Snapshot 96999
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING TERMS AND CONDITIONS
These DATA PROCESSING TERMS AND CONDITIONS (“Terms and Conditions”) govern the processing of Personal Data
(defined below) by Optiv Security Inc. and/or its Affiliates (“Optiv”) in connection with the business relationship for the party
identified in the relevant order for product resale or cybersecurity professional service (“Client”).
RECITALS
WHEREAS, these Terms and Conditions amend and supplement all relevant statements of work, service orders, change
orders, purchase orders, signed quotes, and other orders, including all terms, conditions and underlying agreements referenced
therein, between Optiv and Client (“Agreement(s)”), and shall be incorporated into all such Agreement(s) which reference these
Terms and Conditions or to which these Terms and Conditions are attached; and
WHEREAS, these Terms and Conditions contain the mandatory clauses required by the Data Protection Laws (defined
below) applicable to Personal Data.
NOW, THEREFORE, in consideration of the premises and for other good and valuable consideration, the receipt and
sufficiency of which is hereby acknowledged, the parties agree to the following Terms and Conditions:
1. DEFINITIONS. All capitalized terms not expressly defined herein shall have the meanings ascribed to them in the
Agreement(s).
“Affiliate(s)” means any entity that, directly or indirectly through one or more intermediaries, controls, is controlled by, or is
under common control with a party to these Terms and Conditions.
“Business Purposes” means as needed for Optiv to perform under the Agreement(s); and/or as otherwise agreed upon between
the parties in writing from time to time.
“Client Personal Data” means Personal Data provided by Client to Optiv for purposes of Optiv’s provisions of the services.
“Client Contact Data” means Personal Data relating to individual business contacts of Client who Optiv may interact with
for purposes of reselling third-party products to Client, engaging in professional services projects or otherwise performing
activities related to the Agreement(s).
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
“Data Protection Laws” means all applicable local, state, federal and international privacy and data protection laws, including
but not limited to the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and any applicable national implementing
laws, regulations and secondary legislation in any Member State of the European Union relating to the processing of Personal
Data; the privacy of electronic communications, as amended, replaced or updated from time to time, including the Privacy and
Electronic Communications Directive (2002/58/EC); the United Kingdom Data Protection Act 2018 and all regulations and
amendments relating thereto; the Personal Information Protection and Electronic Documents Act of Canada; and the California
Consumer Privacy Act of 2018, Cal. Civ. Code sections 1798-100 et seq., and its implementing regulations as well as the
California Privacy Rights Act of 2020, Cal. Civ. Code sections 1798-100 et seq., and any legally binding implementing
regulations and amendments related thereto.
“Data Subject” means an individual who is the subject of Personal Data.
“Personal Data” means any information relating to an identified or identifiable natural person that is processed by Optiv for
Client as a result of, or in connection with the Agreement(s); an identifiable natural person is one who can be identified, directly
or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that
natural person.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of, or access to, the Personal Data transmitted, stored or otherwise processed by Optiv under the
Agreement(s).
“Process”, “Processes” or “Processing” means any operation or set of operations which involves use of Personal Data,
whether or not by automated means, including but not limited to: collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction.
“Sell” or “Selling” means the exchange of Personal Data for monetary or other valuable consideration, or as otherwise defined
in applicable Data Protection Laws.
“Standard Contractual Clauses” means the Standard Contractual Clauses by and between Client acting as Controller (or
Processor, when applicable) and Optiv acting as Processor (or Sub-Processor, when applicable) and included herein, pursuant
to the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the
transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council;
and reference to the Standard Contractual Clauses refers to the UK Addendum thereto. The Standard Contractual Clauses, as
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 1
may be updated periodically, may be obtained at https://www.optiv.com/agreements, by e-mail request to privacy@optiv.com
or as otherwise made reasonably available by Optiv.
“Sub-processor” means any Processor engaged by Optiv or Optiv’s Affiliates.
