Data Processing Addendum

1. DEFINITIONS

   The following terms have the meanings set out below for purposes of this DPA. Any capitalized terms not defined in this DPA have the meanings given in the Agreement.“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where “control” refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.“Applicable Data Protection Laws” means the privacy, data protection and data security laws and regulations applicable to Provider’s Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws and GDPR.“Controller” means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including, as applicable, any “business” or “controller” as such term is defined by the California Consumer Privacy Act (the “CCPA”) or other State Privacy Laws.“Customer Data” means information provided or otherwise made available by or on behalf of Customer to Provider for Processing on Customer’s behalf to perform the Services, including Personal Data contained within Customer Content (including Scenes and Output) as those terms are defined in the Agreement.“Data Subject” means the identified or identifiable natural person to whom Personal Data relates.“EEA” means the European Economic Area.“FADP” means the Swiss Federal Act on Data Protection of 25 September 2020 (as amended and in force from 1 September 2023) and any applicable implementing legislation and ordinances, and, to the extent applicable, its predecessor of 19 June 1992.“FDPIC” means the Swiss Federal Data Protection and Information Commissioner.“GDPR” means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UK GDPR”), including, in each case (i) and (ii), any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment, to or of the foregoing. References to “Articles” and “Chapters” of, and other relevant defined terms in, the GDPR shall be construed accordingly.“Information Security Incident” means a breach of Provider’s security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider’s possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.“Personal Data” means Customer Data that constitutes “personal data,” “personal information,” or “personally identifiable information” defined in Applicable Data Protection Laws or information of a similar character regulated thereby, provided that Personal Data does not include such information pertaining to Customer’s business contacts who are Customer personnel or such information that Provider receives, collects, or generates independently of the Services and not from or on behalf of Customer.“Process” or “Processing” means any operation or set of operations which is performed by Provider (or on Provider’s behalf) for Customer under the Agreement on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.“Processor” means the entity that Processes Personal Data on behalf of the Controller, including, as applicable, any “service provider” or “contractor” as those terms are defined by the CCPA.“Restricted Transfer” means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an “EU Restricted Transfer”); (ii) in the context of the UK, any country or territory outside the UK which does not benefit from an adequacy decision from the UK Government (a “UK Restricted Transfer”); and (iii) in the context of Switzerland, a country or territory outside of Switzerland which does not benefit from an adequacy decision from the Swiss Government (a “Swiss Restricted Transfer”), in each case, which would be prohibited without a legal basis under applicable data protection law (including Chapter V of the GDPR, where applicable).“SCCs” means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.“Security Measures” has the meaning given in Section 4.1 (Provider Security Measures).“Services” has the meaning given in the Agreement.“State Privacy Laws” means, collectively, the comprehensive state-specific data privacy laws (and any implementing regulations) currently in effect and applicable to Provider’s Processing of Personal Data under the Agreement.“Subprocessors” means Provider’s Affiliates and third parties that Provider engages to Process Personal Data in relation to the Services.“Supervisory Authority” means any entity with the authority to enforce Applicable Data Protection Laws, including (i) in the context of the EEA and the EU GDPR, the meaning given to that term in the EU GDPR; (ii) in the context of the UK and the UK GDPR, the UK Information Commissioner’s Office; and (iii) in the context of Switzerland and the FADP, the FDPIC.“UK Transfer Addendum” means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the Mandatory Clauses included in Part 2 thereof.

2. DURATION AND SCOPE OF DPA

   This DPA will remain in effect so long as Provider Processes Personal Data, notwithstanding the expiration or termination of the Agreement. Processing of Personal Data subject to the GDPR shall be subject to Annex 2 (European Annex). Processing of Personal Data subject to the State Privacy Laws with respect to which Customer is a Business, Controller, Processor, or Service Provider (as such terms are defined in State Privacy Laws) shall be subject to Annex 3 (State Privacy Laws Annex) to this DPA.

3. CUSTOMER INSTRUCTIONS

   Provider will Process Personal Data only in accordance with Customer’s documented instructions, including as set out in this DPA, the Agreement, and any applicable order form(s). By entering into this DPA, Customer instructs Provider to Process Personal Data to provide, secure, support, and improve the Services; perform its obligations and exercise its rights under the Agreement; and comply with applicable law. Additional instructions that are inconsistent with the Agreement or this DPA, or that require Provider to materially change the Services or perform additional work, may be subject to Provider's then-current professional services rates and must be documented in a mutually executed written agreement. The details of Provider’s Processing of Personal Data, including the Parties’ respective roles, are described in Annex 1 (Data Processing Details).

4. SECURITY

   1. Provider Security Measures. Provider will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in Annex 4 (the “Security Measures”), taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing and the risks to Data Subjects. Provider may update the Security Measures from time to time, including to maintain or improve security or address changes in Applicable Data Protection Laws, so long as the updated measures do not materially decrease the overall protection of Personal Data.
   2. Security Compliance by Provider Staff. Provider will require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.
   3. Information Security Incidents. Provider will notify Customer without undue delay, and in any event within seventy-two (72) hours, of any Information Security Incident of which Provider becomes aware. Provider may provide information in phases as it becomes reasonably available, and its notification will describe, to the extent then known, the nature of the Information Security Incident and the measures taken or proposed to address it. Provider’s notification of or response to an Information Security Incident will not be construed as an acknowledgement of fault or liability. Taking into account the nature of the Processing and the information available to Provider, Provider will provide reasonable assistance required by Applicable Data Protection Laws for Customer to investigate and respond to the Information Security Incident. Customer will reimburse Provider for reasonable assistance requiring work beyond the standard functionality of the Services, except to the extent the Information Security Incident was caused by Provider’s breach of this DPA. Customer remains responsible for its own legal and third-party notification obligations. To the extent a notice refers to or identifies Provider, where legally permitted, Customer will notify Provider in advance and reasonably consider Provider’s factual corrections relating to its involvement.

5. CUSTOMER’S SECURITY RESPONSIBILITIES AND ASSESSMENT

   1. Customer’s Security Responsibilities. Customer agrees that, without limitation of Provider’s obligations under Section 4 (Security), Customer is solely responsible for its use of the Services, including (i) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (ii) securing the account authentication credentials, systems and devices Customer uses to access the Services; (iii) securing Customer’s systems and devices that Customer provides or makes available for Provider to access in order to provide the Services; and (iv) backing up Personal Data, as applicable.
   2. Customer’s Security Assessment. Customer acknowledges that it has evaluated the Services, the Security Measures and Provider’s commitments under this DPA and, based on information made available by Provider, determines that they are adequate to meet Customer’s needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Personal Data.

6. DATA SUBJECT RIGHTS

   1. Data Subject Request Assistance. Provider will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary and technically feasible for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”) with respect to Personal Data in Provider’s possession or control. Customer will compensate Provider for any such assistance, to the extent such assistance requires work beyond the Services, at Provider’s then-current professional services rates, which shall be made available to Customer upon request, and Provider will, upon request, provide Customer with a good-faith estimate of applicable fees.
   2. Customer’s Responsibility for Requests. If Provider receives a Data Subject Request, Provider will (i) promptly notify Customer (unless prohibited by applicable law); and (ii) advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding to any such request, unless otherwise required by applicable law.

7. CUSTOMER RESPONSIBILITIES

   1. Customer Compliance Obligations. Customer will ensure (and is solely responsible for ensuring) that it has provided all notices to, and obtained all consents and permissions from, third parties (including, without limitation, Data Subjects), and has reserved all necessary rights, in each case, as may be required under Applicable Data Protection Laws for Provider to Process Personal Data as contemplated by the Agreement.
   2. Prohibited Data Categories. The Services are not designed for, intended for, or suitable for the Processing of Restricted Data. Customer represents and warrants to Provider that Customer Data does not and will not contain any social security numbers or other government-issued identification numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords or other credentials for third-party online accounts (other than credentials created for and used solely to access the Services); credentials to any financial accounts; tax return data; any payment card information subject to the Payment Card Industry Data Security Standard; personal data of children under 16 years of age; or any other information that falls within any special categories of data (as defined in Applicable Data Protection Laws) (collectively, “Restricted Data”).
   3. Legal Basis for Processing. Customer shall ensure that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Provider of Personal Data in accordance with this DPA and the Agreement (including any and all instructions issued by Customer from time to time in respect of such Processing) as required under all Applicable Data Protection Laws (including, where applicable, Articles 6, 9(2) and/or 10 of the GDPR).
   4. Data Subject Notices and Consents. Customer will ensure that all Data Subjects have (i) been presented with all required notices and statements (including as required by Articles 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Provider of Personal Data.

8. SUBPROCESSORS

   1. Consent to Subprocessor Engagement. Customer specifically authorizes the engagement of Provider’s Affiliates as Subprocessors and generally authorizes Provider to engage third parties as Subprocessors in accordance with this Section 8.
   2. Information about Subprocessors. A current list of Subprocessors, including their functions and locations, is set out in Annex 5 to this DPA. Provider may continue to use those Subprocessors already engaged by Provider as of the date Customer accepts this DPA.
   3. Requirements for Subprocessor Engagement. When engaging a Subprocessor, Provider will enter into an agreement imposing data protection obligations that provide a level of protection for Personal Data substantially equivalent to the relevant obligations in this DPA, taking into account the nature of the Subprocessor’s services. Provider remains responsible for the Subprocessor’s performance of the obligations subcontracted to it to the extent required by Applicable Data Protection Laws.
   4. Notice of, and Opportunity to Object to, Subprocessor Changes. Provider may add, replace, or remove Subprocessors as the Services develop. Provider will make an updated Subprocessor list available within the Services or in Annex 5 and will provide advance notice of a new Subprocessor to Customers that subscribe to receive such notices. If Customer objects in writing within 15 days after notice on reasonable data-protection grounds, the Parties will work in good faith to address the objection. If Provider cannot provide a commercially reasonable alternative, Customer may, as its sole and exclusive remedy, terminate only the affected Services by written notice before the new Subprocessor begins Processing Personal Data and must pay all amounts accrued through the effective date of termination.

