Data Processing Addendum

1. Definitions
   Terms not specifically defined herein shall have the meaning ascribed thereto in the Terms of Use.
   In this DPA, the following terms shall have the following meanings:
• 1.1 “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• 1.2 “Customer Content” shall mean Personal Data submitted by the Customer to the Services or stored on Customer’s behalf through Customer’s account in connection with Customer’s use of the Services which includes electronic data, email bodies, email recipients, text, voice, video, images, sound or communication logs.
• 1.3 “Customer Subscription Data” means Personal Data that relates to Customer’s interactions and association with ControlHippo. This shall be inclusive of the names and/or contact details of individuals authorized by the Customer to access Customer’s account, along with billing information of individuals that Customer has associated with its account. Customer Subscription Data shall also include any data ControlHippo may require to collect for the purpose of identity verification, amongst other legal obligations.
• 1.4 “Customer Usage Data” means data relating to the Customer’s account activity Processed by ControlHippo for the purposes of passing on Customer Content to the intended recipient. This shall include data used to identify the source and destination of Customer Content, such as (a) individual data subjects’ telephone numbers, the date, time, duration and the type of communication, along with data on the location of the device generated in the context of providing the Services; and (b) communication logs used to identify the source of Service requests, improve and prevent system abuse.
• 1.5 “CCPA” shall mean the California Consumer Privacy Act of 2018.
• 1.6 “Data Protection Laws” shall mean the data protection laws of the country in which You are established and any data protection laws applicable to You in connection with the Terms, including but not limited to (a) laws and regulations applicable to the GDPR, (b) in respect of the UK, the GDPR as saved into United Kingdom by virtue of section 3 of the United Kingdom European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act, 2019 (c) the Swiss Federal Data Protection Act and its implementing regulations (“Swiss DPA”) in each case, as may be amended, superseded or replaced.
• 1.7 “Data Subject” means any identified or identifiable natural person.
• 1.8 “GDPR” shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
• 1.9 “Standard Contractual Clauses” or “SCCs” means (i) where the GDPR applies, the standard contractual clauses as approved by the European Commission (Implementing Decision (EU) 2021/914 of 04 June 2021) Implementing Decision (EU) 2021/914 of 04 June 2021) and available at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914 (“EU SCCs”); (ii) where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, Version B1.0, in force from 21 March 2022 set forth as Appendix IV (“UK SCCs”) and (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (the “Swiss SCCs”) (in each case, as updated, amended or superseded from time to time).
• 1.10 “Personal Data” shall mean any information relating to a Data Subject that is Processed by Processor as part of providing the Services to Controller.
• 1.11 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
• 1.12 “Privacy Policy” means ControlHippo’s privacy policy at https://controlhippo.com/privacy/
• 1.13 “Process” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• 1.14 “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
• 1.15 “Sensitive Data” means Personal Data consisting of a Data Subject’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation. It also includes information about an individual’s criminal offences or convictions, as well as any other information deemed sensitive under applicable data protection laws.
• 1.16 “Services” means the cloud-based synchronized communication platform services provided by ControlHippo that the Customer has subscribed to under the Terms.
2. Scope, Duration and Responsibilities
• 2.1 This DPA applies to Processing of Customer Content.
• 2.2 ControlHippo shall Process Customer Content for the term of this DPA and only in accordance with this DPA, especially as mentioned in the respective Appendix.
• 2.3 Within the scope of the Terms, each Party shall be responsible for complying with its respective obligations as Controller and Processor under Data Protection Laws.
3. Relationship of the Parties
• 3.1 ControlHippo as a Processor: The Parties acknowledge and agree that with regard to the Processing of Customer Content, Customer may act either as a Controller or Processor and ControlHippo is a Processor.