2. CONTROLLING AND PROCESSING PURPOSES AND PERSONAL DATA TYPES.
a. Client Contact Data. Each Party is a Controller of the Client Contact Data and is solely responsible for its own
processing of such Client Contact Data.
b. Processing. Optiv and Client each acknowledge that for the purposes of the Data Protection Laws, Client is, depending
on the data, a Controller or a Processor of the Client Personal Data, and in regards to Client Personal Data, Optiv is the
Processor or Sub-processor thereof.
c. Purposes. The duration, purpose of Processing, and the Personal Data categories and Data Subject types that Optiv may
process for Client are as follows:
i. Duration of Processing. Term of the relevant Agreement, or otherwise as necessary to fulfill obligations under the
Agreement(s) or as required by law.
ii. Business Purpose. To provide products and/or services in accordance with the Agreement(s); to provide
cybersecurity services to Client and/or Client’s employees; to enhance Client’s threat defenses; to resell or
sublicense cybersecurity technology to Client; and/or for any other purpose agreed to between Client and Optiv.
Optiv may require Client to provide certain Client Contact Data, and Optiv and Optiv Affiliates may store such
Client Contract Data in databases on Optiv systems at any Optiv location and make it accessible globally to
authorized Optiv personnel and vendors. Optiv owns the data derived from the purchase and usage of its products
and services, including data regarding purchase history, configurations and applications utilized in connection with
Optiv’s services, support data, operational data, log data and the performance results for its service. Optiv may use
such data for various legitimate purposes such as to (A) use such information and data to improve and enhance the
services and for other development, diagnostic and corrective purposes in connection with Optiv’s services; (B)
marketing and/or data analytics to assist Optiv in offering services and products to its customers; (C) leverage
machine learning or artificial intelligence tools (“AI”) when used in reselling products and/or delivering the services
and (D) disclose such data solely in aggregate or other de-identified form in connection with its business. Optiv
shall adhere to its applicable confidentiality and safeguarding obligations. Notwithstanding the above, Optiv may
act as a Controller when Processing Client Contact Data for the aforementioned business and operational purposes
above.
iii. Personal Data Categories.
• Client’s employees’ names and contact information, which may include but is not limited to business and
home addresses, email addresses, phone numbers, IP addresses, user names, and transaction history
• Client’s customer names and business contact information, including addresses, email addresses, phone
numbers, IP addresses
• Client’s vendor names and business contact information, including addresses, email addresses, phone
numbers, IP addresses
iv. Data Subject Types.
• Current, former, prospective employees of Client
• Employees or customers of Client’s clients
• Vendors of Client
d. Data Return and Destruction. Upon Client’s request, Optiv shall return Client Personal Data to Client and, to the
extent allowed by applicable law, delete Client Personal Data in accordance with the procedures and time periods
specified in Optiv’s then-current records retention and destruction policies and practices, unless the retention of the
Personal Data is requested from Optiv according to mandatory statutory laws.
e. Selling of Personal Data. Optiv acknowledges and confirms that it does not receive any Personal Data as consideration
for any products, services or other items that it provides to Client. Optiv shall not have, derive or exercise any rights or
benefits regarding Personal Data. Optiv will not Sell any Personal Data nor will Optiv collect, share or use any Personal
Data except as necessary to fulfill the Business Purposes. Optiv represents and warrants that it understands the rules,
requirements and definitions of the Data Protection Laws and agrees to refrain from taking any action that would cause
any transfers of Personal Data to or from the Client to qualify as Selling the Personal Data under the relevant Data
Protection Laws.
3. TERM AND TERMINATION.
a. Term. These Terms and Conditions will remain in full force and effect so long as: (a) the Agreement(s) remains in
effect; and/or (b) Optiv retains any Personal Data of Client related to the Agreement(s) (“Term”).
b. Termination for Cause. Either party’s failure to comply with these Terms and Conditions will constitute a material
breach of the Agreement(s). In such event, the non-breaching party may terminate the Agreement(s) effective
immediately on written notice to the breaching party without further liability or obligation. In addition, if a change in
any Data Protection Law prevents either party from fulfilling all or part of its obligations under the Agreement(s), the
parties will suspend the Processing of Personal Data until that Processing complies with the new requirements. If the
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 2
parties are unable to promptly bring the Personal Data Processing into compliance with the Data Protection Laws, either
party may terminate the Agreement(s) on written notice to the other party.
c. Sections Surviving Termination. Any of these Terms and Conditions that expressly or by implication are meant to
survive termination of the Agreement(s), including but not limited to any provision related to protection of Personal
Data, will remain in full force and effect upon termination.
4. REPRESENTATIONS AND WARRANTIES.
Optiv represents and warrants that it will:
a. Process Personal Data only to the extent and in such manner as is necessary for the Business Purposes and that it will
not Process the Personal Data for any other purpose or in a way that does not comply with the Agreement(s), these Terms
and Conditions, or the Data Protection Laws;
b. take appropriate technical and organizational measures to prevent the unauthorized or unlawful Processing of, accidental
loss or destruction of, or damage to, Client Personal Data in its control or possession, and will ensure a level of security
appropriate to: (i) the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction
or damage, (ii) the nature of the Personal Data protected, and (C) comply with all applicable Data Protection Laws.
c. ensure that all personnel who have access to and/or Process Client Personal Data are obliged to keep the Client Personal
Data confidential and not to disclose it to third parties unless such disclosure is to support a Business Purpose above or
is otherwise authorized by Client, or as required by law; and
d. promptly notify Client of any changes to Data Protection Laws that may adversely affect Optiv’s performance of the
Agreement(s).
Client represents and warrants that it:
x. will comply with all relevant Data Protection Laws;
y. in its capacity as a data Controller, has obtained necessary consent to collect the Personal Data provided to Optiv for
Processing hereunder; or if Client is a data Processor, has confirmed in writing with the data controller that data controller
has obtained necessary consent to collect the personal data provided to Optiv for Processing hereunder; and
z. will not violate the rights of any Data Subject that has opted-out from sales or other disclosures of Personal Data, to the
extent applicable under Data Protection Laws.
5. PROCESSOR PERSONNEL.
a. Employee training. Optiv will ensure that all of its employees who handle Client Personal Data have undertaken
training on the Data Protection Laws, and are aware of Optiv’s duties and obligations under: (i) the Data Protection
Laws; (ii) the Agreement(s); and (iii) these Terms and Conditions.
b. Background Checks. Optiv will conduct background checks on all of its employees with access to the Client Personal
Data, consistent with applicable law.
6. Optiv’S SUB-PROCESSORS.
a. Use of Sub-processors. Client has instructed or otherwise consents to Optiv’s use of Affiliates and Sub-processors for
the Processing of Client Personal Data in connection with the Business Purposes; provided that Optiv agrees to be
responsible for the acts or omissions of such Sub-processors to the same extent as Optiv would be liable if performing
the services of the Sub-processors under these Terms and Conditions. Client acknowledges and hereby consents that in
some instances, Optiv’s Sub-processors may leverage AI in order to render the services contemplated by the Business
Purposes. Such AI tools may utilize Personal Data in order to make recommendations and predictions to the Client and
Optiv partners under the Business Purposes with prior written consent by Optiv.
b. List of Sub-processors. A list of Optiv’s current Sub-processors, including a description of their processing activities
and locations, will be (i) in writing between Client and Optiv in the Standard Contractual Clauses, or related data transfer
assessment, (ii) available by emailing privacy@optiv.com; and/or (iii) available at https://www.optiv.com/agreements.
