Snapshot 822
Normalized text
Scripts and page chrome removed; this is what change detection compares.
FEEDLY, INC.
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms a part of the Enterprise Subscription Agreement (“Agreement”) between
Feedly, Inc., a Delaware corporation with offices at 805 Veterans Blvd, Suite 220, Redwood City, CA 94063 (“Feedly”),
and the entity indicated on any Order Form that references or attaches this Agreement (“Customer”). This DPA is entered
into as of the date of the earliest to occur of the following: (a) execution of an Order Form for the Services; (b) Feedly’s
receipt of a purchase order or similar document referencing an Order Form; (c) Feedly’s receipt of Customer’s payment
for the Services pursuant to an Order Form; or (d) Customer’s use of the Services (the “Effective Date”). Customer’s use
of the Services is deemed to be a binding agreement to this DPA. All capitalized terms not defined in this DPA shall have
the meanings set forth in the Agreement. This DPA consists of the following:
A. The main body of this Data Processing Addendum
B. Schedule 1: Standard Contractual Clauses for the transfer of personal data to third countries pursuant to
Regulation (EU) 2016/679, Module Two: Transfer controller to processor
C. SCC Annex I: Details of the Processing of Personal Data
D. SCC Annex II: Security Measures
E. SCC Annex III: List of Sub-Processors
1. DEFINITIONS
1.1. “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code Sec. 1798.100 et seq. and its
implementing regulations as amended, including the California Privacy Rights Act (“CCPA”).
1.2. “Data Controller” means the entity which determines the purposes and means of the Processing of
Personal Data.
1.3. “Data Processor” means the entity which Processes Personal Data on behalf of the Data Controller.
1.4. “Data Protection Laws and Regulations” means all laws and regulations, including laws and regulations
of the European Union (“EU”), the European Economic Area (“EEA”) and their member states, Switzerland,
the United Kingdom, and the United States and its States applicable to the Processing of Personal Data
under the Agreement.
1.5. “Data Subject” means the individual to whom Personal Data relates.
1.6. “GDPR” means Regulation 2016/679 of the European Parliament and of the Council on the protection of
natural persons with regard to the processing of Personal Data and on the free movement of such data
(General Data Protection Regulation or “GDPR”) and for the purposes of this DPA includes the
corresponding laws of the United Kingdom (including the UK GDPR and Data Protection Act 2018). GDPR
is a Data Protection Law and Regulation.
1.7. “Personal Data” shall have the meaning given by Data Protection Laws and Regulations, generally including
any information relating to an identified or identifiable natural person, submitted or otherwise transferred to
Processor or a Sub-Processor in the course of providing the Services.
1.8. “Process” or “Processing” means any operation or set of operations which is performed upon Personal
Data, whether or not by automatic means, such as collection, recording, organization, storage, adaption, or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure, or destruction.
1.9. “Security Incident” means any unauthorized or unlawful breach of security that leads to accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.
1.10. “Services” means any product or service provided by Feedly to Customer pursuant to the Agreement.
1.11. “Standard Contractual Clauses” or “SCCs” means the standard contractual clause set out in the annex to
the commission implementing decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for
the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European
Parliament and of the Council, Module Two: Transfer controller to processor, with the elections set forth in
Schedule 1.
1.12. “Sub-Processor” means any Data Processor engaged by Feedly to assist in fulfilling its obligations with
respect to providing the Services pursuant to the Agreement or this DPA.
Page 1 of 9
1.13. “Supervisory Authority” means an independent public authority, which is established by an EEA or EU
Member State, or the United Kingdom, pursuant to the GDPR.
2. PROCESSING OF PERSONAL DATA
2.1. Role of the Parties. During the course of providing the Services, Data Processor may obtain, access or
otherwise Process Personal Data. The Parties acknowledge and agree that with regard to Processing
Personal Data, Customer will act as the Data Controller and Feedly will act as the Data Processor under this
Addendum.