• 3.2 ControlHippo as a Controller of Customer Subscription Data: The Parties acknowledge that, with regard to the Processing of Customer Subscription Data, Customer is a Controller and ControlHippo is an independent Controller, not a joint Controller with Customer. Customer Subscription Data shall be Processed in accordance with ControlHippo’s Privacy Policy.
• 3.3 ControlHippo as a Controller of Customer Usage Data: The Parties acknowledge that, with regard to the Processing of Customer Usage Data, Customer may act either as a Controller or Processor and ControlHippo is an independent Controller, not a joint Controller with Customer. Customer Usage Data shall be Processed in accordance with ControlHippo’s Privacy Policy
4. Term and Termination
• 4.1 This DPA becomes effective upon Customer’s subscribing to the Services. It shall continue to be in full force and effect as long as ControlHippo is Processing Customer Content pursuant to the Terms and shall terminate automatically thereafter.
• 4.2 Where amendments are required to ensure compliance of this DPA or an Appendix with Data Protection Laws, the Parties shall make reasonable efforts to agree on such amendments upon request of the Controller. Where the Parties are unable to agree upon such amendments, either Party may terminate Customer’s use of the Services with thirty (30) days written notice to the other Party.
5. Processing Instructions
• 5.1 ControlHippo will Process Customer Content in accordance with the Customer’s instructions. This DPA contains Customer’s initial instructions to ControlHippo with respect to the Customer Content. The Parties agree that the Customer may communicate any change in its initial instructions to ControlHippo by way of amendment to this DPA.
• 5.2 For the avoidance of doubt, any instructions that would lead to Processing outside the scope of this DPA (e.g. because a new Processing purpose is introduced) will require a prior agreement between the Parties.
• 5.3 ControlHippo shall without undue delay inform the Controller in writing if, in ControlHippo’s opinion, an instruction infringes Data Protection Laws, and provide a detailed explanation of the reasons for its opinion in writing.
6. Processor Personnel
• 6.1 ControlHippo will restrict its personnel from Processing Customer Content without authorisation. ControlHippo will impose appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.
7. Disclosure to Third Parties; Data Subjects Rights
• 7.1 ControlHippo will not disclose Customer Content to any government agency, court, or law enforcement except with written consent from Controller or as necessary to comply with applicable mandatory laws. If ControlHippo is obliged to disclose Customer Content to a law enforcement agency ControlHippo agrees to give Controller reasonable notice of the access request prior to granting such access, to allow Controller to seek a protective order or other appropriate remedy. If such notice is legally prohibited, ControlHippo will take reasonable measures to protect the Customer Content from undue disclosure as if it were ControlHippo’s own confidential information being requested and shall inform Controller promptly as soon as possible if and when such legal prohibition ceases to apply.
• 7.2 In case Controller receives any request or communication from Data Subjects which relates to the Processing of Customer Content (” Request “), ControlHippo shall reasonably provide the Controller with full cooperation, information and assistance (” Assistance “) in relation to any such Request where instructed by Controller.
• 7.3 Where ControlHippo receives a Request, ControlHippo shall (i) not directly respond to such Request, (ii) forward the request to Controller within ten (10) business days of identifying the Request as being related to the Controller and (iii) provide Assistance according to further instructions from Controller.
8. Technical and Organizational Measures
• 8.1 ControlHippo shall implement and maintain appropriate technical and organizational security measures to ensure that Customer Content is Processed according to this DPA, to provide assistance and to protect Customer Content against a Personal Data Breach (” TOMs “). Such measures shall include the measures set out in Appendix 2.
9. Assistance with Data Protection Impact Assessment
• 9.1 Where a Data Protection Impact Assessment (” DPIA “) is required under applicable Data Protection Laws for the Processing of Customer Content, ControlHippo shall provide upon request to Customer any information and assistance reasonably required for the DPIA and assistance for any communication with data protection authorities, where required, unless the requested information or assistance is not pertaining to ControlHippo’s obligations under this DPA.
• 9.2 The Customer shall pay ControlHippo reasonable charges for providing the assistance in this clause 9 to the extent that such assistance is not reasonably able to be accommodated within the normal provision of the Services.
10. Information Rights and Audit