Client may subscribe to notifications of new Sub-processors applicable to products and services Optiv provides to Client
by emailing privacy@optiv.com its request to receive such notifications; and if Client so subscribes, Optiv shall provide
notification of new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data in
connection with the provision of the applicable service to Client.
c. Right to Object to new Sub-processor. In order to exercise its right to object to Optiv’s use of a new Sub-processor,
Client shall notify Optiv promptly in writing within ten (10) business days after receipt of Optiv’s notice in accordance
with the mechanism set out in these Terms and Conditions. In the event Client objects to a new Sub-processor, and that
objection is not unreasonable, Optiv will use reasonable efforts to make available to Client a change in the service or
recommend a commercially-reasonable change to Client’s configuration or use of the service to avoid Processing of
Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If Optiv is unable to
make available such change within a reasonable time period, which shall not exceed thirty (30) days, Client may
terminate the applicable order for prossional service with respect only to those aspects of the professional service which
cannot be provided by Optiv without the use of the objected-to new Sub-processor by providing written notice to Optiv.
d. Sub-processors and the Standard Contractual Clauses. Client acknowledges and agrees that Optiv may engage Sub-
processors as described in this section for the fulfilment of Optiv’s obligations under Clause 9(a) of the Standard
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 3
Contractual Clauses. The parties agree that the copies of the Sub-processor agreements that must be provided by Optiv
to Client pursuant to Clause 9(c) of the Standard Contractual Clauses may have all commercial information, or clauses
unrelated to the Standard Contractual Clauses or their equivalent, removed by Optiv beforehand to protect business
secrets or other confidential information; and, that such copies will be provided by Optiv, in a manner to be determined
in its discretion, only upon request by Client.
7. SECURITY STANDARDS. Optiv has implemented and will maintain appropriate technical and organizational measures to
protect against unauthorized or unlawful Processing, loss, destruction of, or damage to the Client Personal Data in Optiv’s
control or possession, appropriate to: (a) the harm that might result therefrom; and (b) the nature of the Personal Data to be
protected, having regard to the state of technological development and the cost of implementing any such measures. Optiv will
review its security measures, at least annually, to ensure such measures remain current and complete.
8. PERSONAL DATA BREACH.
a. Loss or Destruction. Optiv will promptly and without undue delay notify Client if any Client Personal Data in Optiv’s
control or possession is lost or destroyed, or becomes damaged, corrupted, or unusable.
b. Notification. Optiv will, as soon as practicable and without undue delay, notify Client if it becomes aware of any
Personal Data Breach of the Client Personal Data in Optiv’s control or possession, and shall provide Client with a
description of the nature of the Personal Data Breach, including approximate number of Data Subjects and Personal Data
records concerned, likely consequences, and description of measures taken or proposed to mitigate possible adverse
effects. Optiv will not inform any third party of any such Personal Data Breach without first obtaining Client’s prior
written consent, except when required to do so by law. Optiv agrees that Client, or where Client is acting as a Processor
on behalf of a controller, that controller, has the sole right to determine: (a) whether to provide notice of the Personal
Data Breach to any Data Subjects, supervisory authorities, regulators, law enforcement agencies or others, as required
by law or regulation or, as applicable, in Client’s or the third-party controller’s discretion, including the contents and
delivery method of the notice; and (b) whether to offer any type of remedy to affected Data Subjects, including the nature
and extent of such remedy.
c. Remedy and Assistance. Immediately following any Personal Data Breach of the Client Personal Data in Optiv’s
control or possession, the parties will co-ordinate with each other to investigate the matter. Optiv will reasonably co-
operate with Client, including (i) assisting with any investigation; (ii) facilitating interviews with employees, former
employees and others involved in the matter; (iii) making available all relevant records, logs, files, data reporting and
other materials required to comply with all Data Protection Laws or as otherwise reasonably required by Client; and (iv)
taking reasonable and prompt steps to mitigate the effects and to minimize any damage resulting from such Personal
Data Breach.
d. Expense. Each party will cover all expenses associated with its performance of its obligations required under this section.
