Data Processing Agreement

a) Scope

This DPA applies to the extent that Company processes Personal Information that is subject to Applicable Data Protection Laws as a processor (or a sub-processor, where applicable) on behalf of and in accordance with the instructions of the Customer in the course of providing the Services and/or for the business purposes agreed with the Customer in writing in the Agreement (collectively, the "Business Purposes"), as further described in Annex A of this DPA. For the avoidance of doubt, Business Purposes shall include (i) processing in accordance with the Agreement (including this DPA); (ii) processing initiated by Customer's authorized users in their use of the Services; and (iii) processing to comply with other documented, reasonable instructions provided by Customer (e.g. via email) or where otherwise agreed upon by the parties, where such instructions are consistent with the terms of the Agreement.

b) Processing of Personal Information

The Parties acknowledge and agree that Customer is the controller of the Personal Information processed in connection with the Services or, if Customer is itself acting on behalf of a third-party controller, a processor.

Company will at all times: (i) process the Personal Information only to fulfil the Business Purposes to provide the Services to Customer in accordance with the Agreement; (ii) not process the Personal Information for a purpose other than the Business Purposes; (iii) not "sell" Personal Information (as understood within the requirements of the CCPA); (iv) not retain, use, or disclose the Personal Information except as necessary to fulfil the Business Purposes or as otherwise permitted under Applicable Data Protection Laws; and (v) not retain, use, or disclose the Personal Information outside of the direct business relationship between the person and the business except as necessary to fulfil the Business Purposes or as otherwise permitted under the Applicable Data Protection Laws. Company certifies that it understands these restrictions and will comply with them.

Customer shall comply with its obligations under Applicable Privacy Laws, and in particular under European Data Protection Laws as a controller or processor (as applicable). Where Customer is itself a processor acting on behalf of a third party controller, Customer shall ensure that any data processing undertaken pursuant to this DPA and the Agreement reflects the documented instructions issued by the ultimate controller of such data.

Company shall process Personal Data submitted to Company by the Customer within the Services as a processor (or sub-processor, as applicable) on behalf of the Customer and in accordance with Customer's instructions.

As a processor, Company shall process Personal Information only for the purposes described in the Agreement (including this DPA) and only in accordance with the Business Purposes. Company shall inform the Customer if, in its opinion, the Customer's processing instructions infringe Applicable Data Protection Laws.

The parties agree that the Agreement (including this DPA), and the Customer's use of the Services in accordance with the applicable terms of use, set out Customer's complete and final instructions to Company in relation to the processing of Personal Information. The parties further agree that any processing outside the scope of these instructions (if any) shall require a prior written agreement between the Customer and Company.

c) Aggregate or de-identified information

Notwithstanding the foregoing or anything to the contrary in the Agreement (including this DPA), the Customer acknowledges that Company shall have a right to collect and create anonymized, aggregate, and/or de-identified information as defined by Applicable Data Protection Law ("Aggregate Data") for its own legitimate business purposes, including, but not limited to, product improvement and development.

d) Customer responsibilities

The Customer is responsible for the lawfulness of Personal Information processed under or in connection with the Agreement. Notwithstanding anything contrary in the Agreement, the Customer represents and warrants that:

• it has provided, and will continue to provide all notice and obtained, and will continue to obtain, all consents, permissions and rights necessary under Applicable Data Protection Laws for Company to lawfully process Personal Information for the purposes contemplated by the Agreement (including this DPA);
• it has complied with its obligations under Applicable Data Protection Laws in order to lawfully provide Company and its Sub-processors with the Personal Information; and
• it shall ensure its processing instructions comply with applicable laws (including Applicable Data Protection Law) and that the processing of Personal Information by Company in accordance with the Customer's instructions will not cause Company to be in breach of Applicable Data Protection Laws.

e) Prohibited information

Customer further acknowledges that it shall not disclose, and shall not require any individuals to disclose, (i) Sensitive Information or (ii) Personal Information of any person under the age of 13, and Customer agrees not to provide any such information through the Services.

The Services provide reasonable technical and organizational measures that have been designed, taking into account the nature of its Processing, to assist Company's customers in securing their Personal Information in the Services, insofar as reasonably possible. Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. These measures are listed in Annex B of this DPA.