2.2. Customer’s Processing of Personal Data. Customer agrees that (i) it shall comply with its obligations as
a Data Controller under Data Protection Laws and Regulations in respect of its Processing of Personal Data
and any processing instructions it issues to Feedly; (ii) it shall have sole responsibility for the accuracy of
Personal Data made available to Feedly and the means by which Data Controller acquired Personal Data;
and (iii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data
Protection Laws and Regulations for Feedly to Process Personal Data and provide the Service pursuant to
the Agreement and this DPA. Customer will indemnify Feedly for any breach of the foregoing obligations.
2.3. Feedly’s Processing of Personal Data. Feedly shall Process this Personal Data only for the purposes
described in this DPA and only in accordance with Customer’s documented lawful instructions. The parties
agree that this DPA and the Agreement set out Customer’s complete and final instructions to Feedly in
relation to the Processing of Personal Data and Processing outside the scope of these instructions (if any)
shall require prior written agreement of Customer and Feedly. Feedly shall notify Customer promptly if an
instruction for the Processing of Personal Data infringes applicable Data Protection Laws and Regulations.
Feedly shall monitor the Processing of Personal Data to ensure that Processing is carried out consistent
with this DPA and in compliance with applicable Data Protection Laws and Regulations.
2.4. Details of the Processing. The subject matter of Processing Personal Data by Feedly is the performance
of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the
Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are
further specified in Annex 1 to the SCC.
2.5. Confidentiality of Personal Data. Feedly shall ensure that its personnel engaged in the Processing of
Personal Data are informed of the confidential nature of Personal Data, have received appropriate training
on their responsibilities, and have executed written agreements containing confidentiality obligations that
survive the termination of their engagement with Feedly. In addition, Feedly shall take commercially
reasonable steps to limit access to Personal Data to those personnel who require such access to perform
the Agreement.
2.6. Retention Policy. Upon expiration or termination of the Agreement, Feedly will delete all Personal Data (if
any) upon Customer’s request via email to privacy@feedly.com.
3. SUB-PROCESSORS
3.1. Authorized Sub-Processors. Customer acknowledges and agrees that Feedly may engage the Authorized
Sub-Processors as set forth in Annex III to the SCC (the “List”) to access and Process Personal Data in
connection with the Agreement. The current version of the List is available at
https://feedly.com/legal/subprocessors. Feedly shall enter into a written agreement with each Authorized
Sub-Processors containing data protection obligations no less protective than those in this DPA (including
confidentiality obligations) with respect to the protection of Personal Data.
3.2. Notification of new Sub-Processors. At least thirty (30) days before enabling any third party other than
Authorized Sub-Processors to access or participate in the Processing of Personal Data, Feedly will add such
third party to the List. Customer is responsible for checking the List for updates. Customer may request
that it be notified by email of any changes to the List by emailing sales@feedly.com, or reaching out the
Feedly Customer Service. Customer may object to any changes in writing within ten (10) days of receipt of
the aforementioned notice by Feedly.
3.3. Customer Objections. In the event that Customer reasonably objects to an engagement in accordance
with Section 3.2, Feedly shall provide Customer with a written description of commercially reasonable
alternative(s), if any, to such engagement, including without limitation modification to the Services. If Feedly,
in its sole discretion, cannot provide any such alternative(s), or if Customer does not agree to any such
alternative(s) if provided, then Customer may terminate the applicable Order Form(s) with respect to those
Page 2 of 9
Services which cannot be provided by Feedly without use of the objected-to new Sub-Processors, by
providing written notice to Feedly. Termination shall not relieve Customer of any fees owed to Feedly under
the Agreement.
3.4. No Objections. If Customer does not object to the engagement of a third party in accordance with Section
3.2 within ten (10) days of notice by Feedly, that third party will be deemed an Authorized Sub-Processors
for the purposes of this Addendum.
3.5. Liability for Authorized Sub-Processors. Feedly shall be liable to Customer for the acts and omissions of
Authorized Sub-Processors to the same extent that Feedly itself would be liable under this Addendum had
it conducted such acts or omissions.