9. CROSS-BORDER TRANSFERS OF PERSONAL DATA. Optiv shall not transfer or otherwise Process Personal Data
outside the country in which the Personal Data was received without obtaining prior written consent from Client including
transfers to countries shown in the list of Sub-processors, as applicable; provided, however, Optiv will Process Personal Data
in the United States of America, and Personal Data may also be Processed by Optiv’s Affiliates in Canada and/or India. Client
hereby consents to such cross-border transfers, and the parties further agree to execute any additional documents necessary to
legally effect such transfers. Where Personal Data is provided to Optiv in the European Economic Area (“EEA”) and/or the
United Kingdom (“UK”), the parties agree to (i) comply with, and execute as necessary, the latest version of the Standard
Contractual Clauses/EU Model Clauses and/or UK Addendum as applicable, which are hereby incorporated by reference
(where Client is the entity exporting Personal Data to Optiv outside the EEA and/or UK), and (ii) take all other actions required
by law to legitimize the transfer. In the event Client is located in a country outside of the EEA and/or UK that recognizes the
Standard Contractual Clauses and/or UK Addendum as an adequate cross-border transfer mechanism, the parties may execute
the Standard Contractual Clauses and/or UK Addendum to govern Client’s transfer of Personal Data to Optiv, in which case:
(a) all references to the European Union in the Standard Contractual Clauses and/or references to the UK in the UK Addendum
are hereby replaced with the country location where Client’s Personal Data is transferred from; and (b) all references to the
GDPR and/or the UK’s Data Protection Act are hereby replaced with references to the relevant data privacy law(s) of such
country. The Standard Contractual Clauses and/or the UK Addendum apply to: (i) the legal entity that has executed the
Standard Contractual Clauses and/or UK Addendum as a data exporter and its authorized Affiliates and, (ii) all Affiliates of
Client established within the European Economic Area, United Kingdom, Switzerland, or other country who has adopted same
or similar terms as the EEA and/or UK, which have signed Orders for Optiv’s services. For the purpose of the Standard
Contractual Clauses and/or the UK Addendum the aforementioned entities shall be deemed “data exporters.”
10. DATA SUBJECT REQUESTS AND THIRD PARTY RIGHTS.
a. Data Subject and Supervisory Authority Requests. Optiv will, at no additional cost, take such technical and
organizational measures as may be appropriate, and promptly provide such information as may reasonably be required,
to enable Client to comply with: (i) the rights of Data Subjects under the Data Protection Laws, including Data Subject
access rights, the right to rectify and erase Personal Data, the right to object to the Processing and automated Processing
of Personal Data, and the right to restrict the Processing of Personal Data, and (ii) information or assessment notices
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 4
served on Client by any supervisory authority under the Data Protection Laws. Optiv will notify Client within five (5)
business days if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their
related rights under the Data Protection Laws.
b. Compliance Notification and Cooperation. Optiv will notify Client as soon as practicable if it receives any complaint,
notice or communication that relates directly or indirectly to the Processing of Client Personal Data or to Client’s
compliance with the Data Protection Laws. Optiv will give Client its reasonable co-operation and assistance in
responding to any such complaint, notice, communication or Data Subject request.
c. Disclosure. Optiv shall not disclose the Client Personal Data to any Data Subject or to any third party, other than at
Client’s or the relevant data controller’s direct request or instruction, unless otherwise required by law.
11. RECORDS AND AUDIT.
a. Records. Optiv will keep detailed, accurate and up-to-date written records regarding any Processing of Client Personal
Data. Optiv will ensure records are sufficient to enable Client to verify compliance with the obligations under these
Terms and Conditions, and Optiv will provide Client with copies of such records upon thirty (30) days prior written
request.
b. General Audits. Throughout the Term hereof, and upon at least thirty (30) days advance notice, Optiv will allow Client
to audit its books, records, policies and procedures pertaining to Optiv’s Processing of Client Personal Data, to verify
compliance with these Terms and Conditions. Optiv will provide Client with reasonable assistance to conduct such
audits; provided, however, that audits shall be limited to once per twelve (12) month period and shall be conducted so as
not to interfere with Optiv’s normal business operations.
c. Annual Assessments. At least once a year, Optiv will conduct audits of its Personal Data Processing practices and the
information technology and information security controls for all facilities and systems used in complying with its
obligations under these Terms and Conditions. Optiv agrees that it will promptly address any exceptions noted during
its audit.
12. LIABILITY. Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to these
Terms and Conditions, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’
section (or section substantively addressing limitation of liability) of the Agreement, and any reference in such section to the
liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and these Terms and
Conditions together.
13. DATA PROTECTION IMPACT ASSESSMENT. Upon Client’s request, Optiv shall provide Client with reasonable
cooperation and assistance needed to fulfil Client’s obligation under Data Protection Laws to carry out a data protection impact
assessment related to Client’s use of the service, to the extent Client does not otherwise have access to the relevant information,
and to the extent such information is available to Optiv. Optiv shall provide reasonable assistance to Client in the cooperation
or prior consultation with the supervisory authority in the performance of its tasks relating this section of these Terms and
Conditions , to the extent required under the Data Protection Laws.
14. CLIENT’S PROCESSING INSTRUCTIONS. These Terms and Conditions and the Agreement are Client’s complete and
final instructions at the time of signature of the Agreement to Optiv for the Processing of Personal Data. Any additional or
alternate instructions must be agreed upon separately. For the purposes of Clause 8.1 of the Standard Contractual Clauses
and/or the relevant portions of the UK Addendum, the following is deemed an instruction by the Client to Process Personal
Data: (a) Processing in accordance with the Agreement and applicable Order(s); (b) Processing initiated by users in their use
of the service; and (c) Processing to comply with other reasonable instructions provided by Client (e.g., via email) where such
instructions are consistent with the terms of the Agreement.
15. GENERAL.
a. Notices. Any notice permitted or required under these Terms and Conditions shall be deemed to have been given if it is in
writing and (i) personally served or delivered, (ii) mailed by registered or certified mail (return receipt requested), or (iii)
delivered by a national overnight courier service with confirmed receipt, to the parties at the addresses set forth in the
relevant Agreement. Each party may change its notice address by giving similar notice. Simultaneous to the notice methods
above, Client may provide notice and / or inquire with Optiv’s Chief Privacy Officer by emailing privacy@optiv.com.
b. Severability. In the event a court of competent jurisdiction holds any of these Terms and Conditions invalid or
unenforceable, the remainder of the Terms and Conditions will continue in full force and effect. The parties shall in good
faith negotiate a mutually acceptable and enforceable substitute for the unenforceable provision, which substitute shall be
as consistent as possible with the original intent of the parties.
c. No Waiver. The failure by either party to enforce any of these Terms and Conditions shall not be deemed a waiver of such
provisions or any subsequent breach thereof.
d. Remedies not Exclusive. No remedy made available under these Terms and Conditions is intended to be exclusive unless
expressly stated otherwise herein.
e. Entire Agreement. These Terms and Conditions along with the Agreement(s) and any amendments thereto contain the
entire understanding between the parties with respect to the subject matter hereof and may not be changed except by a
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 5
separate writing signed by both parties. During the term of the Agreement(s), purchase orders, acknowledgment forms, or
similar routine documents may be used. The parties agree that any provisions of such routine documents, which purport
to add to or change, or which conflict with these Terms and Conditions or the Agreement(s) shall be deemed deleted and
have no force or effect.
f. Interpretation and Construction. The section headings in these Terms and Conditions are for reference purposes only and
shall not be deemed a part of the Terms and Conditions. The wording herein is the wording chosen by the parties to express
their mutual intent, and no rule of strict construction shall be applied against either party.
g. Governing Law. These Terms and Conditions will be governed by, and construed and enforced in accordance with, the
laws of the State of Colorado of the United State excluding conflicts of law principles. Exclusive jurisdiction for any
lawsuit or claim in connection with these Terms and Conditions shall be in the state or federal courts of the State of
Colorado.
h. Conflicts. In the event of conflict or ambiguity between any of these Terms and Conditions and the provisions of the
Agreement(s), these Terms and Conditions will prevail with regard to the subject matter contained herein. In addition, in
the case of conflict or ambiguity between any of the provisions of the Agreement(s) and any executed Standard Contractual
Clauses and/or UK Addendum, the provisions of the executed Standard Contractual Clauses and/or UK Addendum will
prevail.
DATA PROCESSING TERMS AND CONDITIONS 6.17.25 6