Data Processing Addendum

Effective Date: August 30, 2018

1. Background

0.1 In accordance with section 4 of the Terms of Service or as the case may be on the basis of a superseding written Enterprise Services Agreement (each individually referred to as the “Agreement”), this Data Processing Addendum ("DPA") sets out the basis on which Airy processes Customer Personal Data (as defined below).

1.2 In the event of a conflict between any of the provisions of this DPA and the remaining provisions of the Agreement, the provisions of this DPA shall prevail.

2. Definitions

2.1 Unless otherwise set out below, each capitalised term in this DPA shall have the meaning set out in the Agreement and the following capitalised terms used in this DPA shall be defined as follows:

(a) "Customer Personal Data" means the personal data described in ANNEX 1 and any other personal data that Airy processes on behalf of the Customer in connection with Airy's provision of the Service;

(b) "Data Protection Laws" means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council ("GDPR") and all applicable legislation protecting the fundamental rights and freedoms of persons and their right to privacy with regard to the Processing of Customer Personal Data;

(c) "European Economic Area" or "EEA" means the Member States of the European Union together with Iceland, Norway, and Liechtenstein;

(d) "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Customer Personal Data;

(e) "Standard Contractual Clauses" means the Standard Contractual Clauses (processors) approved by European Commission Decision C(2010)593 or any subsequent version thereof released by the European Commission (which will automatically apply);

(f) "Subprocessor" means any Processor engaged by Airy who agrees to receive from Airy Customer Personal Data; and

(g) the terms "personal data", "Controller", "

Processor", "Data Subject", "Process" and "

Supervisory Authority" shall have the same meaning as set out in the GDPR.

3. Data Processing

3.1 Instructions for Data Processing. Airy will only Process Customer Personal Data in accordance with (a) the Agreement, to the extent necessary to provide the Service to the Customer, and (b) the Customer's written instructions, unless Processing is required by European Union or Member State law to which Airy is subject, in which case Airy shall, to the extent permitted by applicable law, inform the Customer of that legal requirement before Processing that Customer Personal Data.

3.2 Processing outside the scope of this Agreement will require prior written agreement between the Customer and Airy on additional instructions for Processing.

3.3 Required consents. Where required by applicable Data Protection Laws, the Customer will ensure that it has obtained/will obtain all necessary consents for the Processing of Customer Personal Data by Airy in accordance with the Agreement.

4. Subprocessors

4.1 Consent to Subprocessor Engagement. The Customer generally authorises the engagement of third parties as Subprocessors.

4.2 Information about Subprocessors. A list of Airy's Subprocessors is available at Subprocessors (the “Subprocessors List”) as may be updated by Airy from time to time in accordance with this DPA. Customer may receive notifications of new Sub-processors by e-mailing dpa@airy.co with the subject “Subscribe”, and if a Customer contact subscribes, Airy shall provide the subscriber with notification of new Subprocessors before authorizing such new Subprocessor to process Customer Personal Data in connection with the provision of the applicable Services.

4.3 Requirements for Subprocessor Engagement. When engaging any Subprocessor, Airy will:

• (a) ensure via a written agreement that:
  • (i) the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it and does so in accordance with the Agreement and this DPA; and
  • (ii) the same obligations are imposed on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on Airy under this DPA , to the extent applicable to the nature of the Services provided by such Sub-processor.
• (b) remain full liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.

4.4 Opportunity to Object to new Subprocessors. Customer may reasonably object to the appointment of a new Subprocessor by notifying Airy promptly in writing within ten (10) business days after receipt of Airy’s notice in accordance with the mechanism set out in Section 4.2. Such notice shall require to provide documentary evidence that reasonably shows that the Subprocessor does not or cannot comply with the requirements in this DPA ("Objection"). If Airy does not remedy or provide a reasonable workaround for your Objection within a reasonable time, Customer may object to any new Subprocessor by terminating the Agreement immediately upon written notice to Airy, on condition that Customer provides such notice within 90 days of being informed of the engagement of the relevant Subprocessor in accordance with the mechanism set out in Section 4.2. This termination right is Customer’s sole and exclusive remedy if Customer objects to any new Subprocessor.

4.5 Transfers of Personal Data Outside the EEA. To the extent that the Processing of Customer Personal Data by Airy involves the export of such Personal Data to a country or territory outside the EEA, such transfer shall be to a third party:

• (a) in a country subject to an adequacy decision by the European Commission;
• (b) that is a member of a compliance scheme recognized by the European Commission as offering adequate protection for the rights and freedoms of data subjects such as the EU-U.S. Privacy Shield; or
• (c) that has signed Standard Contractual Clauses (processors) approved by European Commission Decision C(2010)593 or any subsequent version thereof released by the European Commission, (with the Customer as data exporter and the third party as data importer). For this purpose, the Customer appoints Airy to act as its agent with the authority to complete and enter into the Standard Contractual Clauses as agent for the Customer on its behalf for this purpose.

5. Data Security, Audits and Security Notfications

5.1 Airy Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Airy shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk including, where applicable by virtue of Article 28(3)(c) of the GDPR, and as appropriate, the measures referred to in Article 32(1) of the GDPR. Without limiting the generality of the foregoing, Airy shall put in place and maintain the technical and organisational measures set out in ANNEX 2.

5.2 Security Audits. The Customer may, upon reasonable notice, audit (by itself or using independent third party auditors) Airy's compliance with the security measures set out in this DPA (including the technical and organisational measures as set out in ANNEX 2), including by conducting audits of Airy's (and Suprocessors') data processing facilities. Upon request by the Customer, Airy shall make available all information reasonably necessary to demonstrate compliance with this DPA.

5.3 Security Incident Notification. If Airy or any Subprocessor becomes aware of a Security Incident, Airy will (a) notify the Customer of the Security Incident within 72 hours, (b) investigate the Security Incident and provide such reasonable assistance to the Customer (and any law enforcement or regulatory official) as required to investigate the Security Incident, and (c) take steps to remedy any non-compliance with this DPA.

5.4 Airy Employees and Personnel. Airy shall treat the Customer Personal Data as the Confidential Information of the Customer, and shall ensure that:

• (a) access to Customer Personal Data is limited to those employees or other personnel who have a business need to have access to such Customer Personal Data;
• (b) any employees or other personnel have agreed in writing to protect the confidentiality and security of Customer Personal Data.