Updated: October 11, 2022

This Data Processing Addendum (“DPA“) forms part of, and is subject to, the Terms of Service or other written or electronic terms of service or subscription agreement between RevMethods, Inc. and the legal entity defined as ‘Customer’ thereunder, and together with RevMethods, the “Parties” and each a “Party” (such agreement, the “Agreement“)). All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.

1. Definitions.

“Account” means Customer’s account in the Service in which Customer stores and processes Customer Data.

“California Consumer Privacy Act” or “CCPA“ means the California Consumer Privacy Act of 2018, as may be amended from time to time.

“Customer Data” has the meaning set forth in the Agreement.

“Customer Personal Data” means any Customer Data that is Personal Data.

“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.

“Data Processor” means an entity that Processes Personal Data on behalf of a Data Controller.

“Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement.

“Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.

“Personal Data” means any information, including opinions, relating to an identified or identifiable natural person and includes similarly defined terms in Data Protection Laws, including, but not limited to, the definition of “personal information” in the CCPA.

“Processing” shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination and “Process“, “Processes” and “Processed” will be interpreted accordingly.

“Purposes“ shall mean (i) RevMethods’ provision of the RevMethods Offerings as described in the Agreement, including Processing initiated by Users in their use of the RevMethods Offerings; and (ii) further documented, reasonable instructions from Customer agreed upon by the Parties.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.

“Service” has the meaning set forth in the Agreement.

“RevMethods’ Offering(s)” has the meaning set forth in the Agreement.

“Sub-Processor” means any other Data Processors engaged by a member of RevMethods to Process Customer Personal Data.

**2. Scope and Applicability of this DPA. **This DPA applies where and only to the extent that RevMethods Processes Customer Personal Data on behalf of Customer as Data Processor in the course of providing the RevMethods Offerings.

3. Roles and Scope of Processing.

3.1. Role of the Parties. As between RevMethods and Customer, RevMethods shall Process Customer Personal Data only as a Data Processor (or sub-processor) acting on behalf of Customer and, with respect to CCPA, as a “service provider” as defined therein, in each case regardless of whether Customer acts as a Data Controller or as a Data Processor on behalf of a third-party Data Controller (such third-party, the “Third-Party Controller“) with respect to Customer Personal Data. To the extent any Usage Data (as defined in the Agreement) is considered Personal Data under applicable Data Protection Laws, RevMethods is the Data Controller of such data and shall Process such data in accordance with the Agreement and applicable Data Protection Laws.

3.2. Customer Instructions. RevMethods will Process Customer Personal Data only for the Purposes. Customer shall ensure its Processing instructions are lawful and that the Processing of Customer Personal Data in accordance with such instructions will not violate applicable Data Protection Laws. The Parties agree that the Agreement (including this DPA) sets out the exclusive and final instructions to RevMethods for all Processing of Customer Personal Data, and (if applicable) include and are consistent with all instructions from Third-Party Controllers. Any additional requested instructions require the prior written agreement of RevMethods. RevMethods shall promptly notify Customer if, in RevMethods’ opinion, such an instruction violates any data privacy laws. Where applicable, Customer shall be responsible for any communications, notifications, assistance and/or authorizations that may be required in connection with a Third-Party Controller

3.3. Customer Processing of Personal Data.  Customer agrees that it: (i) will comply with its obligations under Data Protection Laws with respect to its Processing of Customer Personal Data; (ii) will make appropriate use of the Service to ensure a level of security appropriate to the particular content of the Customer Personal Data, such as pseudonymizing and backing-up Customer Personal Data; and (iii) has obtained all consents, permissions and rights necessary under Data Protection Laws for RevMethods to lawfully Process Customer Personal Data for the Purposes, including, without limitation, Customer’s sharing and/or receiving of Customer Personal Data with third-parties via the Service.

3.4. Details of Data Processing.

(a) Subject Matter: The subject matter of the Processing under this DPA is the Customer Personal Data.

