Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Verdocs Subscription Terms and Conditions or other written agreement governing Customer’s use of the Services (the “Agreement”) and applies to the extent Verdocs processes Customer Personal Data on behalf of Customer in connection with the Services.

This DPA automatically applies when Verdocs acts as a processor or subprocessor of Customer Personal Data. No separate signature or Order Form is required for this DPA to apply. If Customer and Verdocs have separately executed a data processing agreement, that executed agreement will supersede this DPA with respect to the processing covered by it.

Definitions

“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (“GDPR”), the United Kingdom GDPR, and applicable U.S. state privacy laws.

“Customer Personal Data” means Personal Data processed by Verdocs on behalf of Customer in connection with the Services.

“Free Services” means Services made available to Customer on an ongoing no-fee production basis, excluding Trial Services as defined in the Agreement.

“Negotiated Agreement” means a written order form or other agreement containing expressly negotiated terms and executed by authorized representatives of both Customer and Verdocs, including by electronic signature, but excluding standard online Subscription Terms accepted solely through a click-through or similar self-service process.

“Personal Data,” “Controller,” “Processor,” “Data Subject,” and “Processing” have the meanings given to them under Applicable Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.

“Subprocessor” means a third party engaged by Verdocs to process Customer Personal Data on behalf of Customer.

1. Roles. Customer is the Controller of Customer Personal Data or, where Customer processes Personal Data on behalf of another Controller, a Processor. Verdocs processes Customer Personal Data as a Processor on behalf of Customer and acts as a Subprocessor where Customer is itself a Processor. Each party will comply with its respective obligations under Applicable Data Protection Laws. Customer is responsible for ensuring that its instructions to Verdocs comply with Applicable Data Protection Laws and that it has all necessary rights, notices, consents, and other lawful bases required for Verdocs to process Customer Personal Data in accordance with the Agreement and this DPA. The subject matter, duration, nature and purpose of the Processing, categories of Data Subjects, and types of Personal Data are described in Annex 1.
2. Processing Instructions. Verdocs will process Customer Personal Data only on documented instructions from Customer, including with respect to transfers of Customer Personal Data to a third country or international organization, unless Verdocs is required to process such Personal Data by applicable law. Where Verdocs is required by applicable law to process Customer Personal Data other than on Customer’s documented instructions, Verdocs will inform Customer of that legal requirement before Processing unless applicable law prohibits such notice. The Agreement, this DPA, any applicable Order Form, Customer’s configuration and use of the Services, and other documented instructions submitted by Customer through the Services or to Verdocs constitute Customer’s documented instructions. Verdocs will promptly inform Customer if, in Verdocs’ reasonable opinion, an instruction infringes Applicable Data Protection Laws.
3. Confidentiality. Verdocs will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and are permitted to process Customer Personal Data only as necessary to provide, support, secure, and maintain the Services and otherwise comply with Customer’s documented instructions.
4. Security Measures. Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks to Data Subjects, Verdocs will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Such measures will include, as appropriate, the measures described in Annex 2 and will be designed to satisfy the requirements of Article 32 of the GDPR where applicable. Verdocs may update its technical and organizational measures from time to time, provided that such updates do not materially decrease the overall security of the Services.
5. Subprocessors. Customer provides general written authorization for Verdocs to engage Subprocessors to process Customer Personal Data in connection with the Services. Verdocs will maintain a current list of its Subprocessors and will provide the current list to Customer upon request. For Restricted Transfers subject to the EU SCCs, Verdocs will provide Customer with the then-current Subprocessor list upon commencement of the applicable Restricted Transfer. The Subprocessors identified on such list are authorized by Customer for purposes of this DPA. Verdocs will provide Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor that processes Customer Personal Data, thereby giving Customer a reasonable opportunity to object to the change on legitimate data protection grounds. If Customer reasonably objects to a new Subprocessor, the parties will work in good faith to identify a commercially reasonable alternative. If no commercially reasonable alternative is available, Customer may terminate the affected portion of the Services, and any fees, refunds, or other financial consequences of such termination will be determined in accordance with the Agreement. Verdocs will enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective than those imposed on Verdocs under this DPA to the extent applicable to the Subprocessor’s Processing. Verdocs remains responsible for the performance of its Subprocessors’ data protection obligations to the extent required by Applicable Data Protection Laws.
6. US State Privacy Obligations: To the extent Applicable Data Protection Laws include U.S. state privacy laws under which Verdocs acts as a processor, service provider, contractor, or similar regulated recipient of Customer Personal Data, Verdocs will not sell or share Customer Personal Data; retain, use, or disclose Customer Personal Data outside the business purposes specified in the Agreement and this DPA except as permitted by Applicable Data Protection Laws; or combine Customer Personal Data with Personal Data received from or on behalf of another person except as permitted by Applicable Data Protection Laws.

Verdocs will provide the same level of privacy protection required of processors, service providers, contractors, or similar regulated recipients under Applicable Data Protection Laws and will notify Customer if Verdocs determines that it can no longer meet its applicable obligations.

Customer may take reasonable and appropriate steps to help ensure that Verdocs uses Customer Personal Data in a manner consistent with Customer’s obligations under Applicable Data Protection Laws and, upon notice to Verdocs, may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

7. Breach Notification. Verdocs will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. To the extent reasonably available, Verdocs will provide Customer with information regarding the nature of the Personal Data Breach, including the categories and approximate number of affected Data Subjects and Personal Data records, the likely consequences of the Personal Data Breach, and the measures taken or proposed to address and mitigate its effects. Verdocs will reasonably cooperate with Customer in investigating, mitigating, and responding to the Personal Data Breach and in meeting Customer’s applicable breach-notification obligations. Verdocs’ notification of a Personal Data Breach will not be construed as an acknowledgment of fault or liability. If Customer determines that a Personal Data Breach must be notified to a supervisory authority, Data Subjects, the public, or other third parties, and such notification directly or indirectly identifies Verdocs, Customer will, where permitted by applicable law and without limiting Customer’s ability to meet any mandatory notification deadline, provide Verdocs with reasonable advance notice of the notification and consider in good faith any clarifications or corrections Verdocs reasonably requests concerning the description of Verdocs’ involvement in the Personal Data Breach.
8. Data Subject Requests. Taking into account the nature of the Processing, Verdocs will provide reasonable assistance through appropriate technical and organizational measures, insofar as reasonably possible, to assist Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Laws. If Verdocs receives a request directly from a Data Subject concerning Customer Personal Data processed on Customer’s behalf, Verdocs will direct the Data Subject to Customer and will not independently respond to the substance of the request unless required by applicable law.
9. Security, DPIAs, and Regulatory Assistance. Taking into account the nature of the Processing and the information available to Verdocs, Verdocs will provide reasonable assistance to Customer in meeting its applicable obligations relating to security of Processing, Personal Data Breach notifications, data protection impact assessments, and consultations with supervisory authorities, including obligations under Articles 32 through 36 of the GDPR.
10. Return/Deletion. Upon termination or expiration of the Services involving Processing of Customer Personal Data, Verdocs will, at Customer’s choice, return Customer Personal Data to Customer or delete such Customer Personal Data and existing copies, unless applicable law requires continued retention. Customer may exercise its right to return Customer Personal Data through the export functionality made available as part of the Services or through any applicable wind-down or transition period under the Agreement. Customer Personal Data retained in backup or archival systems will remain subject to the protections of this DPA and will be deleted in accordance with Verdocs’ ordinary backup-retention cycle, except where continued retention is required by applicable law.
11. Artificial Intelligence and Machine Learning. Verdocs will not use Customer Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether Verdocs’ own or a third party’s, except (a) to the extent reasonably necessary to provide the Services in accordance with Customer’s documented instructions, or (b) as expressly authorized by Customer in writing. Verdocs will contractually prohibit its Subprocessors, including any providers of artificial intelligence models or services, from using Customer Personal Data to train, fine-tune, develop, or improve their own models, except as expressly authorized by Customer in writing. If the Services involve automated decision-making that produces legal or similarly significant effects concerning Data Subjects, Verdocs will disclose the existence of such Processing to Customer, provide meaningful information about the logic involved to the extent reasonably available to Verdocs and without disclosure of trade secrets or confidential information, and reasonably cooperate with Customer as required by Applicable Data Protection Laws to enable Data Subjects to exercise their applicable rights.
12. Compliance Information & Audit. Verdocs will make available to Customer information reasonably necessary to demonstrate Verdocs’ compliance with its obligations under this DPA and Applicable Data Protection Laws, including, as applicable, then-current independent audit reports, certifications, security documentation, and written responses to reasonable compliance inquiries. Verdocs may satisfy routine requests for verification of its security and data protection controls by providing its then-current independent audit reports, certifications, security summaries, or other reasonably appropriate documentation, subject to confidentiality obligations. Additional audits shall be permitted only to the extent required by applicable data protection law or expressly agreed in writing by the parties. Any such audit shall be subject to reasonable advance notice, appropriate confidentiality and security safeguards, and restrictions designed to protect Verdocs’ systems and other customers’ information.
13. International Data Transfers. If a transfer of Customer Personal Data requires a transfer mechanism under Applicable Data Protection Laws, the transfer mechanisms specified in Annex 3 will apply. In the event of a conflict between the applicable Standard Contractual Clauses or UK Addendum and this DPA or the Agreement, the applicable Standard Contractual Clauses or UK Addendum will control to the extent of the conflict.
14. Liability.

14.1 Agreement Framework. Except to the extent prohibited by Applicable Data Protection Laws or mandatory international data-transfer terms, the exclusions of damages, liability limits, and allocation of risk in the Agreement apply to this DPA. Where a Negotiated Agreement contains an express limitation-of-liability provision governing data protection claims, including such a provision in an Order Form, that provision controls the calculation and application of liability under this DPA.

14.2 Default Paid-Customer Cap. Unless a Negotiated Agreement expressly establishes a different liability framework for data protection claims, each party’s aggregate liability for claims arising from breach of this DPA will not exceed three (3) times the Fee Base. For purposes of this Section, the “Fee Base” means all subscription, platform, license, envelope, and other usage-based fees paid or payable by Customer to Verdocs for the Services during the twelve (12) months preceding the event giving rise to the claim, excluding taxes and separately charged Third-Party Fees for optional third-party services, including identity verification, knowledge-based authentication, and messaging services. For purposes of this DPA, “Third-Party Fees” means separately charged fees for optional third-party services, regardless of the terminology used in the Agreement. This three-times-Fee-Base cap is an enhanced cap, not an additional or cumulative cap. If Customer has not entered into a Negotiated Agreement that expressly addresses such claims, including where Customer accepted the Verdocs Subscription Terms and Conditions online, this Section 14.2 sets the amount of the enhanced cap for claims arising from breach of this DPA, and any classification of those claims as enhanced claims in the Agreement (including under Section 15.5(f) of the Verdocs Subscription Terms and Conditions) continues to apply.

14.3 Aggregate Application. The general liability cap and enhanced liability cap are not cumulative. Amounts paid toward either cap count toward the enhanced cap, while claims subject to the lower general cap remain subject to that lower limit. Defense costs, settlements, and judgments paid under an indemnification obligation count toward the applicable cap. The caps apply collectively across the Agreement, this DPA, and related schedules and addenda, not separately for each of Customer’s end customers or for each Authorized User, claimant, claim, incident, or renewal. Related claims are treated as arising from the earliest event giving rise to them. If separate claims yield different Fee Bases, the highest applicable Fee Base determines the overall aggregate ceiling; Fee Bases are not added together. No party may recover twice for the same loss.

