SmartBear Data Processing Addendum

a. “Data Protection Law” means any applicable law relating to data security, data protection and/or privacy including, without limitation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing of personal data and the free movement of that data (“EU GDPR”), Retained Regulation (EU) 2016/679 (the “UK GDPR”, and together with the EU GDPR, the “GDPR”)) and the UK Data Protection Act of 2018, and the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et. seq.) (“CCPA”), and any implementing, derivative or related legislation, rule, regulation, and regulatory guidance, as amended, extended, repealed and replaced, or re-enacted.

b. “Personal Data” means any information relating to, that describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable natural person (“Data Subject”), and which is Processed by SmartBear on behalf of Customer pursuant to the Agreement. An identifiable natural person is one who can be identified, directly or indirectly, in particular by referencing an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. 

c. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

d. “Process”, “Processing” or “Processed” means any operation or set of operations which is performed upon Personal Data whether or not by automatic means, including collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing, making available, aligning, combining, blocking, erasing and destroying Personal Data.

e. “Services” means the provision of SmartBear products and services as set forth  in the Agreement.

f. “Standard Contractual Clauses” means, with respect to (i) the UK GDPR, the standard contractual clauses (controller to processor module) set out in the European Commission’s Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 as modified by the  UK Addendum to the EU standard contractual clauses (effective 21 March 2022), and (ii) the EU GDPR, the standard contractual clauses (controller to processor module) set out in the European Commission’s Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament as may be amended or replaced by the European Commission from time to time.

g. “Subprocessor” means any third party which Processes Personal Data on behalf of SmartBear.

a. This Addendum applies only to the extent Personal Data subject to Data Protection Laws is Processed by SmartBear.  The Parties acknowledge and agree that for purposes of the GDPR, with regard to the Processing of Personal Data, (i) Customer is the Data Controller, (ii) SmartBear is a Data Processor, and (iii) SmartBear may engage Subprocessors pursuant to the requirements set forth in Section 5 below.  Further details of the Processing activities under this Addendum are set forth in Schedule 1.

b. Customer represents and warrants that it has a legal basis for Processing Personal Data, and the authority and right, including consent where required, to lawfully transfer Personal Data to SmartBear.  Customer shall comply with all applicable Data Protection Laws in connection with the Personal Data, including without limitation in connection with providing all required notices, and obtaining all required consents, regarding the Processing and transfer of Personal Data.  Customer acknowledges and agrees that the Services are designed to be for content-neutral, general use and are not designed to Process sensitive or special category data.

a. Limitations on Use; Instructions. SmartBear shall, and shall require that Subprocessors shall, Process Personal Data only: (i) on behalf of Customer and in accordance with Customer’s documented instructions (which shall, for purposes of this DPA, constitute the instruction to Process Personal Data for purposes of performing the Services in accordance with the Agreement, or such other instructions as may be agreed in writing between the Parties), including with regard to transfers of Personal Data to a third country or an international organization; (ii) when required to do so by applicable law to which SmartBear is subject.  In such case, SmartBear will inform Customer of that legal requirement before processing, unless prohibited by applicable law; and (iii) in compliance with this Addendum and all applicable Data Protection Law.

b. Security. SmartBear has implemented and will maintain commercially reasonable technical and organizational measures to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.  Having regard to the state of the art and the cost of their implementation, SmartBear agrees that such measures shall ensure a level of security appropriate to the risks represented by the Processing and the nature of Personal Data to be protected. SmartBear may update the technical and organizational measures from time to time in light of technical development.

c. Confidentiality. SmartBear will treat all Personal Data as confidential information in accordance with the Agreement. SmartBear will take reasonable steps to ensure that its personnel who have access to the Personal Data are obligated to keep such Personal Data confidential.

d. Notice of Certain Events.  SmartBear will promptly notify Customer about: (i) any instruction which, in its opinion, infringes Data Protection Law; (ii) any complaint, communication or request received directly by SmartBear or a Subprocessor from a Data Subject and pertaining to their Personal Data, or from a regulatory authority in connection with the Personal Data, in each case without responding to that request unless it has been otherwise instructed and authorized to do so by Customer or is required to do so by applicable law; or (iii) any change in legislation applicable to SmartBear or a Subprocessor which is likely to have a substantial adverse effect on SmartBear’s ability to comply with its obligations under this Addendum.