Company will require that its personnel who is granted access to Personal Information be under an appropriate obligation of confidentiality (whether a contractual or statutory duty) to protect the confidentiality of the Personal Information.

Customer agrees that, except as otherwise provided by this DPA, the Customer is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Personal Information when in transit to and from the Service(s) and taking any appropriate steps to securely encrypt or backup any Personal Information processed in connection with the Services.

Upon written request from Customer, Company shall provide written responses (on a confidential basis) to reasonable requests for information from Customer in relation to Company's processing of Personal Information, as long as Customer does not exercise this right more than once in any 12-month rolling period. Customer may also exercise such audit right in the event Customer is expressly requested or required to provide this information to a data protection authority, or Company has experienced a Security Incident, or on another reasonably similar basis.

Customer is responsible for handling any requests or complaints from Data Subjects with respect to their Personal Information processed by Company. Customer shall delete from the Services all Personal Information (except where such information has been anonymized or de-identified) for which it has received a verified request for deletion from the relevant individuals or applicable data protection authorities relating to the processing of Personal Information under the Agreement.

Company will notify Customer as soon as practicable, unless prohibited by applicable law, if Company receives any such requests or complaints. For the avoidance of doubt, Company may communicate, without restriction, with a regulatory or judicial body or a Data Subject if it is not reasonably apparent on the face of the communication to which customer of Company the request relates to.

Customer acknowledges that the Services provide the Customer with a number of controls that the Customer may use to retrieve, correct, delete or restrict Personal Information, which Customer may use to assist it in connection with its obligations under Applicable Data Protection Laws and to respond to requests from Data Subjects or applicable data protection authorities.

a) Data protection impact assessments

Company will assist with conducting any legally required data protection impact assessments (including subsequent consultation with applicable data protection authorities), if so required by applicable law, taking into account the nature of processing and the information available to Company. Company may charge a reasonable fee for any such assistance, as permitted by Applicable Data Protection Laws.

b) Regulatory investigations

Upon request from the Customer, Company will assist the Customer in the event of an investigation by a competent regulator, including a data protection authority or similar authority, if and to the extent that such investigation relates to the processing of Personal Information by Company on your behalf in accordance with this Agreement. Company may charge a reasonable fee for such requested assistance, to the extent permitted by Applicable Data Protection Laws.

Upon becoming aware of a Security Incident, Company shall notify Customer without undue delay that a Security Incident has occurred, unless otherwise prohibited by applicable law or otherwise as instructed by a supervisory authority. Following such notification, Company will take reasonable steps to mitigate the effects of the Security Incident and to minimize any damage resulting from the Security Incident. Company shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Client.

At the Customer's request, Company will provide reasonable assistance and cooperation with respect to any notifications that the Customer is legally required to send to affected Data Subjects and relevant authorities. Company may charge a reasonable fee for such requested assistance, to the extent permitted by Applicable Data Protection Laws.

Pursuant to the Agreement, Customer agrees that Company may engage Sub-processors to process personal data on the Customer's behalf and disclose Personal Information to Sub-processors, provided that Company imposes appropriate obligations on its Sub-processors regarding the security and confidentiality of Personal Information.

By signing this DPA, Customer hereby provides a general written authorization for Company to engage Sub-processors to provide the Services.

List of Sub-processors

Company will provide at least fifteen (15) calendar days prior written notice to Customer of the engagement of any new Sub-Processor. Customer may object in writing to the appointment of each such Sub-Processor on reasonable grounds (e.g. if making Personal Information available to the Sub-Processor may violate Applicable Privacy Law or weaken the protections for such Personal Information) by notifying Company promptly in writing within ten (10) calendar days of receipt of Company notice in accordance with this Section 7. Such notice shall explain the reasonable grounds for the objection and the parties shall discuss such concerns in good faith with a view to achieving a commercially reasonable resolution. If Customer does not object to the proposed Sub-processor within ten (10) calendar days of receipt of notice, the Sub-processor is deemed to have been approved. Company may in its sole discretion, remove the Sub-Processor from the list. In the event a Sub-Processor is removed by Company, Company will be provided a reasonable amount of time to replace the Sub-processor.

