Data Processing Addendum

If changes in Data Protection Legislation result in new material obligations as it relates to Appspace’s assistance under this Section 2.3.2, the Parties will work together in good faith to agree upon an acceptable resolution. Each Party shall be responsible for its own costs incurred under this Section 2.3.2;  and

1. make available to Customer all information reasonably requested by Customer for the purpose of demonstrating that Customer’s obligations relating to the appointment of Data Processors as set out in Article 28 of the GDPR have been met.
2. Information Security. In accordance with Appendix 1B, Appspace will implement and maintain commercially reasonable technical, administrative, and physical security measures designed to protect the Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorized or unlawful Processing, accidental loss, destruction, damage or theft of Customer Personal Data and appropriate to the nature of the Customer Personal Data which is to be protected. In an effort to improve Appspace’s overall security, Appspace may amend its security measures, provided that the new or replacement measures do not reduce the level of security provided by the existing measures. Notwithstanding the foregoing, such safeguards shall, at a minimum, be no less rigorous than accepted industry practices for information security or other applicable industry standards.
3. Personal Data Breach. Upon discovering or otherwise becoming aware of a Personal Data Breach, Appspace will notify Customer without undue delay (but no more than seventy-two (72) hours). Such notification shall not be interpreted or construed as an admission of fault or liability by Appspace. 
4. Appspace’s Subprocessors. Customer specifically authorizes the engagement of Appspace’s Affiliates as Subprocessors. In addition, to the extent necessary to fulfill Appspace’s contractual obligations under the Agreement and subject to Appspace’s compliance with this Section 2.6, Customer generally authorizes Appspace to engage other Subprocessors, as described in Appendix 1A, whose Processing activities shall occur in Belgium. 
5. When engaging any Subprocessor, Appspace ensures that:
   1. the Subprocessor only processes Customer Personal Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including this Addendum); 
6. data protection obligations consistent with those described in this Addendum are imposed on the Subprocessor through a written agreement; and
7. Appspace remains fully liable to Customer where the Subprocessor fails to fulfil its data protection obligations under the Agreement.
8. Prior to engaging any new Subprocessor, Appspace will, at least ten (10) days before the new Subprocessor Processes any Customer Personal Data, inform Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) in accordance with applicable Data Protection Legislation.
9. Customer may object to Appspace’s use of a new Subprocessor by notifying Appspace within ten (10) days after notice has been given with Customer’s grounds for its objection.  In the event Customer objects to a new Subprocessor, as permitted in the preceding sentence, Appspace will use commercially reasonable efforts to make available to Customer a change in the Products or recommend a commercially reasonable change to Customer’s configuration or use of the Products to avoid Processing of Customer Personal Data by the objected-to new Subprocessor without unreasonably burdening Customer.  If Appspace is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, either Party may terminate without penalty the applicable Order with respect only to those Products which cannot be provided by Appspace without the use of the objected-to new Subprocessor by providing written notice. Appspace will refund Customer any prepaid, unused fees covering the remainder of the term of such applicable Order following the effective date of termination with respect to such terminated Products, without imposing a penalty on Customer for such termination. 
10. Confidentiality. Appspace will ensure that Appspace’s personnel with access to the Customer Personal Data are subject to a binding duty of confidentiality with regard to such Customer Personal Data. Except as set forth in Section 2.6 above or in accordance with documented instructions from Customer (as set forth in this Addendum or the Agreement or as directed by Customer through the Products), Appspace will ensure that none of Appspace’s personnel publish, disclose or divulge any Customer Personal Data to any third party. 
11. Selling of Customer Personal Data Prohibited. The Customer Personal Data that Customer discloses to Appspace is provided to Appspace for a Business Purpose, as defined under the CCPA, and nothing about the Agreement or the Services involves the “selling” or a “sale” of Customer Personal Data under Cal. Civ. Code § 1798.140(t)(1). 
12. Deletion or Return of Customer Personal Data. Appspace shall retain Customer Personal Data for the term of the Agreement provided that such retention does not conflict with a Data Subject request made pursuant to Section 2.3.1. Upon expiration or termination of the Agreement and upon Customer’s written request, Appspace will securely destroy or return to Customer in a format of Appspace’s choosing all Customer Personal Data, and destroy existing copies. Notwithstanding the foregoing, Appspace may retain copies of the Customer Personal Data disclosed hereunder that are contained in routine system backups or are necessary to fulfill its ongoing obligations or exercise its ongoing rights hereunder, subject to the ongoing obligation to maintain the confidentiality of such information in accordance with the terms the Agreement and this Addendum.