9. AUDITS

   1. Reviews and Audits of Compliance. Customer may audit Provider’s compliance with its obligations under this DPA no more than once in any twelve (12) month period, except where (a) a competent Supervisory Authority with jurisdiction over Customer requires an additional audit and Customer is legally required to conduct it, in which case any such additional audit is limited to what that requirement mandates and is subject to Customer’s written request providing reasonable detail and, where available, supporting documentation of the applicable requirement; or (b) an Information Security Incident has been confirmed by Provider, in which case Customer may conduct one additional audit limited in scope to the Personal Data and systems affected by such Information Security Incident, subject to Customer's written request providing reasonable detail of the basis for the audit.
   2. Satisfaction of Audit Requests. Provider may satisfy any audit request under this Section 9 by making available to Customer, whether through an online portal, secure link, or other electronic means, relevant documentation reasonably necessary to demonstrate Provider's compliance with its obligations under this DPA, including descriptions of the Security Measures and their implementation. Where Provider makes such documentation available and has confirmed there have been no known material changes to the measures described since the date of the relevant documentation, Customer agrees to accept it in satisfaction of its audit right under this Section 9 and will not require an on-site or independent audit of the controls or measures it addresses. An on-site or independent audit may be conducted only to the extent the documentation Provider makes available is insufficient to satisfy a mandatory requirement of Applicable Data Protection Laws, and any such audit remains subject to Section 9.3.
   3. Conduct of Permitted On-site or Independent Audits. Where an on-site or independent audit is permitted under Section 9.2, Customer must give at least 30 days’ prior written notice and provide a proposed audit plan describing the scope, duration, and start date. The audit must be limited to systems and records relevant to Provider’s Processing of Personal Data for Customer, may not access data of other customers, and must not require disclosure of Provider’s trade secrets or information that would compromise security. Provider may require a third-party auditor to be independent, not be a competitor, and sign a customary confidentiality agreement. The Parties will agree on a final audit plan, and the audit will occur during regular business hours, subject to Provider’s reasonable safety, security, and operational policies, without unreasonable disruption. Customer will promptly notify Provider of any identified non-compliance and provide any resulting audit report, unless prohibited by Applicable Data Protection Laws. Customer may use audit materials only to meet its regulatory obligations or confirm compliance with this DPA. Customer bears all audit costs and will reimburse Provider for reasonable, documented costs and internal time at Provider’s then-current professional services rates. Provider is not required to facilitate more than one on-site or independent audit in any 12-month period unless Applicable Data Protection Laws expressly require otherwise.

10. RETURN AND DELETION

    1. Upon cessation of any Services involving the Processing of Personal Data, Provider will, at Customer's written request, return or delete all Personal Data in its possession, custody or control. If Customer makes no such request within thirty (30) days of cessation, Provider may delete or anonymize all Personal Data. Provider may retain Personal Data to the extent required by applicable law, subject to the confidentiality obligations and Security Measures under this DPA.

11. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

    1. Model Training Restrictions. Provider will not use Personal Data to train or fine-tune its own general-purpose artificial intelligence or machine-learning models or models for other customers. This restriction does not prevent Processing necessary to generate Output or provide the Services in accordance with Customer’s documented instructions.
    2. Subprocessor Model Training. A Subprocessor may use Personal Data for its own model training or improvement only where Customer affirmatively enables or requests the relevant optional third-party service after Provider makes the applicable third-party terms reasonably available, and Customer thereby instructs and authorizes the Processing in accordance with the Agreement.

12. MISCELLANEOUS

    1. Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. This DPA and the Agreement are to be read and construed together; however, this DPA stands alone in respect of the Processing of Personal Data and continues to bind the Parties for so long as Provider Processes Personal Data, regardless of whether the Agreement remains in effect. This DPA does not require signature and becomes binding through Customer's acceptance of the Agreement and use of the Services. Notices under this DPA may be given in accordance with any notice clause of the Agreement or to the contact details set out in Annex 1 (Data Processing Details).
    2. Provider will cooperate in good faith with Customer to agree any amendments reasonably necessary to maintain compliance with Applicable Data Protection Laws. Provider may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided that any such variation does not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations without Customer's written agreement.
    3. Each Party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, to the extent permitted by Applicable Data Protection Laws; provided that nothing in this Section limits any person’s liability to Data Subjects under the third-party beneficiary provisions of the SCCs (if and as they apply).
    4. In the event of conflict, this DPA prevails over the Agreement in respect of the Processing of Personal Data. The SCCs and UK Transfer Addendum prevail to the extent of any conflict concerning a Restricted Transfer to which they apply.