4. RIGHTS OF DATA SUBJECTS
4.1. Data Subject Request. Feedly shall, to the extent permitted by law, promptly notify Customer upon receipt
of a request by a Data Subject to exercise the Data Subject’s right of: access, rectification, erasure, data
portability, restriction or cessation of Processing, withdrawal of consent to Processing, and/or objection to
being subject to Processing that constitutes automated decision making (such requests individually and
collectively “Data Subject Requests”). If Feedly receives a Data Subject Request in relation to Customer’s
Personal Data, Feedly shall advise the Data Subject to submit their request to the Customer, and Customer
shall be responsible for responding to such request, including where necessary by using the functionality of
the Services.
4.2. Feedly assistance to Customer for Data Subject Request(s). Feedly shall, at the request of Customer,
and taking into account the nature of the Processing applicable to any Data Subject Request, apply technical
and organizational measures to assist Customer in complying with the Customer’s obligation to respond to
such Data Subject Request and/or in demonstrating such compliance, where possible, provided that (i)
Customer is itself unable to respond without Feedly’s assistance and (ii) Feedly is able to do so in
accordance with all applicable laws, rules, and regulations. Customer shall be responsible to the extent
legally permitted for any costs and expenses arising from any such assistance by Feedly.
4.3. Complaints or Notices related to Personal Data. In the event Feedly receives any official complaint or
notice that relates to Feedly’s Processing of Personal Data or either Party's compliance with Data Protection
Laws and Regulations in connection with Personal Data, to the extent legally permitted, Feedly shall
promptly notify Customer and, to the extent applicable, Feedly shall provide Customer with commercially
reasonable cooperation and assistance in relation to any such complaint or notice. Customer shall be
responsible to the extent legally permitted for any costs and expenses arising from any such assistance by
Feedly.
5. SECURITY MEASURES. Taking into account the state of the art, the costs of implementation and the nature,
scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and
freedoms of natural persons, Feedly shall maintain appropriate technical and organizational measures, as set forth
in Annex II to the SCC to ensure a level of security appropriate to the risk of Processing Personal Data.
6. SECURITY BREACH NOTIFICATIONS AND AUDITS
6.1. Notification of a Security Incident. Upon becoming aware of a Security Incident, Feedly shall notify
Customer without undue delay and shall provide timely information relating to the Security Incident as it
becomes known or as is reasonably requested by Customer.
6.2. Assistance with a DPIA. Feedly shall, taking into account the nature of the Processing and the information
available to it, provide Customer with reasonable cooperation and assistance where necessary for Customer
to comply with a mandatory obligation to conduct a data protection impact assessment (“DPIA”) under
applicable Data Protection Laws and Regulations, and/or to demonstrate compliance with Data Protection
Laws and Regulations, provided that Customer does not otherwise have access to the relevant information.
Customer shall be responsible to the extent legally permitted for any costs and expenses arising from any
such assistance by Feedly.
6.3. Assistance in Cooperation with Supervisory Authorities. Feedly shall, taking into account the nature of
the Processing and the information available to it, provide Customer with reasonable cooperation and
assistance with respect to Customer’s cooperation and/or prior consultation with any Supervisory Authority,
where necessary and where required by applicable Data Protection Laws or Regulations. Customer shall be
Page 3 of 9
responsible to the extent legally permitted for any costs and expenses arising from any such assistance by
Feedly.
6.4. Records. Feedly shall maintain records sufficient to demonstrate its compliance with its obligations under
this DPA, and retain such records for a period of three (3) years after the termination of the Agreement.
Customer shall, with reasonable notice to Feedly, have the right to review, audit and copy such records at
Feedly’s offices during regular business hours.
6.5. Audits. Feedly’s data center is certified NIST 800-53/FISMA, SOC 1 Type II, PCI-DSS, ISO 27001 and SOC-
2 Type II. Upon Customer’s request, Feedly shall, no more than once per calendar year, allow Customer or
its authorized representative, upon reasonable written request, subject to written confidentiality
agreement(s), and at a mutually agreeable data and time, to conduct an audit or inspection of Feedly’s data
security infrastructure that is sufficient to demonstrate Feedly’s compliance with its obligations under this
DPA, provided that Customer shall provide reasonable prior notice of any such request for an audit and such
inspection shall not be unreasonably disruptive to Feedly’s business. Customer shall be responsible for the
costs of any such audits or inspections. Upon receipt of a written request to audit, and subject to Customer’s
agreement, Feedly may satisfy such audit request by providing a confidential copy of Feedly’s then most
recent third party audit report or certification demonstrating the technical and organizational security
measures Feedly has in place to ensure compliance with its obligations under this DPA.
6.6. Notice of Failure to Comply. After conducting an audit or after receiving a third party audit report or
certification under Section 6.5, Customer shall notify Feedly in writing of the specific manner, if any, in which
Customer alleges Feedly does not comply with an obligation under this DPA. Any such information will be
deemed Confidential Information of Feedly. Upon such notice, Feedly will utilize commercially reasonable
efforts to make any necessary changes to ensure compliance with such obligations. If Feedly is unable or
unwilling to undertake or implement the necessary changes, Feedly may terminate the Agreement and any
applicable Order Forms upon written notice and refund Customer any prepaid Fees for the prorated portion
of unused Subscription Term.
7. TRANSFER MECHANISMS FOR DATA TRANSFERS
7.1. Application of the Standard Contractual Clauses. The SCCs, Module Two: Transfer Controller to
Processor, the options noted in Schedule 1, and the terms of this Section 7 apply to any transfer of Personal
Data made subject to this DPA from member states of the European Union, Iceland, Liechtenstein, Norway,
United Kingdom, or Switzerland, either directly or via onward transfer, to any country or recipient that is: (i)
not recognized by the European Commission as providing an adequate level of protection for personal data
under the GDPR, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts
as providing adequate protection for personal data, and shall be deemed entered into and incorporated into
this DPA. Any enforcement of the SCCs in accordance with Clause 3 by a Data Subject or an association or
other body on a Data Subject’s behalf, will be subject to the terms of this DPA by reference. With regard to
Clause 14(a) of the SCCs, the parties acknowledge and agree that Feedly can meet its obligations under the
SCCs considering the laws of the receiving country as well as the limited volume and categories of data, the
non-sensitive nature of the data, and Feedly’s history indicating (to Feedly’s knowledge) that it and similar
organizations are not a target for government information requests or surreptitious surveillance. On this
basis, additional, supplemental measures are not required for the transfers envisaged under the SCCs other
than the contractual safeguards contained therein and the security measures employed by Feedly reflected
in Annex II to the SCC.
7.2. Data Transfers Subject to Jurisdiction-Specific Laws. For transfers of Personal Data subject to the UK
GDPR, the UK Addendum available at https://feedly.com/legal/dpa/UK will apply and shall be deemed
entered into and incorporated into this DPA by reference. For transfers of Personal Data subject to the
Swiss Data Protection Act, the Swiss Addendum available at https://feedly.com/legal/dpa/CH will apply and
shall be deemed entered into and incorporated into this DPA by reference.
7.3. Instructions. For purposes of Clause 8.1 of the SCCs, the following is deemed an instruction by the
Controller to Process Personal Data: (a) at the request of Controller, including requests made in connection
with the Services; and (b) at the request of Controller’s employees in their use of the Services.
7.4. Audits and Certifications. The Parties agree that the audits described in Clause 8.9 of the Standard
Contractual Clauses will be carried out in accordance with the specifications described in Sections 6.5 and
6.6 herein.
Page 4 of 9
7.5. Certification of Deletion. The Parties agree that the certification of deletion of Personal Data that is
described in Clause 8.5 shall be provided to Controller by Processor only upon Controller’s request.
7.6. Conflict. In the event of any conflict or inconsistency between this DPA and Schedule 1, between this DPA
and Schedule 2, and/or between this DPA and Schedule 3, then Schedule 1, Schedule 2 and/or Schedule
3, where applicable, shall prevail.
7.7. Execution of the SCCs. The parties hereby agree that: (a) execution of an Order Form for the Services; (b)
Feedly’s receipt of a purchase order or similar document referencing an Order Form; (c) Feedly’s receipt of
Customer’s payment for the Services pursuant to an Order Form; or (d) Customer’s use of the Services is
deemed to be a binding agreement to this DPA and the SCCs, Module Two: Transfer Controller to Processor,
with the options noted in Schedule 1, and all SCC Annexes. This DPA and its Schedule 1, which
incorporates the SCC with the options noted in Schedule 1, and all SCC Annexes, are hereby incorporated
by reference into the Agreement.
8. LIMITATION OF LIABILITY. Each party’s liability taken together and in the aggregate arising out of or related to
this DPA whether in contract, tort, or under any theory of liability, is subject to the “Limitation of Liability” clause of
the Agreement, and any reference in such clause to the liability of a party means the aggregate liability of that
party under the Agreement and the DPA together.
Page 5 of 9
DPA
SCHEDULE 1
Standard Contractual Clauses
for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679
(Module Two: Transfer controller to processor)
The parties hereby agree to that the standard contractual clauses for the transfer of personal data to third countries
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council are hereby incorporated by
reference in their entirety.
The SCCs are avabilable at https://commission.europa.eu/publications/standard-contractual-clauses-international-
transfers_en.
The parties hereby agree to the following options to the SCCs:
Module Two throughout the SCCs applies. All refereces to Module One, Module Three, and Module Four
provisions are of no effect.
Clause 7 (Docking clause): This option clause is included.
Clause 9(a) (Use of sub-processors): Option 2 applies and the time period is: thirty (30) days.
Clause 11 (Redress): The option under subsection (a) is not included.
Clause 17 (Governing law): Option 1 applies and the Member State is: the country indicated in the governing
law provision of the Agreement, unless such country is not an EU Member State, in which case these Clauses
shall be governed by the laws of Ireland.
Clause 18 (Choice of forum and jurisdiction): Under Section (b), the Member state is: the country indicated in
the jurisdiction provision of the Agreement, unless such country is not an EU Member State, in which case the
courts of Ireland will have forum and jurisdiction over any disputes relating to these Clauses.
For convenience, the full text of the SCCs with the above-mentioned elections are available at
https://feedly.com/legal/dpa/sccs.
Page 6 of 9
ANNEX I
to the
Standard Contractual Clauses
(Details of the Processing of Personal Data)
A. LIST OF PARTIES.
Data exporter/Data Controller
Customer and its Affiliates located within the European Economic Area, as defined in the Agreement and set
forth in the applicable Order Form.
Data importer/Data Processor
Feedly, Inc., a Delaware, USA corporation, 805 Veterans Blvd, Suite 220, Redwood City, CA 94063 USA
B. DESCRIPTION OF TRANSFERS.
Data subjects
The personal data transferred concern the following categories of data subjects (please specify):
Data exporter may submit personal data to the data importer through the Services, the extent of which is
determined and controlled by the data exporter and which may include, but is not limited to, personal data
relating to the following categories of data subject:
• authorized users or administrators of the Services who are employees of the data exporter
Categories of Data Subjects
Customer may submit Personal Data to the Services, the extent of which is determined and controlled by
Customer in its sole discretion, and which may include the following categories of data:
• Customer’s Users
Categories of Personal Data Transferred
• First Name and Last Name
• Contact information (business email address, business phone, physical business address)
• IP address
Special categories of data (“sensitive data,” if appropriate)
NONE
Frequency of the transfer
Data will be transferred on a continuous basis.
Nature and Purpose of the Processing
Feedly and/or its Sub-Processors will Process Personal Data as necessary to perform the Services pursuant
to the Agreement and as instructed by Customer. The personal data transferred will be subject to the
following basic Processing activities:
• Storage and display
• Providing tracking and dashboard view functionality
• Providing customer and technical support
Duration of the Processing/Retention of Personal Data
Feedly will Process the Personal Data for the duration of the Agreement, and delete the Personal Data in
accordance with its standard schedule and procedures.
C. COMPETENT SUPERVISORY AUTHORITY.
The Competent Supervisory Authority, in accordance with the SCCs, Clause 13, will be the Irish Data Protection
Commission.
