the data subject against
Ironscales irrespective of any restriction in the Standard Contractual Clauses. The data subject may only bring a claim
under this Annex on an individual basis, and not part of a class, collective, group or representative action. Rights granted
to data subjects under this Annex are personal to the data subject and may not be assigned.
6. Notice of Change. In addition to the Standard Contractual Clauses, Ironscales agrees and warrants that it has no
reason to believe that the legislation applicable to it or its sub-processors, including in any country to which personal
data is transferred either by itself or through a sub-processor, prevents it from fulfilling the instructions received from
the data exporter and its obligations under this Appendix or the Standard Contractual Clauses and that in the event of a
change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided
by this Appendix or the Standard Contractual Clauses, it will promptly notify the change to Customer as soon as it is
aware, in which case Customer is entitled to suspend the transfer of personal data and/or terminate the contract.
7. Termination. This Annex shall automatically terminate if the European Commission, a competent Member State
supervisory authority, or an EU or competent Member State court approves a different lawful transfer mechanism that
would be applicable to the data transfers covered by the Standard Contractual Clauses (and if such mechanism applies
12
only to some of the data transfers, this Annex will terminate only with respect to those transfers) and that does not
require the additional safeguards set forth in this Annex.
13
EXHIBIT B TO THE STANDARD CONTRACTUAL CLAUSES
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
During the term of the processing of Customer personal data, Ironscales will employ the following technical and
organiza�onal measures for the processing and security of Customer personal data:
1. Implement appropriate environmental and physical security measures to prevent unauthorized access to restricted
informa�on and the systems managing it.
2. Manage and restrict access to only the resources necessary for users (applica�on, database, network, and system
administrators) to perform authorized func�ons. Ironscales should document all the user types and their related
permissions.
3. Require mul�-factor authen�ca�on and encryp�on that meet security standards for any remote access to
Confiden�al Informa�on and Customer’s network.
4. Use a secure method for securing authen�ca�on informa�on (Username and password) by acceptable security
standards. Below are the some of the key parameters for Password Requirements:
• Passwords must be at least eight characters in length. Longer is beter.
• User shall change password at least in every 180 days.
• New passwords cannot be the same as the previous four passwords.
• Passwords must contain both uppercase and lowercase characters (e.g., a-z and A-Z).
• Passwords must contain at least one number (e.g., 0-9).
• Users shall not use easy to guess passwords such as company name, names of pets, spouse, favorites, vendor
supplied default passwords, etc.
5. Separate virtually Customer’s informa�on from any other customer or Subprocessor’s own applica�ons and
informa�on, including but not limited to the public internet or any system used by Subprocessor. Informa�on shall
be protected using appropriate tools and measures, including but not limited to access control, firewall, an�-virus
applica�ons.
6. Not transfer and store Customer’s informa�on on removable devices, laptops, smartphones, tablets, etc., unless
agreed upon in advance with Customer in wri�ng. Ironscales shall implement security measures such as using strong
encryp�on (AES-256 and above) to protect all of Customer’s informa�on stored on mobile devices.
7. Regularly install the most recent system and security updates to systems that used to access, process, manage, or
store Customer’s informa�on.
8. Employ appropriate measures of iden�fica�on and access controls to any of the Ironscales’s systems and Customer’s
informa�on. Ironscales should save log files of all access to Customer’s informa�on and shall be provided to
Customer upon request.
9. Use only the mutually agreed upon facili�es and connec�on methodologies to remotely connect to Customer’s
network. Any connec�on to Customer’s informa�on sources using a remote connec�on is condi�oned on prior
approval.
10. Transfer of Confiden�al Informa�on between Customer and the Ironscales will be implemented by using secure file
transfer pla�orm.
11. Be responsible to architecture reviews, conduct penetra�on tests and/or code review to the Ironscales’s systems at
least once a year, or more than once, if there is any change in its systems. The penetra�on tests shall be conducted
by a third party. Customer shall be en�tled to receive the reports of such penetra�on tests upon its demand.
14
12. Without limi�ng the preceding measures, Ironscales is SOC 2 Type II cer�fied. Customer shall be en�tled to receive
the SOC 2 Type II report upon writen request
15