e. Breach Response.  SmartBear shall notify Customer without undue delay after becoming aware of a Personal Data Breach, and SmartBear shall take reasonable steps to prevent any further Personal Data Breach and to mitigate any resulting damage to Personal Data resulting from the same.  SmartBear shall take appropriate steps to provide Customer with prompt cooperation and assistance in relation to any notifications that Customer is required to make as a result of the Personal Data Breach.  Further, upon written request, SmartBear shall provide Customer with reasonable assistance in relation to any data protection impact assessment or regulatory consultation that Customer is legally required to make in respect of Personal Data.

f. Data Subject/Supervisory Authority Request. SmartBear will provide Customer with reasonable cooperation and assistance in relation to any complaint, communication or request received from a Data Subject or a data protection supervisory authority. Notwithstanding any provision herein to the contrary, the SmartBear’s obligations as set forth in this Section shall apply only to the extent Customer does not have the ability to access the required information directly through the applicable SmartBear service.

g. Audit and Certifications.  To the extent required by applicable Data Protection Laws, and upon Customer’s reasonable written request (not less than 120 days in advance) and at mutually agreed upon times no more than once in any 12 month period, and subject to the confidentiality obligations set forth in the Agreement, SmartBear shall make available to Customer reasonable written information, in the form of access to SmartBear’s books and records, regarding SmartBear’s compliance with the obligations set forth in this Addendum. Customer shall use its best efforts to minimize disruption to SmartBear and its business operations.

h. Return or Disposal. The Parties agree that upon termination of the Services in so far as they relate to Personal Data, SmartBear shall, and shall require all Subprocessors to, at the choice of Customer, return all Personal Data and copies thereof to Customer, or securely destroy all Personal Data and certify to Customer that they have done so, unless prohibited by applicable law.

a. Customer hereby generally authorizes SmartBear to appoint Subprocessors for purposes of Processing Personal Data pursuant to the Agreement. 

b. Upon Customer’s request, or as otherwise required by applicable Data Protection Laws, SmartBear shall make available information about Subprocessors which, to SmartBear’s actual knowledge, will Process Personal Data.  This information may be made available by SmartBear online via a URL provided by SmartBear to Customer and shall be updated by SmartBear from time to time. 

c. SmartBear will inform Customer of any new Subprocessor which, to SmartBear’s actual knowledge, will be Processing Personal Data and is engaged during the term of the Agreement, including by updating the URL or Customer portal or account information or by emailing Customer before the new Subprocessor commences Processing of Personal Data. If Customer can reasonably show that the appointment of a new Subprocessor will have a material adverse effect on Customer’s ability to comply with applicable Data Protection Laws, then Customer must promptly notify SmartBear in writing within fifteen (15) business days thereafter of its reasonable basis for objection to the use of the applicable new Subprocessor. Upon receipt of Customer’s written objection, Customer and SmartBear will work together without unreasonable delay to agree upon an alternative arrangement.  If a mutually acceptable and reasonable alternative arrangement is not found,, then Customer may terminate the Agreement only with respect to those Services that cannot be provided by SmartBear without the use of the new Subprocessor. Unless prohibited by applicable Data Protection Laws, in the event of such early termination by Customer, SmartBear may retain or require payment under the Agreement through the end of Customer’s current contract term for the terminated Services.

d. In the event SmartBear engages Sub-Processors in connection with the Services, SmartBear shall place the same or similar obligations as those in this Addendum on such Sub-Processors or other obligations required by applicable Data Protection Law, and shall remain fully liable to Customer for the acts or omissions of such Sub-Processors, as if they were the acts or omissions of SmartBear.

a. Sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, such personal information to another business or a third party for monetary or other valuable consideration; or

b. Retain, use, disclose, collect, sell, use, or otherwise process such personal information (i) for any purpose other than for the specific purpose of, and as necessary for, performing Services for Customer pursuant to the Agreement, or (ii) as otherwise permitted by the CCPA.