14.4 Uncapped Claims. Monetary caps do not apply to a party’s fraud or willful misconduct, Customer’s obligation to pay undisputed fees and charges properly due under the Agreement, or liability that applicable law prohibits the parties from limiting. Nothing in this Section alters any broader express uncapped-liability category in a Negotiated Agreement.

14.5 Free Services. For Customers using only Free Services, as defined in this DPA, the enhanced cap for DPA claims is ten thousand dollars ($10,000), unless the applicable Agreement expressly provides otherwise. This provision does not create a right to Free Services or override the Agreement’s definition or treatment of Trial Services.

14.6 Mandatory Rights and Negotiated Terms. Nothing in this Section limits rights of Data Subjects, powers of supervisory authorities, or obligations under mandatory Standard Contractual Clauses, the UK Addendum, or other mandatory transfer terms to the extent those rights, powers, or obligations cannot lawfully be limited. A Negotiated Agreement’s expressly negotiated allocation of liability takes precedence over this default DPA provision. Changes to that allocation require the method of amendment prescribed in the applicable Agreement.

15. Precedence. In the event of a conflict between this DPA and the Agreement concerning the Processing or protection of Customer Personal Data, this DPA will control solely with respect to those data protection obligations, except that (a) applicable mandatory Standard Contractual Clauses, the UK Addendum, or other mandatory international data-transfer terms will control to the extent required by law; (b) an express limitation-of-liability or risk-allocation provision in a Negotiated Agreement, including such a provision in an Order Form, will control the contractual allocation and calculation of liability, subject to mandatory law; and (c) any express provision of a Negotiated Agreement governing data export, retention, deletion, or transition assistance will control over this DPA to the extent the provision is more specific to the parties’ agreed services, provided that it does not diminish protections required by applicable data protection law or mandatory international data-transfer terms. Nothing in this Section displaces a shorter notification deadline for a Personal Data Breach or a security incident (as defined in the applicable Negotiated Agreement) expressly agreed in a Negotiated Agreement, to the extent applicable to the incident and consistent with mandatory law. A conflict concerning data protection obligations does not, by itself, displace the Agreement’s liability limits. In all other respects, the Agreement remains in effect. If Customer and Verdocs execute a separate data processing agreement, that executed agreement supersedes this online DPA with respect to the Processing covered by it. This DPA will remain in effect for so long as Verdocs Processes Customer Personal Data, notwithstanding the expiration or termination of the Agreement, including during any retention, backup, transition, or deletion period described in this DPA.
16. Updates. Verdocs may update this DPA from time to time to reflect changes in Applicable Data Protection Laws or the Services, provided that no update will materially decrease the overall protection of Customer Personal Data applicable to Customer’s then-current use of the Services. Verdocs will provide reasonable notice of material changes. No update to this DPA will amend an expressly negotiated liability cap or calculation, fees, data-use permissions, retention or deletion commitment, or support obligation in a signed Agreement, except through the amendment process required by that Agreement or to the extent required by applicable law.

Annex 1 – Details of Processing

Subject Matter

Provision of Verdocs’ eSignature, workflow, API, SDK, embedded, hosting, support, security, and related Services.

Duration

For the duration of Customer’s use of the Services and any applicable transition, retention, backup, or deletion period.

Nature and Purpose of Processing

Processing necessary to provide the Services, including hosting, storage, transmission, organization, retrieval, document and eSignature workflow processing, authentication, audit-trail creation, support, security, maintenance, and other activities performed on Customer’s documented instructions.

Categories of Data Subjects

May include:

• Customer’s personnel and Authorized Users;
• Customer’s customers and end users;
• document senders, recipients, signers, and counterparties; and
• other individuals whose Personal Data Customer or its Authorized Users submit to the Services.

Types of Personal Data

May include:

• names;
• email addresses;
• telephone numbers;
• IP addresses and device information;
• account and user identifiers;
• signature and signing information;
• timestamps and audit-trail information;
• authentication information;
• information contained in documents, forms, fields, and workflows submitted through the Services; and
• other Personal Data submitted by Customer or its Authorized Users.

Special Categories / Regulated Data

Customer will not submit Protected Health Information or electronic Protected Health Information unless the parties have entered into an applicable Business Associate Addendum.

Customer is responsible for determining whether other special-category or regulated Personal Data is appropriate for Processing through the Services and for providing any instructions or safeguards required by Applicable Data Protection Laws.

Annex 2 – Technical and Organizational Measures

Verdocs maintains technical and organizational safeguards appropriate to the nature of the Services and Customer Personal Data, which include, as applicable to the relevant Services:

• encryption of Customer Personal Data in transit and at rest using industry-standard encryption;
• logical access controls, role-based access, least privilege, unique user IDs, and multi-factor authentication for administrative access;
• logging and monitoring of administrative and security-relevant access;
• secure software development lifecycle controls, code review, vulnerability management, and patch management;
• backups, disaster recovery, and business continuity measures;
• incident response procedures and post-incident remediation;
• workforce confidentiality, security awareness training, access provisioning, and timely deprovisioning;
• tenant and logical data-segregation controls; and
• vendor and Subprocessor security management.

Verdocs may modify these measures as its Services and security practices evolve, provided that such modifications do not materially decrease the overall level of security provided for Customer Personal Data.

Annex 3 – International Transfer Terms

1. Applicability

This Annex 3 applies to any transfer of Customer Personal Data from the European Economic Area (“EEA”), United Kingdom, or Switzerland to Verdocs or a Subprocessor in a country that is not recognized under Applicable Data Protection Laws as providing an adequate level of protection for Personal Data (a “Restricted Transfer”).

The parties may rely on any lawful transfer mechanism available under Applicable Data Protection Laws, including an applicable adequacy decision. To the extent a Restricted Transfer requires Standard Contractual Clauses or another contractual transfer mechanism, the provisions below will apply.

By entering into the Agreement, the parties are deemed to have entered into and executed the applicable Standard Contractual Clauses and other transfer terms incorporated by this Annex 3. No separate signature is required unless required by Applicable Data Protection Laws.

In the event of a conflict between this Annex 3, the DPA, and the Agreement, the applicable mandatory transfer mechanism will control solely with respect to the Restricted Transfer.

2. European Economic Area

2.1 Incorporation of Standard Contractual Clauses

For Restricted Transfers subject to the GDPR, the Standard Contractual Clauses issued by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914, as amended, replaced, or superseded from time to time (the “EU SCCs”), are incorporated into this DPA by reference.

2.2 Applicable Module

The applicable module of the EU SCCs will be determined by the roles of the parties with respect to the relevant Processing:

• Module Two (Controller to Processor) applies where Customer is a Controller and Verdocs is a Processor; and
• Module Three (Processor to Processor) applies where Customer is a Processor and Verdocs is a Subprocessor.

Where Customer acts in different roles with respect to different categories of Customer Personal Data, the applicable module will apply separately to the relevant Processing.

2.3 SCC Elections

For purposes of the EU SCCs:

Clause 7 – Docking Clause. The optional docking clause will apply.

Clause 9 – Use of Subprocessors. Option 2, General Written Authorization, will apply. For Module Two, Customer provides general written authorization for Verdocs to engage Subprocessors in accordance with Section 5 of the DPA. For Module Three, Customer represents that the applicable Controller has provided the general authorization necessary for Verdocs to engage Subprocessors. Customer will provide Verdocs with the contact information or other reasonable means necessary for Verdocs to provide the applicable Controller with notices required by Clause 9(a). Verdocs will provide the applicable Controller and Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor.

Clause 11 – Redress. The optional language in Clause 11(a) will not apply.

Clause 17 – Governing Law. The EU SCCs will be governed by the laws of Ireland.

Clause 18 – Choice of Forum and Jurisdiction. The parties submit to the jurisdiction of the courts of Ireland for purposes of the EU SCCs.

Nothing in these elections limits any mandatory rights of Data Subjects or supervisory authorities under Applicable Data Protection Laws.

3. EU SCC Annex I – Parties and Description of Transfer

A. List of Parties

Data Exporter

Name: Customer identified in the Agreement or applicable Order Form.

Address: The address associated with Customer’s account, Agreement, or applicable Order Form.

Contact: The Customer contact identified in the Agreement, applicable Order Form, or Customer account.

Activities relevant to the transfer: Customer’s use of the Services and submission of Customer Personal Data to Verdocs for Processing in accordance with the Agreement and DPA.

Role: Controller for purposes of Module Two or Processor for purposes of Module Three, as applicable.

Data Importer

Name: Verdocs, Inc.

Address: 200 Vesey St. 24 Floor, New York, NY 10281

Contact: Head of Privacy

Email: hello@verdocs.com

Activities relevant to the transfer: Provision of the Services described in the Agreement and Processing of Customer Personal Data as described in this DPA.

Role: Processor for purposes of Module Two or Subprocessor for purposes of Module Three, as applicable.

The parties are deemed to have signed the EU SCCs as of the date Customer becomes bound by the Agreement.

B. Description of the Transfer

Categories of Data Subjects

The categories of Data Subjects are described in Annex 1 of the DPA.

Categories of Personal Data

The categories of Customer Personal Data are described in Annex 1 of the DPA.

Special Categories of Personal Data

Special-category or other regulated Personal Data may be processed only to the extent permitted under the Agreement and DPA and subject to any additional safeguards required by Applicable Data Protection Laws.

To the extent Special Categories of Personal Data are processed, applicable safeguards may include encryption, role-based and least-privilege access controls, logging and monitoring, data minimization, and the other measures described in Annex 2, as appropriate to the nature and risk of the Processing.

Protected Health Information and electronic Protected Health Information may not be submitted to the Services unless the parties have entered into an applicable Business Associate Addendum.

Frequency of Transfer

Transfers may occur on a continuous or recurring basis during Customer’s use of the Services.

Nature of Processing

The nature of Processing is described in Annex 1 of the DPA and may include collection, transmission, hosting, storage, organization, retrieval, access, eSignature and workflow Processing, authentication, audit-trail generation, support, security, maintenance, deletion, and other Processing necessary to provide the Services in accordance with Customer’s documented instructions.

Purpose of Processing

The purposes of Processing are described in Annex 1 of the DPA and include providing, securing, supporting, maintaining, and operating the Services in accordance with the Agreement and Customer’s documented instructions.

Duration of Processing

Processing will continue for the duration specified in Annex 1 of the DPA.

Subprocessor Transfers

Where Verdocs transfers Customer Personal Data to a Subprocessor, the subject matter, nature, and duration of the Subprocessor’s Processing will be limited to what is reasonably necessary for the Subprocessor to provide the relevant services to Verdocs in connection with the Services.

C. Competent Supervisory Authority

The competent supervisory authority will be determined in accordance with Clause 13 of the EU SCCs and Applicable Data Protection Laws based on the circumstances of the applicable Data Exporter and Restricted Transfer.

4. EU SCC Annex II – Technical and Organizational Measures

The technical and organizational measures applicable to Restricted Transfers are described in Annex 2 of the DPA, which is incorporated into the EU SCCs for purposes of Annex II.

Verdocs will maintain such measures in accordance with Section 4 of the DPA.

5. Subprocessor List for General Written Authorization

Because Clause 9(a), Option 2 (General Written Authorization) applies, Verdocs will maintain a current list of Subprocessors engaged to process Customer Personal Data under the general authorization granted by Customer. The current list will be provided to Customer upon request and constitutes the agreed list of Subprocessors for purposes of Clause 9(a), Option 2 of the EU SCCs. Verdocs will provide Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor in accordance with Section 5 of the DPA.

6. United Kingdom

Where a Restricted Transfer is subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office (the “UK Addendum”), as amended, replaced, or superseded from time to time, is incorporated into this DPA.

For purposes of the UK Addendum:

Table 1 – Parties

The parties, contact information, and roles are those identified in Section 3.A of this Annex 3.

Table 2 – Selected SCCs, Modules, and Clauses

The version of the EU SCCs, applicable module, and elections described in Sections 2.1 through 2.3 of this Annex 3 will apply.

Table 3 – Appendix Information

The information required for:

• Annex I.A of the EU SCCs is set forth in Section 3.A of this Annex 3;
• Annex I.B is set forth in Section 3.B and Annex 1 of the DPA;
• Annex I.C is determined as provided in Section 3.C;
• Annex II is set forth in Annex 2 of the DPA; and
• Annex III, Clause 9(a), Option 2 (General Written Authorization) applies. The current agreed list of Subprocessors is maintained by Verdocs and will be provided to Customer upon request in accordance with Section 5 of the DPA and Section 5 of this Annex 3.

Table 4 – Ending this Addendum when the Approved Addendum Changes: Importer and Exporter.

Either party may terminate the UK Addendum to the extent permitted under the applicable version of the UK Addendum if the Information Commissioner issues a revised approved addendum that materially changes the obligations of the parties and the parties are unable to agree upon commercially reasonable replacement terms.

The parties are deemed to have entered into the UK Addendum as of the date the applicable Restricted Transfer begins.

7. Switzerland

Where Customer Personal Data subject to the Swiss Federal Act on Data Protection (“Swiss FADP”) is transferred to a country that does not provide an adequate level of data protection, the EU SCCs will apply as modified by this Section.

For such transfers:

• references in the EU SCCs to the “GDPR” will include the Swiss FADP to the extent applicable to the relevant Processing;
• references to “personal data” will include personal data as defined under the Swiss FADP;
• references to an EU or EEA supervisory authority will include the Swiss Federal Data Protection and Information Commissioner where applicable;
• references to an EU Member State will be interpreted to include Switzerland to the extent necessary to give effect to the applicable rights and obligations under the Swiss FADP; and
• the EU SCCs will be interpreted so that Data Subjects located in Switzerland receive the protections required under the Swiss FADP.

To the extent the GDPR also applies to the relevant Processing, the GDPR-specific provisions of the EU SCCs will continue to apply without modification.

8. Alternative Transfer Mechanisms

Nothing in this Annex 3 prevents Verdocs or Customer from relying on another lawful transfer mechanism permitted under Applicable Data Protection Laws, including an applicable adequacy decision or other officially recognized transfer framework, where that mechanism validly applies to the relevant Restricted Transfer.

If a transfer mechanism relied upon by the parties becomes invalid, unavailable, or otherwise insufficient under Applicable Data Protection Laws, the parties will cooperate in good faith to implement an alternative lawful transfer mechanism.

Unless and until an alternative mechanism is implemented, the EU SCCs, UK Addendum, or other applicable contractual safeguards described in this Annex 3 will apply to the extent legally available.

9. Transfer Impact and Supplementary Measures

To the extent required by Applicable Data Protection Laws, Verdocs will provide Customer with information reasonably available to Verdocs and reasonably necessary for Customer to assess the circumstances of a Restricted Transfer and the safeguards applicable to Customer Personal Data.

Verdocs will implement supplementary technical, organizational, or contractual measures where reasonably necessary to provide a level of protection for Customer Personal Data consistent with Applicable Data Protection Laws.

Customer and Verdocs will reasonably cooperate with one another in connection with any legally required transfer impact assessment or similar evaluation relating to the Services.