In connection with the performance of the Agreement, the parties agree that Company may transfer Personal Information to various locations, which may include locations both inside and outside of the European Economic Area ("EEA"). The parties agree that where transfer of Personal Information from Customer to Company is a Restricted Transfer, it will be subject to the transfer mechanism considerations listed below:

The parties further agree that:

1. although Company is not relying on Privacy Shield as a legal basis for transfers of personal data outside the EU in light of the judgement of the Court of Justice of the European Union in Case C-311/18, Company shall continue to process personal data (within the meaning of Applicable Data Protection Laws) in compliance with the Privacy Shield Principles as long as Company is self-certified to Privacy Shield. Company further agrees to notify Customer if it determines that it can no longer meet its obligation to provide the level of protection required by the Privacy Shield Principles.

2. the Restricted Transfer shall be subject to the appropriate Model Clauses, which are automatically incorporated by reference and form an integral part of this DPA, as follows:

a) EU GDPR Transfers

In relation to Personal Information that is protected by the GDPR, the EU SCCs will apply as follows:

• Module Two (Transfer controller to processor) and Module Three (Transfer processor to processor) will apply, where appropriate;
• in Clause 7, the optional docking clause shall apply;
• in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-Processor changes shall be fifteen (15) days;
• in Clause 11, the optional language will not apply;
• in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;
• in Clause 18(b), disputes shall be resolved before the courts of Ireland;
• Annex I of the EU SCCs shall be deemed completed with the information set out in Annex A to this DPA;
• Annex II of the EU SCCs shall be deemed completed with the information set out in this DPA.

b) UK GDPR Transfers

In relation to data that is protected by the UK GDPR, the EU SCCs as implemented in accordance with paragraph (a) above will apply provided that:

• any references in the EU SCCs to "Directive 95/46/EC" or "Regulation (EU) 2016/679" shall be interpreted as references to the UK GDPR; references to specific Articles of "Regulation (EU) 2016/679" are replaced with the equivalent Article or Section of UK GDPR; references to "EU", "Union" and "Member State law" are all replaced with "UK"; Clause 13(a) and Part C of Annex II of the EU SCCs are not used; references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the Information Commissioner and the courts of England and Wales; Clause 17 of the EU SCCs is replaced to state that "The Clauses are governed by the laws of England and Wales" and Clause 18 of the EU SCCs is replaced to state "Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may bring legal proceeding against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts";
• to the extent and for so long as the EU SCCs as implemented in accordance with paragraph 2(A) above cannot be used to lawfully transfer Personal Information protected by the UK DPA to Supplier, the UK SCCs shall be incorporated into and form an integral part of this DPA and shall apply to such transfers; and
• for the purposes of the UK SCCs (where applicable) the relevant Annexes/ Appendices of the UK SCCs shall be deemed completed using the information contained in Annex A and Annex B of this DPA.

c) Swiss DPA Transfers

In relation to Personal Information that is protected by the Swiss DPA, the EU SCCs as implemented in accordance with paragraph (1) above will apply provided that:

• references in the EU SCCs to "Regulation (EU) 2016/679" or the "GDPR" shall be interpreted as references to the Swiss Federal Act on Data Protection (FADP);
• references to "EU", "Union" and "Member State law" shall be interpreted as references to Switzerland and to Swiss law, as the case may be;
• the term 'member state' shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland);
• the EU SCC clauses should be interpreted as protecting the data of legal entities until the entry into force of the revised FADP; and
• references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner (FDPIC) and competent courts in Switzerland.

d) Conflict Resolution

In the event that any provision of this Agreement or this DPA contradicts, directly or indirectly, the Model Clauses, the Model Clauses shall prevail.

To the extent Company adopts an alternative data export mechanism (including any new version of or successor to the Standard Contractual Clauses) for the transfer of personal data ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall apply instead of any transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with Applicable Data Protection Law and extends to the territories to which the personal data is transferred), and, if required, the parties agree to execute such other and further documents and take such other and further actions as may be reasonably necessary to give legal effect to such Alternative Transfer Mechanism.

If and to the extent that a court of competent jurisdiction or relevant supervisory authority with binding authority orders (for whatever reason) that the measures described in this DPA cannot be relied on to lawfully transfer personal data in accordance with Applicable Data Protection Laws, Company may implement any additional measures or safeguards not described in this DPA to enable the lawful transfer of such personal data.

Upon termination or expiration of the Agreement for any reason, Company will, at the Customer's request, return or destroy Personal Information in its possession or control. This requirement shall not apply to the extent that Company is required by any applicable law to retain some or all information (including Personal Information), in which event Company shall isolate and protect such data from any further processing except to the extent required by applicable law.

a) The parties agree that this DPA shall supersede and replace any existing terms the parties may have previously entered into in connection with the Services, as such terms relate to the subject matter of this DPA.

b) The obligations placed upon Company under this DPA shall survive so long as Company and/or its Sub-processors process Personal Information on the Customer's behalf.

c) This DPA may not be modified except by a subsequent written instrument signed by both parties.

d) If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.

e) The Agreement remains unchanged and in full force and effect. In case of discrepancies between this DPA and any agreement(s) between the parties and/or their Affiliates, the provisions of the following documents (in order of precedence) shall prevail: (a) Standard Contractual Clauses (where applicable); then (b) this DPA; and then (c) the main body of the Agreement. This DPA shall not limit or restrict, but shall only be deemed to supplement the Standard Contractual Clauses.

f) Any claims brought under or in connection with this DPA shall be subject to the terms and conditions of the Agreement.

g) This DPA will be governed by and construed in accordance with the governing law and venue provisions in the Agreement, unless required otherwise by Applicable Data Protection Laws.

ANNEX 1(A): LIST OF PARTIES

ANNEX 1(B): DESCRIPTION OF THE PROCESSING / TRANSFER

Categories of Data Subjects whose personal information is transferred:

Customer shall be deemed to have declared that the categories of data subjects include: (i) prospects, customers, business partners and vendors of Customer (who are natural persons); (ii) employees or contact persons of Customer's prospects, customers, business partners and vendors; (iii) employees, agents, advisors, freelancers of Customer (who are natural persons); and/or (iv) Customer's Authorized Users.

Categories of Personal Information transferred:

Customer shall be deemed to have declared that the types of personal data may include but are not limited to the following types of personal data: (i) name, address, title, contact details; (ii) IP addresses, usage data, cookies data, location data and (iii) contents of emails.

Sensitive Information transferred (if appropriate) and applied restrictions or safeguards:

In accordance with Section 2.5 of the DPA, Customer shall not disclose, and shall not require any individuals to disclose, (i) Sensitive Information or (ii) Personal Information of any person under the age of 13, and Customer agrees not to provide any such information through the Services.

Frequency of the Transfer:

Continuous or one-off depending on the Services being provided by Company.

Nature, subject matter and duration of the Processing:

• Nature: Company provides a Service designed to improve the email experience by making it faster and more intelligent, as further described in the Agreement.
• Subject Matter: Personal Information.
• Duration: The duration of the data processing under this DPA is until the termination of the Agreement in accordance with its terms, plus the period from the expiry of the Agreement until deletion of the Personal Information by Company, in accordance with the terms of the Agreement.

Purpose(s) of the data transfer and further processing:

Company shall process Personal Information for the Business Purposes, as further defined in Section 2.1 of the DPA.

Period for which the personal information will be retained:

Company will retain Personal Information from Customer for the term of the Agreement and any period after the termination of expiry of the Agreement during which Company processes Personal Information from Customer in accordance with the Agreement.

ANNEX 1(C): COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority, in accordance with Clause 13 of the EU SCCs, is either:

1. the supervisory authority applicable to the data exporter in its EEA country of establishment or,
2. where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or
3. where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the data subjects relevant to the transfer are located.

With respect to the processing of Customer Personal Data to which the UK GDPR applies, the competent supervisory authority is the Information Commissioners Office (the "ICO").

With respect to the processing of personal data to which the Swiss DPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

Company's information security program includes administrative, technical, and physical safeguards to protect the Personal Information that we handle against anticipated threats or hazards to its security, confidentiality or integrity (such as unauthorized access, collection, use, copying, modification, disposal or disclosure, unauthorized, unlawful, or accidental loss, destruction, acquisition, or damage or any other unauthorized form of processing).

If you have any questions or comments about this DPA or need a signed copy, please do not hesitate to contact us: