Data Processing Addendum (Global)

(Provider) and (Customer) enter this addendum on What date does this agreement take effect? under Identify the underlying customer agreement..

Customer determines the purposes and means of processing as controller or business, or acts on documented instructions from its controller. Provider acts as processor, service provider, or contractor as applicable. Provider will process personal data only to deliver the agreed services and follow Customer’s documented lawful instructions, including this addendum. It will promptly flag an instruction it reasonably believes unlawful and suspend that instruction pending clarification. Legally required processing is permitted with advance notice unless law prohibits it.

The processing schedule is State subject matter, duration, nature, purposes, individuals, data, sensitive data, frequency, retention, locations, and controller/processor roles.. It must identify subject matter, duration, nature, purposes, categories of individuals and data, sensitive-data restrictions, frequency, retention, locations, and each party’s role. Customer is responsible for lawful collection, necessary notices, permissions, and instructions. Provider must not collect additional data on Customer’s behalf beyond those instructions.

Provider limits access to authorized people bound by confidentiality and maintains the measures set out in Specify the implemented security controls and any incorporated security schedule.. Measures must be appropriate to the risks and cover access controls, encryption where appropriate, recovery, testing, incident response, and secure disposal. Provider will not materially reduce agreed protection during the term. Restricted or sensitive data may be processed only where expressly included in the processing schedule with appropriate safeguards.

Provider must notify Customer without undue delay after becoming aware of a personal-data breach and within State the outer incident reporting deadline; notice must still be without undue delay., subject to any shorter legal deadline. Notices go to Notices must include available information about the incident, affected data, likely consequences, mitigation, and a contact for updates. Provider must mitigate, preserve relevant evidence, and cooperate. An initial notice must not await a full investigation.

Provider will promptly forward individual requests and assist Customer in access, correction, deletion, portability, opt-outs, and other applicable rights. It will not respond substantively unless instructed or required by law. Assistance must enable Customer to meet legal deadlines. Provider will reasonably assist with security duties, impact assessments, and regulator consultations, taking account of the processing and available information. Ordinary compliance with this addendum is included in service fees; extraordinary assistance requires an agreed quote where law permits.

Approved subprocessors, services, locations, and notice channel are List each subprocessor, function, location, and change-notice channel.. Customer gives general authorization for that list. Provider must give What advance notice period applies to subprocessor changes? advance notice of additions or replacements, allowing a reasonable data-protection objection. The parties will seek a practical alternative; if none is available, Customer may end the affected service before the new processing begins and recover unused prepaid fees. Each subprocessor must accept equivalent data-protection obligations. Provider remains responsible for its performance.

Provider will supply information reasonably needed to demonstrate compliance, including relevant independent reports. If those are insufficient, Customer or an independent auditor bound by confidentiality may conduct a proportionate inspection on reasonable notice. Restrictions must not frustrate mandatory audit rights or regulator access. Provider will promptly report an inability to comply and allow reasonable steps to stop and remedy unauthorized processing.

Provider certifies that it understands and will comply with the applicable contractual restrictions. It must not sell or share personal data; retain, use, or disclose it outside the specified business purposes or the direct business relationship; or combine it with data from other sources except as applicable law expressly permits. It must provide the level of privacy protection required by applicable law and cooperate with Customer’s reasonable monitoring and remediation. Data disclosed under this addendum is supplied only for the limited purposes in the processing schedule.

Provider may not train a general-purpose AI model on Customer personal data or make a legally significant decision about an individual unless separately instructed in writing with a lawful basis and necessary safeguards. De-identified data use requires written instructions, reasonable measures against reidentification, and any required public commitment and downstream restrictions.

For processing subject to the GDPR, UK GDPR, or Swiss data-protection law, Provider also undertakes the processor duties required by those laws. Customer’s documented instructions include permitted transfer destinations only where a lawful transfer mechanism is in place. Provider will assist with impact assessments and prior consultation and make compliance information available as required by those laws.

The completed transfer package is Identify and attach the executed EU SCC modules and completed annexes, UK instrument, Swiss adaptations, transfer assessment, and supplementary measures; state none only if no restricted transfer occurs.. Before a restricted transfer starts, the parties must execute or validly incorporate the applicable unmodified European Commission standard contractual clauses, select the correct modules, and complete all annexes, party details, supervisory authority, governing law, and courts. UK transfers require the applicable UK instrument; Swiss transfers require the corresponding adaptations. The package must include a transfer assessment and any supplementary safeguards required for the actual destinations and access risks. This summary does not itself supply or replace those instruments.

Provider must promptly report an inability to comply with the transfer package. The affected transfer must be suspended until lawful safeguards are restored, and terminated with data returned or deleted where required. No commercial term limits an individual’s rights or the authority of a competent regulator under the applicable instrument.

On service completion, Customer chooses return or deletion under Specify return format, deletion deadline, backup expiration, and legally required retention.. Provider must delete remaining copies unless law requires retention, document the legal basis, isolate retained data, and use it only for that required purpose. It will confirm completion on request and ensure subprocessors follow the same obligations. Protection continues until deletion.

This addendum controls conflicts about personal data. Mandatory transfer instruments control inconsistent contract terms. Service-agreement liability provisions apply only to the extent compatible with mandatory data-protection rights and obligations. Changes require writing. Electronic signatures and counterparts are effective.

Provider: ____________________ Name and title: ____________________ Date: ____________________

Customer: ____________________ Name and title: ____________________ Date: ____________________