Data Processing Agreement (DPA)

This Data Processing Agreement (the "DPA") is entered into between the Customer entity defined in Annex I (the “Customer”) and Requirement Yogi, SASU, SIRET 812 048 452, located at 535 route des Lucioles, 06560 Sophia Antipolis, France (the "Company").

1. Scope and Applicability

This DPA applies exclusively to the processing of Personal Data by the Company on behalf of the Customer to provide the Requirement Yogi software application (the "Services").

This Data Processing Agreement is incorporated into and forms part of the Requirement Yogi Terms of Service (the “Agreement”).

Terms are defined in section 14.

2. Roles, scope and processing details

2.1 Roles. The Parties’ roles for each Processing activity are specified in Annex I. Customer may act as Controller or as Processor for a customer or Affiliate. Company acts as Processor or Sub-processor for this data.

2.2 Annexes. The details of Processing, including the roles (Controller, Processor, Sub-processor, Exporter, Importer), the categories of data subjects, the categories of Personal Data, the Sub-processors, the legal basis, duration, frequency of the Processing, retention period, location, and international transfers, are defined in Annex I.

2.3 Covered products. The scope of this agreement is limited to the online application (Requirement Yogi Cloud) and support activities. The License Data, and the other products are excluded from this agreement. For Atlassian Data Center apps, data is hosted entirely within Customer-controlled environments; Company processes no Customer Data except as submitted voluntarily by Customer during technical support.

2.4 Sensitive Data. The Services are not designed as a system of record for highly sensitive information. Customer must not use the Services for the targeted, systematic processing or structured storage of special categories of Personal Data, including:

1. information about a person’s intimate life, including conduct in the private domain;

2. medical information or information regarding the person’s mental condition;

3. genetic information;

4. information about a person’s political opinions or religious beliefs;

5. information about a person’s criminal records;

6. telecommunication data;

7. biometric information;

8. information about a person’s assets, financial debts and liabilities, financial situation or change thereof, ability to meet financial undertakings;

9. a person’s consumption habits that may denote information as in items (1) to (8) or regarding a person’s personality, beliefs or opinions;

10. personal data of other users than authorized Requirement Yogi users.

Incidental Data: If Customer incidentally includes special categories of Personal Data within unstructured free-text fields, attachments, or User-Generated Content, Customer acknowledges that Company’s technical and organizational measures remain strictly as described in Annex II. Customer is solely responsible for determining whether those baseline measures meet its own regulatory obligations (including EU MDR or Israeli Privacy Protection Regulations).

2.5 Customer Obligations. As Controller, Customer:

1. is responsible for the lawfulness of its Processing instructions and must identify and maintain a valid legal basis under Applicable Privacy Laws for each category of Personal Data submitted to the Services;

2. must ensure that data subjects receive any notices or disclosures required by Applicable Privacy Laws before their Personal Data is submitted to the Services;

3. must maintain its own records of Processing activities as required by GDPR Article 30;

4. must provide Company with documented Processing instructions as described in Section 3.2, and must notify Company promptly of any change to those instructions that affects Company's obligations under this DPA;

5. must not submit special categories of Personal Data into the Services, as described in Section 2.4;

6. must inform Company promptly of any third-party claim, regulatory inquiry, or supervisory authority proceeding relating to the Processing of Customer Personal Data under this DPA;

7. must disclose to Company any joint-controller arrangement affecting the Processing covered by this DPA;

8. is solely responsible, at its own expense, for taking legal action to challenge public authority requests for Customer Personal Data, as described in Section 4.5; and

9. is responsible for ensuring that its instructions to Company and its overall use of the Services comply with Applicable Privacy Laws.

3. Compliance

3.1 Company must Process Personal Data only on documented instructions from Customer, including instructions regarding transfers, and only as necessary to provide the Services.

3.2 Documented Instructions. The Terms of Service (the Agreement), this DPA, and Annex I constitute documented instructions.  Written instructions from Customer personnel through the support constitute documented instructions. Actions performed through the Platform (for example, through Jira, through Confluence or through the Requirement Yogi Cloud screens) constitute documented instructions.

3.3 If Applicable Privacy Laws require the Company to Process Customer Personal Data other than on Customer’s instructions, the Company must inform Customer of that legal requirement before the Processing, unless the law prohibits notice. The Company must immediately inform Customer if, in the Company’s opinion, an instruction infringes Applicable Privacy Laws and must suspend only the affected Processing pending resolution.

3.4 Company must notify Customer without undue delay, and no later than thirty (30) business days after making the determination, if Company can no longer comply with this DPA or Applicable Privacy Laws. Customer may suspend affected Processing and, if the issue is not cured within thirty (30) business days, terminate the affected Services without penalty.

3.5 Company must maintain standard records of its Processing activities as required by GDPR Article 30. Upon request, Company must provide Customer with its standard, commercially available documentation to assist Customer in maintaining its own records. To the extent Customer requires custom documentation, audits, or specific assistance with local regulatory filings beyond Company’s standard materials, such assistance is subject to mutual agreement and Customer must reimburse Company for its time and materials at Company’s then-current professional services rates.

3.6 CCPA. To the extent the CCPA applies, the Company must act as a service provider or contractor; Process Personal Data only for the specific business purposes described in Annex I; not sell or share Personal Data; not retain, use or disclose it outside the direct business relationship or for another commercial purpose; and not combine it with Personal Data received from another person or collected from Company’s own interaction with an individual, except as expressly permitted by the CCPA. Customer may take reasonable and appropriate steps to ensure compliance and to stop and remediate unauthorized use, provided that those steps are strictly limited to the review of Company’s annual written security questionnaires, standard independent audit reports, or bug bounty program summaries as outlined in Section 11.

4. International Data Transfers

4.1 Company must not access, host, store, disclose or otherwise transfer Customer Personal Data outside an approved Processing Location listed in Annex I, including through telemetry, backups or a Sub-processor, without providing advance notice in accordance with Section 7.2 and a valid transfer mechanism. As a reminder, billing and marketing activities are excluded from this DPA.

4.2 EU SCCs. For a Restricted Transfer subject to the GDPR and is not covered by an adequacy decision or another lawful mechanism, the Parties incorporate the EU SCCs by reference, as set out in Section 5.1 and subsections.

4.3 UK Addendum. For a Restricted Transfer subject to United Kingdom data protection law, the UK Addendum applies as set out in Section 5.2, unless UK adequacy regulations or another lawful mechanism covers the transfer.

4.4 Assistance. Company’s assistance under this section is limited to providing Company’s existing standard security documentation and questionnaires. Any implementation of new supplementary measures requested by Customer must be mutually agreed upon in writing and at Customer’s sole expense.

4.5 Public authority requests. Company must use commercially reasonable efforts to notify Customer promptly of any legally binding request by a public authority for Customer Personal Data, unless prohibited by law, and shall disclose only the minimum legally required data; and document the request and response. Customer shall be solely responsible, at its own expense, for taking any legal action or initiating court proceedings to challenge or contest those requests.

5. International Transfer Mechanisms

5.1 EU Standard Contractual Clauses

5.1.1 Module Two applies where Customer is Controller and Company is Processor. Module Three applies where Customer is Processor and Company is Sub-processor.

5.1.2 Clause mapping:

• Clause 7 (Docking Clause) applies.

• Under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 7.2.

• Clause 11 optional language does not apply.

• For Clause 17, the law selected in Annex I is the law of an EU Member State that permits third-party beneficiary rights; unless Annex I states otherwise, the law of Section 13.2 applies.

• For Clause 18, the courts of Paris (“Tribunal Judiciaire de Paris” and “Tribunal de Commerce de Paris”) apply.

5.1.3 The competent supervisory authority under Clause 13 is determined for each relevant exporter and transfer in accordance with Clause 13 and identified in Annex II. No supervisory authority is selected solely by contract where Clause 13 requires another authority.

5.1.4 The EU SCC Annexes are completed as follows: Annex I.A (List of Parties) and Annex I.B (Description of Transfer) by Annex I and the signature page; Annex I.C (Competent Supervisory Authority) by Annex I; Annex II (Technical and Organizational Measures) by DPA Annex II together with any additional controls stated in Annex I; and, where relevant, Annex III by the Sub-processor information in Annex I.

5.1.5 If the EU SCCs conflict with this DPA, the EU SCCs prevail for the Restricted Transfer. The Parties must not interpret or amend this DPA in a manner that modifies the EU SCCs contrary to Clause 2.

5.2 United Kingdom Restricted Transfers

5.2.1 The “UK Addendum” is the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0 in force 21 March 2022, as lawfully revised by the UK Information Commissioner (the “UK Addendum”).

5.2.2 Clause mapping:

• Table 1 is completed by Annex I and the signature page;

• Table 2 is completed by Section 4.2 and child sections, and Annex II;

• Table 3 is completed by Annex I and II;

• In Table 4, neither party may end the UK Addendum solely because the approved form changes, unless Annex II expressly selects otherwise. Part 2 Mandatory Clauses apply without modification.

6. Confidentiality and Security

6.1 Confidentiality. Company must ensure that each person authorized to Process Customer Data is bound by written or statutory confidentiality obligations, and accesses Customer Data only on a need-to-know and least-privilege basis.

6.2 Security Measures. Company must implement commercially reasonable and appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk, including encryption at rest and in transit, access controls, and automated backups, to protect Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure.

7. Sub-processing

7.1 General Authorization. The Customer grants a general authorization for the Sub-processors listed in Annex I. The Company must not appoint a Sub-processor that is not listed in Annex I or in an approved Sub-processor list incorporated into Annex I.

7.2 Change of Sub-processor. Company must provide at least thirty (30) days prior written notice of a proposed new Sub-processor. Company may satisfy this notice obligation by sending an email to the Customer’s designated legal or administrative contact containing a link to the Company's published Sub-processor list. The published webpage will identify the Sub-processor, services, processing location, data categories, intended appointment date and the list of changes. Customer may object on reasonable data protection or security grounds within the notice period. Company must work in good faith to avoid the objected-to Processing through a commercially reasonable alternative that does not materially reduce functionality, security or protection. If no such alternative is available, Customer may either terminate the affected Services without penalty within thirty (30) days of the objection, or continue using the Services with the new Sub-processor.

7.3 For an urgent replacement necessary to address a Security Incident or imminent material risk, Company may shorten advance notice to the extent objectively necessary, must notify Customer as soon as practicable, and must preserve Customer’s right to object, receive an alternative, or terminate the affected Services.

7.4 Host-Platform Changes. Customer acknowledges that Company's Services operate on and are dependent upon Third-Party Platform, including Atlassian. Those platform vendors may update their own data processing agreements, sub-processor lists, or international transfer terms unilaterally and independently of Company. Company has no ability to prevent, delay, or negotiate those updates. Where such an update takes effect before the notice period in Section 7.2  would expire, Customer's continued use of the host platform constitutes acceptance of the updated platform terms, and Company's inability to provide advance notice does not constitute a breach of this DPA. Company must use commercially reasonable efforts to notify Customer of any material host-platform change it becomes aware of that affects the processing of Customer Personal Data.

8. Data Subject Rights and Cooperation

8.1 The Company must provide commercially reasonable assistance reasonably required for Customer to respond to requests to access, know, correct, delete, restrict, object, opt out, or otherwise exercise rights under Applicable Privacy Laws, taking into account the nature of the processing and information available to the Company. This clause excludes legal advice to the Customer.

