Snapshot 91607
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CUSTOMER DATA PROCESSING AGREEMENT
(Gigamon as Supplier)
Signature Version
This Data Processing Agreement (“DPA”) applies to the Processing of Personal data by Gigamon on Customer’s
behalf when providing the Gigamon Offerings described in the relevant Agreement between Customer and
Gigamon Inc. (collectively, the “Parties“). In the event of a conflict between the terms of the Agreement and this
DPA, the terms of this DPA shall control. In the event of a conflict between the terms of this DPA and the EU
Standard Contractual Clauses, the terms of the EU Standard Contractual Clauses shall control. Gigamon reserves
the right to periodically update this DPA, which is available at www.gigamon.com/data-processing-
agreement.pdf.
1. Definitions. Capitalized terms that are used but not otherwise defined in this DPA shall have the
meanings given in the applicable Agreement or Data Protection Legislation.
“Agreement” means the underlying agreement(s) and any applicable order form in effect between the
Parties relating to the Gigamon Offerings, including attachments and exhibits, or other written or
electronic terms of service or subscription agreement, including without limitation this DPA upon its
effectiveness.
“Affiliate” shall have the meaning given in the Agreement; if no definition is set forth in the Agreement,
it shall mean any entity that Customer directly or indirectly controls (e.g. subsidiary), or is controlled by
(e.g. parent) or which is under common control (e.g. sibling). “Control” means the ownership, direct or
indirect, of a majority of an entity’s stock or other interest allowing the owner to direct the affairs of
such entity.
“Authorized Affiliate” shall mean an Affiliate of Customer that has not signed a separate agreement with
Gigamon, but is either a Controller or Processor for the Personal Data processed by Gigamon pursuant to
the Agreement, for so long as such entity remains an Affiliate of Customer.
“Approved Jurisdiction” means a jurisdiction that has either been approved as having adequate legal
protections for data by the European Commission or the United Kingdom Information
Commissioner’s Office, or where data transfers contemplated by this Agreement are not otherwise
restricted under the relevant Data Protection Legislation.
“Controller” shall have the meaning attributed to it in the EU GDPR or the UK GDPR, as applicable.
“Customer” shall mean the end customer who has purchased the relevant Gigamon Offerings, whether
directly from Gigamon or through an authorized channel partner, together with all Affiliates of
Customer that are authorized to purchase or use Gigamon Offerings for their own account pursuant to
the Agreement.
“Data Protection Legislation” means all applicable data protection laws, regulations, and regulatory
requirements in the relevant jurisdiction applicable to the respective Party in its role in the Processing of
Personal Data under the Agreement and this DPA, which may include (1) the EU GDPR, the UK GDPR,
and other relevant data protection laws of the EU and its Member States, Iceland, Liechtenstein,
Norway, and the Swiss Federal Data Protection Act (“FADP”); and (2) the California Consumer Privacy
Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), any other United States state
privacy legislation of similar scope to the aforementioned statutes that become enforceable after
execution of this DPA, all of which as may be amended from time to time.
“Data Subject” shall mean an identified or identifiable natural person to whom Personal Data relates.
“DPA Effective Date” shall be the last to occur of the effective date of the Agreement or the date of
initial delivery of the Gigamon Offerings to which this DPA relates (but not later than the first date of
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 1 of 11
Processing of Personal Data for such purpose).
“EEA” means the European Economic Area.
“EU” means the European Union.
“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016.
“EU Standard Contractual Clauses” or “EU SCCs” means the standard data protection clauses for the
transfer of Personal Data to processors established in third countries, as described in Article 46 of the EU
GDPR pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard
Contractual Clauses, as approved by the European Commission in the European Commission’s
Implementing Decision 2021/914/EU of 4 June 2021.
“Gigamon” means Gigamon Inc., with offices at 3300 Olcott Street, Santa Clara, CA 95054, U.S.A., and its
direct and indirect subsidiaries.
“Gigamon Offering(s)” means Gigamon-branded hardware, software and Services procured by Customer
directly from Gigamon or through an authorized channel partner.
“Personal Data” means any personal data, personal information or similar term as defined in the Data
Protection Legislation, that Gigamon Processes in connection with the Gigamon Offering.
“Processing” or “Process” shall have the meaning attributed to it in the applicable Data Protection
Legislation.
“Security Documentation” means the documentation describing the Security Measures and any other
documents and information made available by Gigamon.
“Security Incident” means the accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to, Personal Data in Gigamon’s possession, custody or control.
“Security Measures” has the meaning given in Section 5.2 (Gigamon Security Measures).
“Services” means any services provided by Gigamon pursuant to the Agreement, including but not limited
to support and maintenance services and professional services.
“Sub-processors” means third parties engaged by Gigamon to Process Personal Data in relation to the
Gigamon Offering.
“Term” means the period from the DPA Effective Date until the end of Gigamon’s provision of the
applicable Gigamon Offering pursuant to the Agreement.
“Third-Party Controller” means an entity other than Customer or Gigamon that is a Controller with
respect to Personal Data being processed hereunder.
"UK Addendum” means the template addendum B.1.0 issued by the UK Information Commissioner and
laid before the UK Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February
2022, as it is revised under Section 18 thereof, found at https://ico.org.uk/media/for-
organisations/documents/4019539/international-data-transfer-addendum.pdf
“UK GDPR” means the Retained Regulation (EU) 2016/679 (UK GDPR) and the Data Protection Act 2018
(DPA 2018).
2. Duration and Scope of DPA. This DPA will take effect on the DPA Effective Date and, notwithstanding
the expiration of the Term, will remain in effect until, and automatically expire upon termination or expiration
of the Agreement, or until such time as Gigamon no longer Processes Personal Data. This DPA applies where
and only to the extent that Gigamon Processes Personal Data on behalf of Customer as Data Processor in the
course of providing the Gigamon Offerings. Notwithstanding the foregoing, Gigamon will continue to comply
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 2 of 11
with the relevant provisions of this DPA until Customer’s Personal Data has been deleted in accordance with
Section 4 of this DPA.
3. Roles and Regulatory Compliance.
3.1. Processor and Controller Responsibilities. The parties acknowledge and agree that:
3.1.1. The subject matter and details of the Processing are described in Appendix 1; and
3.1.2. Gigamon is a Processor of that Personal Data under Data Protection Legislation, in each
case regardless of whether Customer acts as a Controller or as a Processor on behalf of a third-Third-Party
Controller; and
3.1.3. Customer is a Controller of that Personal Data under Data Protection Legislation; and
3.1.4. Gigamon will inform Customer if it believes that Customer’s instructions with respect to
the Processing of Personal Data violate the EU GDPR, UK GDPR or Member State provisions; and
3.1.5. Each party will comply with the obligations applicable to it in such role under the Data
Protection Legislation with respect to that Personal Data.
3.2. Customer Responsibilities. Customer agrees that: (a) Customer has established, or ensured that
another party has established, a legal basis for Gigamon’s Processing of Personal Data contemplated by this
DPA; (b) to the extent required by Data Protection Legislation given the context of the Processing and unless
another legal basis supports the lawfulness of Processing, all notices have been given to, and consents and
rights have been obtained from, the relevant Data Subjects and any other party as may be required under
applicable law (including Data Protection Legislation) for such Processing; and (c) Personal Data does not and
will not contain Special Categories of Personal Data, as defined in Article 9.1 of the EU GDPR and the UK GDPR;
(d) Customer will keep the amount of Personal Data provided to Gigamon to the minimum necessary for the
provision of the relevant Gigamon Offerings; and (e) Customer will ensure a level of security appropriate to the
particular content of the Personal Data in accordance with the requirements of the applicable Data Processing
Legislation, including without limitation pseudonymizing and backing-up Personal Data and securing the
account authentication credentials, systems and devices Customer uses to access the Gigamon Offerings.
3.3. Scope of Processing and Authorization.
3.3.1. Customer’s Instructions. By entering into this DPA, Customer instructs Gigamon to Process
Personal Data: (a) to provide the Gigamon Offerings, including Processing initiated by Customer’s users in their
use of Offerings; (b) as authorized by the Agreement, including this DPA; and (c) as further documented in any
other written instructions given by Customer and acknowledged in writing by Gigamon. Where applicable,
Customer shall be responsible for any communications, notifications, assistance and/or authorizations that
may be required in connection with a Third-Party Controller.