• 10.1 ControlHippo shall, in accordance with Data Protection Laws, make available to Customer on request in a timely manner such information as is necessary to demonstrate compliance by ControlHippo with its obligations under Data Protection Laws.
• 10.2 ControlHippo shall, upon reasonable notice, allow for and contribute to audits of the ControlHippo’s Processing of Customer Content, as well as the TOMs (including data Processing systems, policies, procedures and records), during regular business hours and with minimal interruption to ControlHippo’s business operations. Such audits shall be conducted by the Customer, its affiliates or an independent third party on Customer’s behalf (which will not be a competitor of the Processor) that is subject to reasonable confidentiality obligations.
• 10.3 Customer shall pay ControlHippo reasonable costs of allowing or contributing to audits or inspections in accordance with clause 10 (b) where Customer wishes to conduct more than one audit or inspection every 12 months. ControlHippo will immediately refer to Customer any requests received from national data protection authorities that relate to the ControlHippo’s Processing of Customer Content.
• 10.4 ControlHippo undertakes to cooperate with Controller in its dealings with national data protection authorities and with any audit requests received from national data protection authorities.
11. Personal Data Breach Notification
• 11.1 In respect of a Personal Data Breach (actual or reasonably suspected), ControlHippo shall:
• (a) notify Customer of a Personal Data Breach involving ControlHippo or a subcontractor without undue delay and it shall be the responsibility of the Controller to inform the Supervisory Authority of such breach within 72 hours of notice by ControlHippo;
• (b) provide reasonable information, cooperation and assistance to Customer in relation to any action to be taken in response to a Personal Data Breach under Data Protection Laws, including regarding any communication of the Personal Data Breach to Data Subjects and national data protection authorities.
12. Subcontracting
• 12.1 Customer consents to the ControlHippo engaging third-party sub-processors as indicated in Appendix 1 to Process Customer Content to fulfil its obligations under the Agreement provided that, ControlHippo will provide at least fifteen (15) days’ notice to the Customer’s account administrator prior to the appointment or replacement of any sub-processor. Customer may object to ControlHippo’s appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such an event, ControlHippo will either not appoint or replace the sub-processor or, if this is not possible, Customer may suspend or terminate the Services (without prejudice to any fees incurred by Customer prior to such suspension or termination).
• 12.2 Where ControlHippo, with Customer’s consent, subcontracts its obligations and rights under this DPA it shall do so only by way of a binding written contract with the sub-processor which imposes essentially the same obligations according to Art. 28 GDPR especially with regard to instructions and TOMs on the sub-processor as are imposed on ControlHippo under this DPA.
• 12.3 Where the sub-processor fails to fulfil its data protection obligations under the subcontracting agreement, ControlHippo shall remain fully liable to Customer for the fulfilment of its obligations under this DPA and for the performance of the sub-processor ‘s obligations.
13. International Data Transfers
• 13.1 The Parties agree that when the transfer of Customer Content from Controller to Processor is a Restricted Transfer and applicable Data Protection Laws require that appropriate safeguards are put in place, such transfer shall be subject to the appropriate Standard Contractual Clauses, which shall be deemed incorporated into and form part of this DPA as follows:
• a. In relation to transfers of Customer Content originating from the EEA and subject to the GDPR, the EU SCCs shall apply, completed as follows:
• i. Module 2 (Controller to Processor) shall apply where You are a Controller and We are a Processor;
• ii. in Clause 7, the optional docking clause will apply;
• iii. in Clause 11, the optional language will not apply;
• iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;
• v. in Clause 18(b), disputes shall be resolved before the courts of Ireland;
• vi. Annex I of the EU SCCs shall be deemed completed with the information set out in Appendix I to this DPA;
• vii. Annex II of the EU SCCs shall be deemed completed with the information set out in Appendix II to this DPA; and
• viii. Annex III of the EU SCCs shall be deemed completed with the information set out in Appendix III to this DPA.
• b. In relation to transfers of Customer Content originating Switzerland and subject to the Swiss DPA, the EU SCCs as implemented under sub-paragraph (a) above will apply with the following modifications and constitute the Swiss SCCs:
• i. references to Regulation (EU) 2016/679; shall be interpreted as references to the Swiss DPA;
• ii. references to specific Articles of Regulation (EU) 2016/679; shall be replaced with the equivalent section of the Swiss DPA;
• iii. references to “EU”, “Union”, “Member State”, and “Member State law” shall be replaced with references to “Switzerland” or “Swiss law”;
• iv. the term “member state” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland);
• v. Clause 13(a) and Part C of Annex I are not used and the “competent supervisory” is the Swiss Federal Data Protection Information Commissioner;
• vi. references to the “competent supervisory authority” and “competent courts” shall be replaced with references to the “Swiss Federal Data Protection Information Commissioner” and “applicable courts of Switzerland”;
• vii. in Clause 17, the Standard Contractual Clauses shall be governed by the laws of Switzerland; and
• viii. Clause 18(b) shall state that disputes shall be resolved before the applicable courts of Switzerland.
• ix. Annex I of the Swiss SCCs shall be deemed completed with the information set out in Appendix I to this DPA;
• x. Annex II of the Swiss SCCs shall be deemed completed with the information set out in Appendix II to this DPA; and
• xi. Annex III of the Swiss SCCs shall be deemed completed with the information set out in Appendix III to this DPA.
• c. In relation to transfers of Personal Data originating from the UK and subject to the UK GDPR, the UK SCCs shall apply.
• 13.2 For the purposes of descriptions in the SCCs, You agree that You are the “data exporter” and We are the “data importer”.
• 13.3 The Parties agree that if the Standard Contractual Clauses are replaced, amended or no longer recognized as valid under Data Protection Laws, or if a Supervisory Authority and/or Data Protection Laws requires the adoption of an alternative transfer solution, the data exporter and data importer will: (i) promptly take such steps requested including putting an alternative transfer mechanism in place to ensure the processing continues to comply with Data Protection Laws; or (ii) cease the transfer of Customer Content and at the data exporter’s option, delete or return the Customer Content to the data exporter.
14. Deletion or Return of Personal Data
• 14.1 Upon expiry of the Terms, ControlHippo shall delete all Customer Content, including Personal Data within two (2) years. Within such retention period, Customer may export the Customer Content by writing to ControlHippo at [email protected]. This requirement shall not apply to the extent that ControlHippo as a Processor is required by applicable law to retain some or all of the Personal Data, in which event ControlHippo shall isolate and protect the Personal Data from any further Processing except to the extent required by such law.
15. CCPA undertaking
• 15.1 Customer acknowledges and agrees that Customer is the Business and ControlHippo the Service Provider with respect to any Personal Information of Consumers (as those terms are understood under the CCPA) forming part of Customer Content. ControlHippo will not sell, retain, use, or disclose Personal Information of Consumers that ControlHippo Processes on behalf of the Customer when providing the Services under the Terms for any purpose other than for the specific purpose of providing the Services in accordance with the Terms and as part of the direct relationship between ControlHippo and the Customer. ControlHippo certifies that it understands the restrictions in this clause 15 and will comply with such restrictions.
16. Usage of Customer Content for Analytics
• 16.1 Customer acknowledges and grants to ControlHippo the right of usage of Customer Content to collect, use, copy, store, and transmit said Customer Content, in each case solely to the extent necessary to carry out the purposes as intended by the Customer, including but not limited to carrying out analytics for machine learning.
17. Miscellaneous
• 17.1 In case of any conflict, the provisions of this DPA shall take precedence over the provisions of any other agreement with ControlHippo.
• 17.2 No Party shall receive any remuneration for performing its obligations under this DPA except as explicitly set out herein or in another agreement.
• 17.3 Where this DPA requires a “written notice” such notice can also be communicated per email to the other Party. Notices shall be sent to ControlHippo at [email protected] and Customer at the email address with which they signed up.
• 17.4 Any supplementary agreements or amendments to this DPA must be made in writing and signed by both Parties.
• 17.5 Should individual provisions of this DPA become void, invalid or non-viable, this shall not affect the validity of the remaining conditions of this agreement.