8.2 Company must assist Customer with security obligations, breach notifications, data protection and transfer impact assessments, prior consultations and regulatory inquiries, primarily by providing Company’s standard security documentation, completed security questionnaires or bug bounty badge status. To the extent Customer requires custom assistance or dedicated personnel time beyond the provision of standard documentation, such assistance is at Customer's expense at Company’s then-current professional services rates.

9. Personal Data Breach

9.1 Notifications. The Company must notify the Controller without undue delay after becoming aware of a Personal Data breach. The Company will provide reasonable assistance to the Controller in handling the breach. Notification does not constitute an admission of fault. The Company is not in charge of notifying end-users.

9.2 Carve-Outs. A Personal Data Breach does not include, and Company has no obligation to notify Customer regarding: (a) unconfirmed vulnerability reports or bug submissions; (b) automated dependency alerts, CVE notifications, or library vulnerabilities that have not resulted in unauthorized access to Customer Data; (c) pings, port scans, or denial of service attacks; or (d) unsuccessful log-in attempts or similar routine security events.

10. Deletion of Data

10.1 At Customer's choice, upon expiry or termination of the affected Services, or earlier where reasonably requested and consistent with the Agreement, Customer must return or securely delete all Customer Personal Data, and delete existing copies unless EU or Member State law requires continued storage.

10.2 Notwithstanding Section 10.1, the Company must keep routine disaster-recovery backups, limit restoration except for disaster recovery, and delete it through the normal backup cycle.

10.3 If law requires retention, Company must identify the legal basis and retention period where legally permitted, isolate and protect the retained data, Process it only for the legally required purpose, and delete it promptly when the requirement ends.

11. Audits and demonstrations of compliance

11.1 Company must make available to Customer information reasonably necessary to demonstrate compliance, including policies, evidence of active participation in a recognized bug bounty program, and completed standard security questionnaires.

11.2 Customer may request Company’s most recent completed standard security questionnaire (such as the CSA CAIQ) and Bug Bounty program status on reasonable prior notice, normally not more than once in a twelve-month period, unless a Security Incident, material change, reasonable suspicion of non-compliance or authority requirement justifies additional review. Customer agrees to exercise its audit rights under this DPA and Applicable Privacy Laws primarily through this documentary review. Further audits or inspections shall only be permitted in accordance with Sections 11.3, 11.4 and 11.5.

11.3  If Customer has reasonable documented evidence of Company’s material non-compliance, or following a confirmed Personal Data Breach, Company must permit a remote, virtual audit (such as a Q&A session with Company’s technical personnel). To protect the confidentiality and security of Company’s other customers within its multi-tenant environment, any such audit must be strictly remote.

11.4 On-Site Audits and Inspections.

Customer must not conduct an on-site physical audit or inspection unless:

1. Such inspection is expressly mandated by a competent Supervisory Authority under Applicable Privacy Laws; or

2. A confirmed Personal Data Breach has occurred as a result of Company’s material breach, and the documentary and remote audit mechanisms provided under Sections 11.1, 11.2 and 11.3 have demonstrably failed to provide the necessary information required for Customer to verify compliance or satisfy legal reporting obligations.

11.5 Conditions for On-Site Audits.

Any on-site audit is subject to the following conditions:

1. Customer must provide at least thirty (30) business days’ prior written notice detailing the proposed scope, duration, and designated auditor, unless a shorter period is strictly required by a binding order of a Supervisory Authority.

2. Auditor Qualifications: The audit must be conducted during normal business hours by Customer or an independent third-party auditor reasonably acceptable to Company (provided that the auditor is not a competitor of Company and has executed a customary, strict confidentiality agreement).

3. Multi-Tenant & Security Safeguards: The audit must be conducted in a manner that avoids disruption to Company’s operations. To safeguard the confidentiality and security of Company’s multi-tenant environment, intellectual property, and other customers' data, under no circumstances shall Customer or its auditor be granted access to: (i) the personal data or confidential information of other customers; (ii) Company’s underlying source code; or (iii) any live production environments or production databases.

4. Sub-processor Infrastructure: Customer acknowledges that Company’s software relies on third-party cloud infrastructure (such as AWS and Atlassian). On-site access to such physical data center facilities is governed exclusively by the physical security and audit terms of those sub-processors, and Customer's audit rights regarding such facilities are satisfied through independent third-party compliance reports (e.g., SOC 2 Type II or ISO 27001 certifications).

5. Costs: Customer must bear all costs and expenses incurred by Customer and its auditors, and must reimburse Company for its reasonable personnel time expended at Company’s then-current professional services rates, unless the audit reveals a material and uncured breach of this DPA by Company.

12. Indemnity

12.1 Subject to Section 12.3 and the limitations and exclusions of liability set forth in the Agreement, Company must indemnify and hold harmless Customer, its Affiliates and their officers, directors, employees and customers from third-party claims, damages, reasonable legal fees and liabilities to the extent arising from Company’s material breach of this DPA, or violation of Applicable Privacy Laws.

12.2 Customer must indemnify and hold harmless Company, its Affiliates, and their personnel from third-party claims, damages, reasonable legal fees, and liabilities to the extent arising from Customer’s breach of this DPA, including the submission of prohibited sensitive data into the Services.

12.3 Any claims brought under or in connection with this DPA (including claims arising out of the incorporated Standard Contractual Clauses or any Security Incident) are strictly subject to the overall limitations, financial caps, and exclusions of liability set forth in the Agreement. Nothing in this section limits the rights of Data Subjects under Clause 12 of the Standard Contractual Clauses.

13. Miscellaneous

13.1 Conflict. If this DPA conflicts with the Agreement on Processing or protection of Customer Data, this DPA prevails. The Agreement continues to govern commercial matters, including fees and general liability, except as expressly stated otherwise. The EU SCCs or UK Addendum prevail over this DPA only to the extent required for the applicable Restricted Transfer.

13.2 Governing law and jurisdiction. This DPA and any dispute or claim arising out of or in connection with it is governed by the laws of France. Any dispute arising out of or in connection with this DPA is subject to the exclusive jurisdiction of the Commercial Court of Paris (Tribunal de Commerce de Paris), France.

13.3 Severability. If a provision is invalid or conflicts with mandatory law, the Parties must interpret or replace it to preserve the greatest lawful protection for Customer Data without modifying the EU SCCs or UK Addendum in a prohibited manner.

13.4 Modification of this DPA. The Company may modify this DPA from time to time (including to clarify legal terms, reflect changes in its organizational processes, or applicable laws).

• Mandatory legal updates: If modifications are required to comply with changes in Applicable Privacy Laws, a binding decision of a Supervisory Authority, or the issuance of new Standard Contractual Clauses, such changes shall become automatically effective thirty (30) days after notice is provided. If the Customer objects to a legally mandated modification, the Customer’s sole remedy is to terminate the Agreement.

• Appointment of new Sub-processors: Governed by Section 7.2.

• General updates: For all other material updates, the Company must provide the Customer with at least sixty (60) days’ prior written notice. If the Customer reasonably objects to the modification on the grounds that it materially degrades the protection of Customer Data, the Customer must notify the Company within the notice period. If the Parties cannot resolve the objection, the Customer may terminate the Agreement within ten (10) days upon written notice without penalty.

• Continued use: In all cases, the adoption of updated terms and the Customer's continued use of the Service is governed by the acceptance mechanisms set forth in Section 15.1 of the Agreement.

13.5 Notices. All notifications and written communications required or permitted under this DPA shall be addressed to the contact information provided by Customer in the license registration, or to such other address as Customer designates in writing. Notices from Customer to Company shall be sent to the contact details published on Company's website or as otherwise notified by Company in writing.

14. Definitions

In addition to terms defined in the Agreement, capitalized terms used but not otherwise defined shall have the meanings assigned to them in this agreement:

14.1 “Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a Party. “Control” means ownership or control of more than fifty percent (50%) of the voting interests or the power to direct management and policies.

14.2 “Applicable Privacy Laws” means the privacy and data protection laws that are directly and mandatorily applicable to Company’s provision of the Services, including: (a) Regulation (EU) 2016/679 (“GDPR”); and (b) the UK GDPR and Data Protection Act 2018, in each case as amended, including by the Data (Use and Access) Act 2025.

For the avoidance of doubt, Applicable Privacy Laws excludes the California Consumer Privacy Act, as amended (“CCPA”), and other United States state privacy laws, which are governed exclusively by Section 3.6 of this DPA.

14.3 “Controller” means a person or entity that determines the purposes and means of Processing Personal Data, and includes a “business” under the CCPA, where applicable.

14.4 “Data Subject” means an identified or identifiable natural person and includes a consumer or household where protected under Applicable Privacy Laws.

14.5 “EU SCCs” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914, as completed in accordance with Section 5.1. A successor form does not automatically replace the EU SCCs unless the Parties validly incorporate and complete that successor form.

14.6 “Personal Data” means any information that constitutes personal data, personal information, personally identifiable information or an equivalent term under Applicable Privacy Laws. “Customer Personal Data” means Personal Data contained in Customer Data.

14.7 “Process” or “Processing” has the meaning given under Applicable Privacy Laws and includes collecting, accessing, recording, organizing, storing, adapting, retrieving, consulting, using, disclosing, transmitting, combining, restricting, erasing and destroying data.

14.8 “Processor” means a person or entity that Processes Personal Data on behalf of a Controller and includes a service provider, contractor, processor or holder, as applicable under Applicable Privacy Laws.

14.9 “Restricted Transfer” means a transfer of Personal Data that requires an approved transfer mechanism under Applicable Privacy Laws.

14.10 “Security Incident” means an actual or reasonably suspected compromise of the confidentiality, integrity or availability of Customer Personal Data or of systems used to Process Customer Personal Data, including unauthorized access, acquisition, disclosure, alteration, loss or destruction. A confirmed breach of Customer Personal Data is a “Personal Data Breach”. 

14.11 “Customer Data” means all data, content and information provided or made available to Company by or for Customer, or collected, generated, inferred or accessed by Company on behalf of Customer, in connection with the Services. Customer Data does not include administrative records, billing details, invoices, or the text of commercial agreements between the Parties.

14.12 “Sub-processor” means a third party appointed by or for Company to Process Customer Personal Data.

14.13 "License Data" means the administrative, billing, and commercial information associated with the Customer's subscription, for which the Company acts as an independent Controller as described in the Company's Privacy Policy.

14.14 "Application Data" and "Support Data" refer to the categories of Personal Data Processing detailed in Annex I.

14.15 "User-Generated Content" means any unstructured text, attachments, images, or materials voluntarily entered, uploaded, or created by a User within the free-text fields or comments of the Service.

Annex I: Details of the processing

Annex II: Technical and Organizational Security Measures

1. Governance and Risk Management

1. Maintain a documented internal security and privacy program with accountable personnel, current guidelines, risk assessments and appropriate management oversight.

2. Assess risks before material changes and at least every calendar year, and track remediation of identified material risks.

3. Maintain an inventory of systems and assets used to Process Customer Data and classify Customer Data according to sensitivity.

2. Personnel and Access Control

1. Authorize access only on a documented need-to-know, least-privilege basis; review access upon material role changes and  at least annually; and revoke access promptly when no longer required.

2. Use unique user identities. Prohibit shared credentials except for technically necessary service accounts subject to compensating controls and accountable ownership.

3. Require multi-factor authentication for privileged access, remote administrative access and access to production systems containing Customer Data.

4. For Company personnel, require passwords or other authenticators consistent with current recognized standards. Do not rely on arbitrary periodic password changes absent compromise or risk; block commonly used or compromised passwords where natively supported by the underlying identity provider, and protect stored authentication secrets using strong salted cryptographic hashing.