3.3.2. Gigamon’s Compliance with Instructions. Gigamon will only Process Personal Data in
accordance with Customer’s instructions described in Section 3.3.1 unless Data Protection Legislation requires
otherwise, in which case Gigamon will notify Customer in writing (unless that law prohibits Gigamon from
doing so on important grounds of public interest).
3.3.3. CCPA. As used in this sub-Section 3.3.3, the terms “Sell,” “Share,” “Business Purpose,”
and “Commercial Purpose” shall have the meanings given in the CCPA and “Personal Information” shall mean
any personal information (as defined in the CCPA) contained in Personal Data. To the extent the CCPA applies,
Gigamon will not: (a) Sell or Share any Personal Information; or (b) retain, use, or disclose any Personal
Information (i) for any purpose other than for the Business Purposes specified in the Agreement, including for
any Commercial Purpose other than the Business Purposes specified in the Agreement, or as otherwise
permitted by the CCPA, or (ii) outside of the direct business relationship between Gigamon and Customer; or
(c) combine Personal Information received from, or on behalf of, Customer with Personal Data received from
or on behalf of any third party, or collected from Gigamon’s own interaction with Data Subjects, except to
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 3 of 11
perform any Business Purpose permitted by the CCPA. Gigamon hereby certifies that it understands the
foregoing restrictions under this Section and will comply with them. The parties acknowledge that the
Personal Information disclosed by Customer to Gigamon is provided to Gigamon only for the limited and
specified purposes that constitute the Permitted Purpose. Gigamon will comply with applicable obligations
under the CCPA and provide the same level of privacy protection to Personal Information as is required by the
CCPA. Customer has the right to take reasonable and appropriate steps to help ensure that Gigamon uses the
Personal Information transferred in a manner consistent with Customer's obligations under the CCPA by
exercising Customer's audit rights in Section 7 (Reviews and Audits of Compliance). Gigamon will notify
Customer if it makes a determination that Gigamon can no longer meet its obligations under the CCPA. If
Gigamon notifies Customer of unauthorized use of Personal Information, including under the foregoing
sentence, Customer will have the right to take reasonable and appropriate steps to stop and remediate such
unauthorized use by limiting the Personal Information shared with Gigamon, terminating the portion of the
Agreement relevant to such unauthorized use, or such other steps mutually agreed between the Parties in
writing.
3.4. Authorized Affiliates. Gigamon’s obligations set forth in this DPA shall also extend to Authorized
Affiliates, subject to the following conditions:
3.4.1. Customer must exclusively communicate any additional Processing instructions requested
pursuant to 3.3.2 directly to Gigamon, including instructions from Authorized Affiliates;
3.4.2. Customer shall be responsible for Authorized Affiliates’ compliance with this DPA and all
acts and/or omissions by an Authorized Affiliate with respect to Customer’s obligations in this DPA shall be
considered the acts and/or omissions of Customer.
3.4.3. Authorized Affiliates may only bring a claim directly against Gigamon if they have acceded
in writing to this DPA. Otherwise, if an Authorized Affiliate seeks to assert a legal demand, action, suit, claim,
proceeding, or otherwise against Gigamon (“Authorized Affiliate Claim”), Customer must bring such Authorized
Affiliate Claim directly against Gigamon on behalf of such Authorized Affiliate, unless Data Protection
Legislation requires the Authorized Affiliate be a party to such claim.
4. Data Deletion and Retention.
4.1. Deletion on Termination. On termination of the Agreement or expiry or termination of the Term
and at the choice of the Customer, Gigamon will either delete or return (in a commonly machine-readable
format) the Personal Data to the Customer unless Data Protection Legislation requires or permits continued
retention and Processing of the Personal Data.
4.2. Retention. Personal Data will be retained as needed to fulfill the purposes for which it was
collected, such as delivery of the Gigamon Offerings, and as necessary for Gigamon to comply with its business
requirements, legal obligations, resolve disputes, protect its assets, and enforce its rights and agreements
(“Business Requirements”). Gigamon will use commercially reasonable efforts to implement and maintain
appropriate retention periods for Personal Data in accordance with Data Protection Legislation. Gigamon will
delete Personal Data when retention of such data is no longer necessary for the purposes of Processing under
this DPA, subject only to situations where a longer period is necessary for Gigamon’s Business Requirements
or is required under Data Protection Legislation or other governing laws.