Page 7 of 9
ANNEX II
to the
Standard Contractual Clauses
(Security Measures)
(A) Control of physical access Technical and organizational measures to control physical access to premises and facilities, particularly to
to premises identify permitted personnel at entry:
1. Feedly’s corporate office has locks. No personal data is stored at the corporate office.
2. Feedly’s servers are located at Equinix. These Feedly servers store and process customer data including
personal data. Equinix’s security protocols can be found
here.
(B) Control of access to IT Technical and organizational security measures designed to ensure that users with access to the relevant IT
systems systems are identified and authenticated:
1. IT security systems requiring individual users to log in using unique user names.
2. IT security systems requiring the use of strong / complex passwords.
3. Additional system log-in requirements for particular applications.
4. State-of-the art encryption applied to all data ‘in transit’.
5. Automatic locking of IT terminals and devices after periods of non-use, with passwords required to ‘wake’ the
terminal or device.
6. Password databases are subject to strong encryption / hashing.
7. Training for employees regarding access to IT systems.
(C) Control of access to Technical and organizational security measures designed to ensure that users with access to the relevant
personal data personal data are identified and authenticated:
• ‘Read’ rights for systems containing personal data restricted to specified personnel roles
• ‘Edit’ rights for systems containing personal data restricted to specified personnel roles or profiles
• Logging of all attempts to access systems containing personal data (e.g., recording IP addresses and
username combinations)
• Training for employees regarding access to personal data
(D) Control of disclosure of Technical and organizational measures to securely transfer, transmit and communicate or store data on data
personal data media and for subsequent checking:
• Secure data networks (e.g., encrypted VPNs)
• State-of-the art encryption for all systems used to send personal data
• SSL encryption for all internet access portals
• Training for employees regarding transfers of personal data
(E) Control of input Technical and organizational security measures to permit the recording and later analysis of information about
mechanisms when input to data systems (e.g., editing, adding, deleting, etc.) occurred and who was responsible for such
input:
• Logging of all input actions in systems containing personal data
• ‘Edit’ rights for systems containing personal data restricted to specified personnel roles Profiles
• Binding agreements in writing with all employees who process personal data, imposing confidentiality
obligations
• Training for employees regarding editing of personal data
(F) Control of workflows Technical and organizational measures to segregate the responsibilities between controllers and processors
between controllers and processing the relevant personal data:
processors • Binding agreements in writing governing the appointment and responsibilities of processors with access to the
relevant personal data
• Binding agreements in writing governing the allocation of data protection compliance responsibilities between
all controllers with access to the relevant personal data
• Training for employees regarding processing of personal data
(G) Control mechanisms to Technical and organizational measures to ensure the physical and electronic availability and accessibility of the
ensure availability of the relevant personal data:
relevant personal data • Asynchronous data replication in another physical location
• Redundant power supplies
• Physical security (e.g., secure premises; security personnel; etc.).
• Security alarm systems
• Electronic security (e.g., firewalls)
• Environmental controls (e.g., cooling; humidity controls; etc.)
• Fire protection (e.g., sprinkler systems; fireproof doors; etc.)
Page 8 of 9
ANNEX III
to the
Standard Contractual Clauses
(List of Sub-Processors)
Customer acknowledges and agrees that Feedly may engage the Authorized Sub-Processors as set forth in this Annex
III to the SCC (the “List”) to access and Process Personal Data in connection with the Agreement. The current version of
the List is available at:
https://feedly.com/legal/subprocessors
At least thirty (30) days before enabling any third party other than Authorized Sub-Processors to access or participate in
the Processing of Personal Data, Feedly will add such third party to the List. Customer is responsible for checking the List
for updates. Customer may request that it be notified by email of any changes to the List by emailing sales@feedly.com
or reaching out the Feedly Customer Service. Customer may object to any changes in writing within ten (10) days of
receipt of the aforementioned notice by Feedly, or within the timeline agreed to between Feedly and Customer in a signed
writing.
Page 9 of 9