5. Conduct identity verification before employment, and provide recurring privacy, confidentiality, phishing and secure-handling training.

3. Encryption and key management

1. Encrypt Customer Data in transit using current industry-standard protocols and encrypt Customer Data at rest where technically feasible and appropriate to risk; encryption at rest is mandatory for sensitive data, credentials, portable media and backups.

2. Manage cryptographic keys separately from encrypted data, restrict key access, rotate and revoke keys according to documented procedures, and protect secrets from source-code repositories and logs.

4. System, network and cloud security

1. Harden systems and cloud resources using documented internal security guidelines; segment production from development and testing; and prevent use of production Customer Data in non-production environments unless expressly approved.

2. Use standard network and system-level security controls (such as firewalls and access management). Apply security updates and patches according to risk-based timelines, with critical actively exploited vulnerabilities addressed without undue delay.

3. Maintain secure configuration and secrets-management controls for cloud services, APIs, service accounts and infrastructure-as-code.

4. Log  administrative activity, authentication,  material changes and security events, and protect logs from unauthorized modification.

5. Secure development and vulnerability management

1. Where Company develops software used for the Services, maintain standard internal development practices, including security requirements, code review, dependency management,  testing and  release processes.

2. Perform vulnerability scanning periodically. Conduct independent penetration testing periodically (typically on an annual basis) for internet-facing production services, unless a different frequency is approved in Annex I.

3. Remediate vulnerabilities according to documented severity-based service levels. Company must notify Customer of vulnerabilities only if they result in a confirmed Personal Data Breach requiring notification under Section 9.

6. Segregation, Data Minimization and DLP

1. Logically segregate Customer Data from data of other customers and prevent unauthorized cross-tenant access.

2. Collect and retain only Customer Personal Data necessary for the approved purposes.  Notwithstanding the foregoing, Company may retain Customer Personal Data captured in automated logs or routine backups in accordance with its standard data retention schedules, provided that data remains protected by the security controls herein.

3. Securely erase or render unrecoverable Customer Data on media before disposal, reuse or return (which may be achieved via cryptographic erasure of encrypted media, such as resetting a FileVault-encrypted device, or standard cloud-provider data sanitization).

7. Resilience, Backup and Recovery

1. Use commercially reasonable efforts to maintain business continuity and disaster recovery practices appropriate to the Services; and maintain and verify data recovery capabilities.

2. Protect backups through encryption, access control and separation appropriate to risk. 

8. Incident Response

1. Maintain incident-response practices, defined escalation paths and appropriate contact channels during Company’s standard business hours appropriate to the Services.

2. Use commercially reasonable efforts to preserve logs and evidence relevant to an incident, coordinate with Customer, and implement appropriate corrective actions.

3. In exceptional circumstances, such as critical incident response or Tier 3 support escalations, Company personnel may temporarily export the minimum-necessary log data or identifiers to encrypted, Company-managed workstations or secure internal collaboration tools (such as Google Workspace) where doing so is required to diagnose or resolve the incident. Any data exported under this measure is treated as highly confidential, used solely for the purpose of resolving the incident, and permanently purged from all endpoints and temporary storage immediately upon resolution.

9. Physical Security

Use facilities and hosting providers with physical access controls, visitor management, environmental protections, power resilience and secure media disposal appropriate to the service and risk.

10. Assurance and Sub-processors

1. Assess relevant Sub-processors before appointment and periodically thereafter,  evaluating their security and ability to meet applicable obligations appropriate to the risk and the Services.

2. Maintain independent assurance appropriate to the service and make relevant current evidence available under Section 8 of this DPA.

[End of Agreement]

History of changes:

• 2026-11-10 Added definitions of License Data, Support Data, Application Data and User-Generated Content, and fixed layout (orphaned clause) and spelling mistakes.

• 2026-11-06 First version