5. Data Security.
5.1. General. Taking into account the state of the art, the costs of implementation, and the nature,
scope context and purposes of the Processing as well as the risk of varying likelihood and severity to the rights
and freedoms of natural persons, the Parties shall implement and maintain appropriate technical and
organizational measures to ensure a level of security appropriate to the risk.
5.2. Gigamon Security Measures. Gigamon will implement and maintain technical and organizational
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 4 of 11
measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of or access to Personal Data as described in the Security Measures Addendum to this
DPA, which may be found at www.gigamon.com/security-measures-addendum.pdf (the “Security Measures”),
and which is hereby incorporated into this DPA by reference.
5.3. Security Controls; Confidentiality of Processing. Gigamon may grant access to Personal Data to
employees, contractors and Sub-processors under an appropriate obligation of confidentiality (whether a
contractual or statutory duty) when such access is required to perform their job duties.
5.4. Gigamon Security Assistance. Gigamon will (taking into account the nature of the Processing of
Personal Data and the information available to Gigamon) provide Customer with reasonable assistance
necessary for Customer to comply with its obligations in respect of Personal Data under Data Protection
Legislation, including Articles 32 to 36 (inclusive) of the EU GDPR and UK GDPR, by:
5.4.1. implementing and maintaining the Security Measures in accordance with Section 5.2
(Gigamon Security Measures), and
5.4.2. complying with the terms of Section 6 (Notice and Communication).
5.5 No Assessment of Personal Data by Gigamon. Gigamon shall have no obligation to assess the
contents or accuracy of Personal Data, including to identify information subject to any specific legal,
regulatory, or other requirement. Customer is responsible for reviewing the information made available by
Gigamon relating to data security and making an independent determination as to whether the Offerings meet
Customer’s requirements and legal obligations under Data Protection Legislation.
6. Notice and Communication.
6.1. Notification of Security Incident. If Gigamon becomes aware of a Security Incident, Gigamon will
(a) promptly take reasonable steps to investigate the Security Incident and (b) notify Customer of the Security
Incident without undue delay, in accordance with governing law.
6.2. Communication. Gigamon shall provide Customer timely information about the Security Incident
including, to the extent known to Gigamon: (a) description of the nature of the Security Incident, (b) the name
and contact details for the contact point to find more information, (c) a description of likely consequences of
the Security Incident, (d) a description of the measures taken or proposed to be taken to address the Security
Incident including, where appropriate, measures to mitigate its possible adverse effects, and (e) such other
information as is necessary for Customer to carry out Customer’s notification obligations related to the
Security Incident, including, but not limited to, to assist Customer in complying with Articles 33 and 34 of EU
GDPR. Notwithstanding the foregoing, Customer acknowledges that because Gigamon personnel may not
have visibility to the content of Personal Data, it may be unlikely that Gigamon can provide information as to
the particular nature of the Personal Data, or where applicable, the identities, number or categories of
affected Data Subjects. Communications by or on behalf of Gigamon with Customer in connection with a
Security Incident shall not be construed as an acknowledgment by Gigamon of any fault or liability with respect
to the Security Incident.
6.3 Complaints or Notices Related to Personal Data. If Gigamon receives any official complaint,
notice, or communication that relates to Gigamon's Processing of Personal Data or either Party's compliance
with Data Protection Legislation in connection with Personal Data, to the extent legally permitted, Gigamon
shall promptly notify Customer and, to the extent applicable, Gigamon shall provide Customer with
commercially reasonable cooperation and assistance in relation to any such complaint, notice, or
communication. Customer shall be responsible for any reasonable costs arising from Gigamon’s provision of
assistance in relation to any official complaint, notice, or communication that relates to Customer’s
compliance with Data Protection Legislation.
7. Reviews and Audits of Compliance.
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 5 of 11
7.1. Audit. Customer may audit Gigamon’s compliance with its obligations under this DPA as required
by Data Protection Legislation, but not more than once per year unless required by Data Protection
Legislation, including where mandated by Customer’s supervisory authority. Gigamon will contribute to such
audits by providing Customer or Customer’s supervisory authority with the information and assistance
reasonably necessary to conduct the audit. Customer acknowledges and agrees that any exercise of its audit
rights under applicable Data Protection Legislation will be conducted in accordance with this DPA.
7.2. Third Party. If a third party is to conduct the audit, Gigamon may object to the auditor if the
auditor is, in Gigamon’s reasonable opinion a competitor of Gigamon. Such objection by Gigamon will require
Customer to appoint another auditor or conduct the audit itself.
7.3. Process. Subject to Section 6 (Notice and Communication) in relation to a Security Incident and
aside from in the event of an investigation of a supervisory authority, to request an audit, Customer must
submit a detailed proposed audit plan to Gigamon at least thirty (30) days in advance of the proposed audit
date and any third party auditor must sign a customary non-disclosure agreement mutually acceptable to the
parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all
information exchanged in connection with the audit and any reports regarding the results or findings thereof.
Customer shall be solely responsible for the actions or inaction of any such third party, including without
limitation any breaches of confidentiality. The proposed audit plan must describe the proposed scope,
duration, and start date of the audit. Gigamon will review the proposed audit plan and provide Customer with
any concerns or questions (for example, any request for information that could compromise Gigamon security,
privacy, employment or other relevant policies). Gigamon will work cooperatively with Customer to agree on a
final audit plan. Nothing in this Section shall require Gigamon to disclose any information where such
disclosure would result in a breach of any duties of confidentiality.
7.4. Documents. If the controls or measures to be assessed in the requested audit are addressed in an
SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within
twelve (12) months of Customer’s audit request and Gigamon has confirmed there are no known material
changes in the controls audited, Customer agrees to accept such report in lieu of requesting an audit of such
controls or measures.
7.5. Timing. The audit must be conducted during regular business hours, subject to the agreed final
audit plan and Gigamon’s safety, security or other relevant policies, and may not unreasonably interfere with
Gigamon business activities.
7.6. Reports. Customer will promptly notify Gigamon of any non-compliance discovered during the
course of an audit and provide Gigamon any audit reports generated in connection with any audit under this
Section 7, unless prohibited by Data Protection Legislation or otherwise instructed by a supervisory authority.
Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit
requirements and/or confirming compliance with the requirements of this DPA. The reports, audit, and any
information arising therefrom shall be considered Gigamon's Confidential Information and may only be shared
with a third party (including a Third-Party Controller) with Gigamon's prior written agreement.
7.7. Costs. Any audits are at Customer’s expense. Customer will be responsible for any fees charged by
any auditor appointed by Customer to execute any such audit. Gigamon may charge a fee, to be mutually
agreed by the parties in advance, for any such audit; rates shall be reasonable, taking into account the
resources expended by Gigamon. Nothing in this DPA shall be construed to require Gigamon to furnish more
information about its Sub-processors in a connection with such audits than such Sub-processors make
available to Gigamon without restriction on further disclosure.
8. Impact Assessments and Consultations. Gigamon will provide reasonably requested information
regarding the Gigamon Offerings to enable Customer to carry out impact assessments or prior consultations
with data protection authorities as required by applicable Data Protection Legislation, including, if applicable,
Customer’s obligations pursuant to Articles 35 and 36 of the EU GDPR and UK GDPR, by (a) making available for
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 6 of 11
review copies of the Security Documentation or other documentation or information describing relevant
aspects of Gigamon’s information security program and the security measures applied in connection
therewith; and (b) providing the other information contained in the Agreement including this DPA. Gigamon
shall additionally provide such reasonable assistance to Customer, taking into consideration the nature of the
Offerings provided, to the extent needed by Customer in connection with a data protection impact assessment
as required to comply with applicable Data Protection Legislation.
9. Data Subject Requests.
9.1. Customer’s Responsibility for Requests. Gigamon shall promptly notify Customer if Gigamon
receives a request from a Data Subject that identifies Personal Data related to Customer or that otherwise
identifies Customer, including where the Data Subject seeks to exercise any of its rights under applicable Data
Protection Legislation. During the Term or as otherwise required by applicable Data Protection Legislation, if
Gigamon receives any request from a Data Subject in relation to the Data Subject’s Personal Data Processed in
connection with the Gigamon Offering, to the extent legally permitted Gigamon will advise the Data Subject to
submit their request to Customer and Customer will be responsible for responding to any such request, subject
to the assistance to be provided by Gigamon pursuant to Section 9.2 below.
9.2. Gigamon’s Data Subject Request Assistance. Gigamon will provide (taking into account the nature
of the Processing of Personal Data) Customer with reasonable assistance as necessary for Customer to
perform its obligation under Data Protection Legislation to respond to requests by Data Subjects, including if
applicable, Customer’s obligation to respond to requests for exercising the Data Subject’s rights set out in
Chapter III of the EU GDPR and in the UK GDPR.
10. Transfers of Personal Data.
10.1. Data Storage and Processing Facilities. Gigamon may, subject to this Section 10, store and Process
Personal Data in the United States or anywhere Gigamon or its Sub-processors maintains facilities.
10.2. Transfer Mechanisms. For any transfers of Personal Data from the EEA and its member states,
United Kingdom and/or Switzerland or other jurisdictions to a country which is not an Approved Jurisdiction,
such transfers and Processing shall be governed by a valid mechanism for the lawful transfer of Personal
Data recognized under applicable Data Protection Legislation, such as those below:
10.2.1. EU Standard Contractual Clauses. With respect to transfers of Personal Data protected by
the EU GDPR outside an Approved Jurisdiction, such transfers shall be subject to the EU Standard Contractual
Clauses, which shall be deemed incorporated into and form part of this DPA, including the election of specific
terms and/or optional clauses of the EU SCCs as described in more detail in (a)-(j) below, and any optional
clauses not expressly selected are not included:
a) The Module 2 terms shall apply (Controller to Processor);
b) The optional Clause 7 in Section I of the EU SCCs is incorporated, and Authorized
Affiliates may accede in a signed writing to this DPA and the SCCs under the same terms and conditions
as Customer, subject to Section 3.4 (Authorized Affiliates) of this DPA via mutual agreement of the
Parties;
c) For purposes of Clause 9 of the EU SCCs, Option 2 (“General written authorization”) is
selected and the process and time period for the addition or replacement of Sub-processors shall be as
described in Section 11 (Sub-processing) of this DPA;
d) The optional paragraph in Clause 11 of the EU SCCs is not incorporated;
e) For purposes of Clause 13 and Annex 1.C of the SCCs, Option 1 will apply if Customer
has an establishment in the European Union, Option 2 will apply if Customer is not established in the
European Union and has an appointed representative, and Option 3 will apply if Customer has neither
an establishment nor a representative in the European Union. Customer shall maintain accurate
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 7 of 11
records of the applicable Member State(s) and competent supervisory authority, which shall be made
available to Customer on request;
f) For purposes of Clause 17 and Clause 18 of the SCCs, Option 1 of Clause 17 is selected
and the Member State for purposes of governing law and jurisdiction shall be the Federal Republic of
Germany;
g) For purposes of Annex 1.A, the “data importer” shall be Gigamon and the “data
exporter” shall be Customer and any Authorized Affiliates that have acceded to the SCCs pursuant to this
DPA;
h) For purposes of Annex 1.B, the description of the transfer is as described in Appendix
1 of this DPA;
i) For purposes of Annex 1.C, The competent supervisory authority in accordance with
Clause 13 is the supervisory authority associated with Customer’s establishment or representative in
accordance with Clause 13 of the SCCs; and
j) For purposes of Annex II, the technical and organization measures are those measures
described in Section 5.2 (Gigamon Security Measures) of this DPA.
10.2.2. UK Addendum. With respect to transfers of Personal Data protected by the UK GDPR
outside an Approved Jurisdiction, the EU SCCs will also apply in accordance with the paragraphs in Section
10.2.1 (a)-(j) above, subject to the following modifications:
a) Part 1: Tables (found at https://ico.org.uk/media/for-
organisations/documents/4019539/international-data-transfer-addendum.pdf)
i. Table 1 will be filled out with the Parties as set forth in Section
10.2.1(g);
ii. Table 2 will be filled out with the selected SCCs, Modules and Selected
Clauses as set forth in Sections 10.2.1(a)-(d);
iii. Table 3 will be filled out with the information as set forth in Sections
10.2.1(g), (h), (j) and the Subprocessor Addendum (as described
below); and
iv. Table 4 will be filled out by selecting “neither Party” may end the UK
Addendum as set out in Section 19 of the UK Addendum.
b) The following Alternative Part 2 of the Mandatory Clauses shall apply: Mandatory
Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by
the Information Commissioner’s Office (the “ICO”) of the UK and laid before the UK
Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January
2022, as it is revised under Section 18 of those Mandatory Clauses.10.2.3.
10.2.3. Swiss Standard Contractual Clauses. With respect to transfers of Personal Data
protected by the FADP, the EU SCCs will also apply in accordance with the paragraphs in Section 10.2.1 (a)-(j)
above, subject to the following modifications: (a) the term “member state” as used in the SCCs shall not be
interpreted in such a way as to exclude Data Subjects in Switzerland from suing for their rights in their place of
habitual residence in accordance with Clause 18(c) of the SCCs; (b) the SCCs shall also protect the data of legal
entities until the entry into force of the revised FADP; (c) references to the GDPR or other governing law
contained in the SCCs shall also be interpreted to include the FADP; and (d) the parties agree that the
supervisory authority as indicated in Annex I.C of the SCCs shall be the Swiss Federal Data Protection and
Information Commissioner.
11. Sub-Processing.
11.1. Authorized Sub-Processors. For purposes of Clause 9 of the Standard Contractual Clauses,
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 8 of 11
Customer provides Gigamon with a general consent to engage Sub-processors, subject to Section 11.3
(Changes to Sub-processors), as well as Gigamon’s current Sub-processors already engaged as of the DPA
Effective Date and as listed in the Sub-processor Addendum to this DPA located at www.gigamon.com/sub-
processor-addendum.pdf, which is hereby incorporated into this DPA by reference, subject to Gigamon
ensuring those Sub-processors meet obligations in this DPA.
11.2. Sub-Processor Obligations. Gigamon shall: (i) enter into a written agreement with each Sub-
processor imposing data protection obligations no less protective of Personal Data as Gigamon’s obligations
under this DPA to the extent applicable to the nature of the services provided by such Sub-processor; and (ii)
remain liable for each Sub-processor’s compliance with the obligations under this DPA. Upon written request,
and subject to any confidentiality restrictions, Gigamon shall provide Customer all relevant information it
reasonably can in connection with its applicable Sub-processor agreements where required to satisfy
Customer’s obligations under Data Protection Legislation.
11.3. Changes to Sub-Processors. Gigamon shall notify Customer (for example, by updating the Sub-
Processor Addendum, which may be found at www.gigamon.com/sub-processor-addendum.pdf, or by
publishing this information at Gigamon’s customer portal or www.gigamon.com/legal.html, or by e-mail or
in-application messaging) of any new Sub-processor at least fourteen (14) business days in advance of
allowing the new Sub-processor to Process Personal Data (the “Objection Period”). During the Objection
Period, objections (if any) to Gigamon’s appointment of the new Sub-processor must be provided to
Gigamon in writing and based on reasonable grounds relating to data protection. In such event, the Parties
will discuss those objections in good faith with a view to achieving resolution. If it can be reasonably
demonstrated to Gigamon that the new Sub-processor is unable to Process Personal Data in compliance with
the terms of this DPA and Gigamon cannot provide an alternative Sub- processor, or the Parties are not
otherwise able to achieve resolution as provided in the preceding sentence, Customer may provide written
notice to Gigamon terminating the purchases with respect only to those aspects of the Offerings which
cannot be provided by Gigamon without the use of the new Sub-processor.
12. Government, Law Enforcement, and/or Third-Party Inquiries. If Gigamon receives a demand to retain,
disclose, or otherwise Process Personal Data for any third party, including, but not limited to law enforcement
or a government authority (“Third-Party Demand”), then Gigamon shall attempt to redirect the Third-Party
Demand to Customer. Customer agrees that Gigamon can provide information to such third-party as
reasonably necessary to redirect the Third-Party Demand. If Gigamon cannot redirect the Third-Party Demand
to Customer, then Gigamon shall, to the extent legally permitted to do so, provide Customer reasonable
notice of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek a
protective order or other appropriate remedy. This section does not diminish Gigamon’s obligations under the
EU SCCs or UK Addendum with respect to access by public authorities.
13. Miscellaneous.
13.1. Notices. Notwithstanding anything to the contrary in the Agreement, any notices required or
permitted to be given by Gigamon to Customer under this DPA may be given (a) in accordance with the notice
clause of the Agreement; and/or (b) as described in Section 6.1 (Notification of Security Incident) of this DPA if
applicable; and/or (c) to Gigamon’s primary points of contact with Customer.
13.2. General. The Parties agree that this DPA shall replace and supersede any existing data processing
addendum, attachment, exhibit or standard contractual clauses that Gigamon and Customer may have
previously entered into in connection with the Gigamon Offerings. Except as expressly modified by the DPA,
the terms of the Agreement remain in full force and effect. To the extent of any conflict or inconsistency
between this DPA and the remaining terms of the Agreement regarding the subject matter herein, this DPA
shall govern. To the extent of any conflict or inconsistency between the body of this DPA and its Addenda (not
including the Standard Contractual Clauses) and the relevant Standard Contractual Clauses in a way that
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 9 of 11
materially affects the adequacy of the transfer, the Standard Contractual Clauses shall prevail. In the event of
any conflict between this DPA and the relevant Data Protection Legislation, the provisions under the Data
Protection Legislation shall prevail. Notwithstanding anything to the contrary in the Agreement or this DPA,
each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this
DPA, the SCCs, and any other data protection agreements in connection with the Agreement (if any), shall be
subject to any aggregate limitations on liability set out in the Agreement. Nothing in this DPA is intended to
limit the Parties’ direct liability towards Data Subjects or applicable supervisory data protection authorities
that may not be limited under mandatory applicable law.
13.3. No Third Party Rights. In no event shall this DPA benefit or create any right or cause of action on
behalf of a third party (including a Third-Party Controller), but without prejudice to the rights or remedies
available to Data Subjects under Data Protection Legislation or this DPA (including the SCCs).
13.4. Governing Law. Except as otherwise set forth in this DPA, this DPA will be governed by and
construed in accordance with governing law and jurisdiction provisions in the Agreement or in the event that
the Agreement is silent, in accordance with the law of the State of California and the United States without
regard to conflicts of laws provisions.
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07 Page 10 of 11
Appendix 1 to the DPA – GIGAMON OFFERINGS
Subject Matter and Details of the Data Processing
Subject Matter Gigamon’s delivery of Gigamon Offerings.
Duration of Processing Duration of the applicable purchase order.
Nature of the Processing Collection, storage, organization, retrieval, erasure, modification, and any other
Processing operation anticipated by Customer using the Gigamon Offerings.
Purpose of the Processing Gigamon’s delivery of Gigamon Offerings.
Categories of Personal Data Contact Information: Gigamon receives and uses contact information (name, email, title,
phone, address) for Customer’s employees for billing purposes. Gigamon may also
receive contact information of our customer’s employees, when these employees
contact Gigamon’s Customer Success organization requesting assistance with product
issues.
Metadata: In select circumstances and only upon Customer’s initiation and direction,
Customer may provide network access to Gigamon’s Support Engineers or Professional
Services Team, or transmit select packet capture data (including metadata) to Gigamon’s
Support Team and as a result Gigamon will have access to metadata associated with
packets traveling through Customer’s network for the sole purpose of providing Support
or delivering Gigamon Professional Services. This metadata may contain domain, file or
user names, and depending on the naming conventions used by the originator of the
packet to which the metadata pertains, may include Personal Data.
Sensitive data transferred N/A
Frequency of the transfer Continuous
Categories of Statutorily Data Subjects such as Customer’s system user’s data and other individuals whose
Defined Data Subjects for Personal Data Customer is responsible for, and which Personal Data is Processed in
Whom the Customer’s connection with support and or delivery of Gigamon Offerings.
Personal Data Relates
For transfers to sub- The subject matter, nature, and duration of Processing undertaken by Sub-
processors, also specify processors will be the same as set forth in this DPA with respect to Gigamon.
subject matter, nature and
duration of the processing
Appendix 1 to Customer DPA and SCCs (Gigamon as Supplier) 2023.07.07 Page 11 of 11