1. ControlHippo has the following policies established, management approved, and documented. The policies shall be continually improving, reviewed at least annually, and require all ControlHippo employees, contractors and interns to review and acknowledge annually. Evidence of policies is required.
• 1.1 Information Security Policy
• 1.2 Acceptable Use Policy
2. ControlHippo has the following policies established, management approved, and documented. The policies shall be continually improving and reviewed at least annually. Evidence of policies is required.
• 2.1 Access Control Policy
• 2.2 Change Management Policy
• 2.3 Mobile Device Management Policy
• 2.4 Remote / Teleworker Policy
3. Security Awareness and Training Program
• 3.1 ControlHippo has in place a Security Awareness Program that all employees are required to complete at hire and at least annually thereafter.
4. Physical Security
• 4.1 ControlHippo shall limit access to areas where Controller data is Processed and maintain audit logs of access.
• 4.2 ControlHippo shall implement security protocols.
5. Asset Management
• 5.1 ControlHippo has in place a system to manage and track all Processor owned or managed assets

1. Operating System / Software / Applications
• 1.1 ControlHippo has in place a method to communicate and/or push security patch updates for operating systems, software, and applications deployed in its environments.
• 1.2 Critical patches and or updates are deployed within 30 days of release.
2. Access Credentials
• 2.1 All employees who have access to or maintain Controller data:
• a. Have a unique user id/account
• b. Do not share user id/account with other users
• c. Are required to authenticate with a second factor
• 2.2 User accounts are required to:
• a. Lock a user account after 5 or less unsuccessful attempts
• b. Remain locked out for at least 15 minutes
3. Encryption
• 3.1 ControlHippo shall use full disk encryption on all corporate managed devices.
• 3.2 ControlHippo shall encrypt all Controller data in transit and at rest.
4. Backups
• 4.1 If ControlHippo performs backup of Controller data:
• a. Backups are required to be performed and stored in a secure location.
• b. Backups shall be encrypted.
5. Intrusion Detection and Prevention
• 5.1 ControlHippo has in place an intrusion detection and prevention system in all corporate and production locations.

Appendix III – List of Sub-processors

As set out in Appendix I.

Appendix IV: UK SCCs

This UK SCCs shall stand included as an addendum to the EU SCCs set implemented under Clause 12.1 (a) of this DPA.

Part 1: Tables

For data transfers from the United Kingdom that are subject to the UK SCCs, the UK SCCs will be deemed entered into (and incorporated into this Data Processing Addendum by this reference) and completed as follows:

1. In Table 1 of the UK SCCs, the Parties’ details and key contact information shall be as set forth in Schedule A.A.
2. In Table 2 of the UK SCCs, information about the version of the Approved EU SCCs, modules and selected clauses which this UK SCC is appended to shall be as set forth in Clauses 11.1 and 12.1(a)(i), (ii), (iii), (iv) of this DPA.
3. In Table 3 of the UK SCCs:
• 3.1 Annex 1A: List of Parties: Parties are as set forth in Appendix I.A.
• 3.2 Annex 1B: Description of Transfer: Description of Transfer is as set forth in Appendix I.B.
• 3.3 Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: TOMs are as set forth in Appendix II.
• 3.4 Annex III: List of Sub processors: Sub processors are as set forth in Appendix I.B.
4. In Table 4 of the UK SCCs, both the data importer and the data exporter may end the UK SCCs in accordance with the terms of the UK SCCs.

Part 2: Mandatory Clauses

Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section ‎‎18 of those Mandatory Clauses.