13. Audits. Appspace is regularly audited by independent third-party auditors and internal auditors to test and verify the security controls of Appspace and its people. Upon request and provided that the Parties have an applicable non-disclosure agreement in place, Appspace will allow Customer and Customer’s authorized representatives to access and review up-to-date attestations, reports (e.g. external auditors) or suitable certifications to ensure compliance with the terms of this Addendum. Notwithstanding the foregoing, any review of aforementioned materials or audit must be conducted during Appspace’s regular business hours, with reasonable advance notice to Appspace and subject to reasonable confidentiality procedures. In addition, reviews and/or audits shall be limited to once per year, unless (a) Appspace has experienced a Personal Data Breach within the prior twelve (12) months; (b) an audit is carried out at the direction of a government entity; or (c) an audit reveals a material noncompliance. Appspace shall be entitled to charge Customer a reasonable fee for any Appspace effort or costs in complying with this Section 2.10.
14. Data Protection Officer. The contact details for the team responsible for data protection at Appspace are: Data Privacy Officer privacy@appspace.com 
15. European Economic Area Data Transfers. Upon separate, prior written approval from Customer, Appspace and its Subprocessors will be authorized to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States. If Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom is transferred by Customer to Appspace in a country that has not been found to provide an adequate level of protection under Data Protection Legislation, the Parties agree      to execute the EU/EEA SCCs and any necessary amendment to this DPA,      but to the extent that and for so long as the EU/EEA SCCs cannot be relied on for a lawful transfer in compliance with the UK Data Protection Law or the Swiss DPA, the Parties agree to execute the UK SCCs or Swiss SCCS      (or such applicable, superseding standard contractual clauses). 
16. Compliance with UK Addendum. Customer and Appspace acknowledge and agree the UK Addendum will hereby be incorporated and apply to International Data Transfers out of the UK. Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the “Exporter” is Customer and the “Importer” is Appspace, and their details are set forth in this section and the Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are the Module 2 Standard Contractual Clauses; (iii) in Table 3, Annexes 1 (A and B) & III, and II to the “Approved EU SCCs” are found in Appendix 1A and Appendix 1B respectively; and (iv) in Table 4, both the “Importer” and the “Exporter” can terminate the UK Addendum.
17. Compliance with Data Protection Legislation. Each Party will comply with the obligations applicable to it under the Data Protection Legislation with respect to the Processing of Customer Personal Data and the performance of the Agreement and this Addendum, including without limitation, compliance with Article 31 of GDPR. With respect to Customer Personal Data, Customer as the Data Controller, is responsible the administration and management of Customer Personal Data, in addition to, obtaining, and demonstrating evidence that is has obtained all authorizations, lawful bases, and consents necessary for Appspace to Process Customer Personal Data in accordance with the Agreement and this Addendum.
18. Data Subject Requests. Customer is responsible for communications and efforts to comply with requests made by Data Subjects under the Data Protection Legislation. If any such request requires Appspace assistance, Customer shall notify Appspace of the Data Subject request in a reasonable amount of time and sent to privacy@appspace.com.
19. Limitation on Disclosure of Customer Personal Data. To the extent legally permitted, Appspace shall: (i) promptly notify Customer in writing upon receipt of an order, demand, or document purporting to request, demand or compel the production of Customer Personal Data to any third party, including, but not limited to the United States government for surveillance and/or other purposes; and (ii) to the extent possible, provide at least seventy-two (72) hours’ notice prior to disclosing Customer Personal Data to any third party without providing Customer, so that Customer may, at its own expense, exercise such rights as it may have under applicable laws to prevent or limit such disclosure. 

• Customer Obligations

1. Customer shall continue at all times to have in place recognized lawful legal bases under Data Protection Legislation and all necessary data privacy notices to ensure that all processing of personal data by the Processor and all Subprocessors that is contemplated by this Addendum will be lawful and shall not contravene the obligations of a data controller under Data Protection Legislation.

• Miscellaneous

1. Save as specifically modified and amended in this Addendum, all of the terms, provisions and requirements contained in the Agreement shall remain in full force and effect and govern this Addendum.  Except as otherwise expressly provided herein, no supplement, modification, or amendment of this Addendum will be binding, unless executed in writing by a duly authorized representative of each Party to this Addendum.  If any provision of the Addendum is held illegal or unenforceable in a judicial proceeding, such provision shall be severed and shall be inoperative, and the remainder of this Addendum shall remain operative and binding on the Parties.