(b) Frequency and duration: Notwithstanding expiry or termination of the Agreement, RevMethods will Process the Customer Personal Data continuously and until deletion of all Customer Personal Data as described in this DPA.

(c) Purpose: RevMethods will Process the Customer Personal Data for the Purposes, as described in this DPA.

(d) Nature of the Processing: RevMethods will perform Processing as needed for the Purposes, and to comply with Customer’s Processing instructions as provided in accordance with the Agreement and this DPA

(e) Retention Period. The period for which Customer Personal Data will be retained and the criteria used to determine that period shall be determined by Customer during the term of the Agreement via its use and configuration of the Service. Upon termination or expiration of the Agreement, Customer may retrieve or delete all Customer Personal Data as set forth in the Agreement. Any Customer Personal Data not deleted by Customer may be deleted by RevMethods promptly upon the later of (i) expiration or termination of the Agreement and (ii) expiration of any post-termination “retrieval period” set forth in the Agreement.

(f) Categories of Data Subjects: The categories of Data Subjects to which Customer Personal Data relate are determined and controlled by Customer in its sole discretion, and may include, but are not limited to:

(i) Prospects, customers, business partners and vendors of Customer (who are natural persons);

(ii) Employees or contact persons of Customer’s prospects, customers, business partners and vendors; and/or

(iii) Employees, agents, advisors, freelancers of Customer (who are natural persons).

(g) Categories of Personal Data: The types of Customer Personal Data are determined and controlled by Customer in its sole discretion, and may include, but are not limited to:

(i) Identification and contact data (name, address, title, contact details);

(ii) Financial information (credit card details, account details, payment information);

(iii) Employment details (employer, job title, geographic location, area of responsibility); and/or

(iv) IT information (IP addresses, cookies data, location data).

(h) Special Categories of Personal Data (if applicable): Subject to any applicable restrictions and/or conditions in the Agreement or Documentation, Customer may also include “special categories of personal data” or similarly sensitive Personal Data (as described or defined in Data Protection Laws) in Customer Personal Data, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to Customer Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data Processed for the purposes of uniquely identifying a natural person, data concerning health and/or data concerning a natural person’s sex life or sexual orientation.

4. Sub-Processing.

4.1. Authorized Sub-Processors. Customer provides RevMethods with a general authorization to engage Sub-processors as of the effective date of this DPA.

4.2. Sub-Processor Obligations. RevMethods shall: (i) enter into a written agreement with each Sub-processor imposing data protection obligations no less protective of Customer Personal Data as RevMethods’ obligations under this DPA to the extent applicable to the nature of the services provided by such Sub-processor; and (ii) remain liable for each Sub-processor’s compliance with the obligations under this DPA. Upon written request, and subject to any confidentiality restrictions, RevMethods shall provide Customer all relevant information it reasonably can in connection with its applicable Sub-processor agreements where required to satisfy Customer’s obligations under Data Protection Laws.

5. Security.

5.1. Security Measures. RevMethods shall implement and maintain appropriate technical and organizational security measures designed to protect Customer Personal Data from Security Incidents and to preserve the security and confidentiality of the Customer Personal Data.

5.2. Confidentiality of Processing.  RevMethods shall ensure that any person who is authorized by RevMethods to Process Customer Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

5.3. No Assessment of Customer Personal Data by RevMethods. RevMethods shall have no obligation to assess the contents or accuracy of Customer Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement. Customer is responsible for reviewing the information made available by RevMethods relating to data security and making an independent determination as to whether the Service meet Customer’s requirements and legal obligations under Data Protection Laws.

6. Security Incident Response.

**6.1. Security Incident Reporting. **If RevMethods becomes aware of a Security Incident, RevMethods shall notify Customer without undue delay, and in any case, where feasible, notify Customer within seventy-two (72) hours after becoming aware. RevMethods’ notification shall be sent to the email registered by Customer within the Service for such purposes, and where no such email is registered, Customer acknowledges that the means of notification shall be at RevMethods’ reasonable discretion and RevMethods’ ability to timely notify shall be negatively impacted.  RevMethods shall promptly take reasonable steps to contain, investigate, and mitigate any Security Incident.

6.2. Security Incident Communications. RevMethods shall provide Customer timely information about the Security Incident, including, but not limited to, the nature and consequences of the Security Incident, the measures taken and/or proposed by RevMethods to mitigate or contain the Security Incident, the status of RevMethods’ investigation, a contact point from which additional information may be obtained, and the categories and approximate number of data records concerned. Notwithstanding the foregoing, Customer acknowledges that because RevMethods personnel do not have visibility to the content of Customer Personal Data, it will be unlikely that RevMethods can provide information as to the particular nature of the Customer Personal Data, or where applicable, the identities, number or categories of affected Data Subjects. Communications by or on behalf of RevMethods with Customer in connection with a Security Incident shall not be construed as an acknowledgment by RevMethods of any fault or liability with respect to the Security Incident.

7. Cooperation.

7.1. Data Subject Requests. RevMethods shall promptly notify Customer if RevMethods receives a request from a Data Subject that identifies Customer Personal Data or otherwise identifies Customer, including where the Data Subject seeks to exercise any of its rights under applicable Data Protection Laws (collectively, “Data Subject Request”). The Service provides Customer with a number of controls that Customer may use to assist it in responding to Data Subject Requests and Customer will be responsible for responding to any such Data Subject Requests. To the extent Customer is unable to access the relevant Customer Personal Data within the Service using such controls or otherwise, RevMethods shall (upon Customer’s written request and taking into account the nature of the Processing) provide commercially reasonable cooperation to assist Customer in responding to Data Subject Requests.

**7.2. Data Protection Impact Assessments. **RevMethods shall provide reasonably requested information regarding the Service to enable Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required by Data Protection Laws, so long as Customer does not otherwise have access to the relevant information.

**7.3. Government, Law Enforcement, and/or Third-Party Inquiries. **If RevMethods receives a demand to retain, disclose, or otherwise Process Customer Personal Data for any third party, including, but not limited to law enforcement or a government authority (“Third-Party Demand”), then RevMethods shall attempt to redirect the Third-Party Demand to Customer. Customer agrees that RevMethods can provide information to such third-party as reasonably necessary to redirect the Third-Party Demand. If RevMethods cannot redirect the Third-Party Demand to Customer, then RevMethods shall, to the extent legally permitted to do so, provide Customer reasonable notice of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek a protective order or other appropriate remedy.

8. Relationship with the Agreement.

8.1. The Parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment, exhibit or standard contractual clauses that RevMethods and Customer may have previously entered into in connection with the Service. RevMethods may update this DPA from time to time; provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.

8.2. Except as provided by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict in connection with the Processing of Customer Personal Data. Notwithstanding the foregoing, and solely to the extent applicable to any Customer Personal Data comprised of patient, medical or other protected health information regulated by HIPAA or any similar U.S. federal or state health care laws, rules or regulations (“HIPAA Data”), if there is any conflict between this DPA and a business associate agreement between Customer and RevMethods (“BAA”), then the BAA shall prevail solely with respect to such HIPAA Data.

8.3. Notwithstanding anything to the contrary in the Agreement or this DPA, each Party’s liability, taken together in the aggregate, arising out of or relating to this DPA and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. Without limiting the Parties’ obligations under the Agreement, each Party agrees that any regulatory penalties incurred by one Party (the “Incurring Party”) in relation to the Customer Personal Data that arise as a result of, or in connection with, the other Party’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce the Incurring Party’s liability under the Agreement as if it were liability to the other Party under the Agreement.

8.4. In no event shall this DPA benefit or create any right or cause of action on behalf of a third party (including a Third-Party Controller), but without prejudice to the rights or remedies available to Data Subjects under Data Protection Laws or this DPA.

8.5. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement.