[Last Updated July 20, 2023]
This Data Processing Agreement (“DPA”) forms part of, and is governed by the Master Service Agreement, Terms of Service, and any other agreement (“Agreement”) executed by and between Panaya Ltd. (“Panaya“), and a Customer (“Customer”). Panaya and Customer shall each be refer to as “party” and collectively as “parties”.
All capitalized terms not defined herein shall have the meaning set forth in the Agreement.
WHEREAS, Panaya provides subscription-based on-demand online services for testing and impact analysis of changes made to the Customer Systems, all as agreed by the parties in the applicable Subscription Order or other ordering documents that are referencing the Agreement (collectively the “Services”);
WHEREAS, the Services may require Panaya to Process Personal Data (as such terms are defined below) on Customer’s behalf, subject to the terms and conditions of this DPA; and
WHEREAS, the parties desire to supplement this DPA to achieve compliance with the UK, EU, Swiss, United States and other data protection laws and agree on the following:
1. DEFINITIONS
1.1. “Adequate Country” is a country that received an adequacy decision from the European Commission.
1.2. “CCPA” means the California Consumer Privacy Act ( Civ. Code §§ 1798.100 – 1798.199) of 2018, including as modified by the California Privacy Rights Act (“CPRA”) as well as all regulations promulgated thereunder from time to time.
1.3. “CPA” means the Colorado Privacy Act C.R.S.A. § 6-1-1301 et (SB 21-190), including any implementing regulations and amendments thereto.
1.4. “CTDPA” means the Connecticut Data Privacy Act, S.B. 6 (Connecticut 2022), including any implementing regulations and amendments thereto.
1.5. “Customer Data” means Customer Data (as defined in the Agreement) containing Personal Data (or the equivalent term) Processed by Panaya in the course of its Services provision to Customer, all as detailed in Annex I attached herein.
1.6. The terms “Business Purpose“, “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” (and “Process”), “Processor”, “Special Categories of Personal Data” and “Supervisory Authority”, shall all have the same meanings as ascribed to them in the EU Data Protection Law, the CPA, the VCDPA and the CTDPA. The terms “Business”, “Business Purpose”, “Consumer”, “Contractor”, “Service Provider”, “Sale”, “Sell” and“Share”, shall all have the same meaning as ascribed to them in the US Data Protection Laws. “Data Subject” shall also mean and refer to (under this DPA) a “Consumer”, as such term defined in the US Data Protection Laws, and “Personal Data” shall include “Personal Information” under this DPA.
1.7. “Data Protection Law” means any and all applicable privacy and data protection laws and regulations (including, where applicable, EU Data Protection Law, UK Data Protection Laws, Swiss Data Protection Laws, Israeli Law and the US Data Protection Laws) as may be amended or superseded from time to time.
1.8. “EEA” means the European Economic Area.
1.9. “EU Data Protection Law” means the (i) EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”); (ii) Regulation 2018/1725; (iii) the EU e-Privacy Directive (Directive 2002/58/EC), as amended (e-Privacy Law); (iv) any national data protection laws made under, pursuant to, replacing or succeeding (i) and (ii); (v) any legislation replacing or updating any of the foregoing; and (vi) any judicial or administrative interpretation of any of the above, including any binding guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant Supervisory Authority.
1.10. “Israeli Law” means Israeli Privacy Protection Law, 5741-1981, the regulations promulgated pursuant thereto, including the Israeli Privacy Protection Regulations (Data Security), 5777-2017 and other related privacy regulations.
1.11. “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. Any Personal Data Breach will comprise a Security Incident.
1.12. “Standard Contractual Clauses” or “SCC” mean the standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission Decision 2021/914 of 4 June 2021, which may be found here.
1.13. “Swiss Data Protection Laws” or “FADP” shall mean (i) Swiss Federal Data Protection Act (dated June 19, 1992, as of March 1, 2019) (“FDPA”); (ii) The Ordinance on the Federal Act on Data Protection (“FODP“); and (iii) any national data protection laws made under, pursuant to, replacing or succeeding and any legislation replacing or updating any of the foregoing.
1.14. “Swiss SCC” shall mean the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner.
1.15. “US Data Protection Laws” means any U.S. federal and state privacy laws effective as of the Effective Date of this DPA and applies to Panaya Processing of Customer Data, and any implementing regulations and amendment thereto, including without limitation, the CCPA, the CPA, the CTDPA, and the VCDPA.
1.16. ”UK Data Protection Laws” shall mean the Data Protection Act 2018 (DPA 2018), as amended, and EU General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as incorporated into UK law as the UK GDPR, as amended, and any other applicable UK data protection laws, or regulatory Codes of Conduct or other guidance that may be issued from time to time.
1.17. ”UK GDPR” shall mean the GDPR as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time).
1.18. “UK Standard Contractual Clauses” or “UK SCC” means the UK “International Data Transfer Addendum to The European Commission Standard Contractual Clauses” available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf as adopted, amended or updated by the UK Information Commissioner Office (“ICO”), Parliament or Secretary of State.
1.19. “VCDPA” means the Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. (SB 1392), including any implementing regulations and amendments thereto.
Any other terms that are not defined herein shall have the meaning provided under the Agreement or applicable Data Protection Laws. A reference to any term or section of the Data Protection Laws means the version as amended. Any references to the GDPR in this DPA shall mean the GDPR or UK GDPR depending on the applicable Law.
2. ROLES AND DETAILS OF PROCESSING
2.1. The parties agree and acknowledge that under the performance of their obligations set forth in the Agreement, with respect to the Processing of Customer Data, and according to the applicable Data Protection Laws, Panaya is acting as a Data Processor, or Service Provider and Customer is acting as a Data Controller or Business.
2.2. Each party shall be individually and separately responsible for complying with the obligations that apply to such party under applicable Data Protection Law.
2.3. The subject matter and duration of the Processing carried out by the Processor on behalf of the Controller, the nature and purpose of the Processing, the type of Personal Data and categories of Data Subjects are described in Annex Iattached hereto.
2.4. Additional US Data Protection Laws specifications are further detailed in Annex VII.
3. REPRESENTATIONS AND WARRANTIES
3.1. Panaya represents and warrants that it shall Process Customer Data, on behalf of the Customer, solely for the purpose of providing the Service, all in accordance with Customer’s written instructions under the Agreement and this DPA. Notwithstanding the above, in the event Panaya is required under applicable laws, including Data Protection Law or any union or member state regulation, to Process Customer Data other than as instructed by Customer, it shall make its best efforts to inform the Customer of such requirement prior to Processing such Customer Data, unless prohibited under applicable law.
3.2. Panaya shall provide reasonable cooperation and assistance to the Customer in ensuring compliance with its obligation to carry out data protection impact assessments.
3.3. Where applicable, Panaya shall assist the Customer in ensuring that Customer Data Processed is accurate and up to date, by informing the Customer without delay if it becomes aware of the fact that the Customer Data it is processing is inaccurate or has become outdated.
3.4. Panaya shall ensure: (i) the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process Customer Data; and (ii) that persons authorized to Process the Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.5. Notwithstanding the above, in any event that the Israeli Law applies, the parties hereby undertake that they comply with the aforesaid regulations as well as comply with the DPA.
4. DATA SUBJECTS RIGHTS AND REQUEST
4.1. It is agreed that where Panaya receives a request from a Data Subject or an applicable authority in respect of Customer Data, where applicable, Panaya will notify the Customer of such request promptly and direct the Data Subject or the applicable authority to the Customer in order to enable the Customer to respond directly to the Data Subject’s or the applicable authority’s request, unless otherwise required under applicable laws.
4.2. Parties shall provide each other with commercially reasonable cooperation and assistance in relation to the handling of a Data Subject’s or applicable authority’s request, to the extent permitted under Data Protection Law.
5. SUB-PROCESSING
5.1. The Customer acknowledges that Panaya may transfer Customer Data to and otherwise interact with third party data Processors (“Sub-Processor”). The Customer hereby authorizes Panaya to engage and appoint such Sub-Processors as listed in Annex III, to Process Customer Data, as well as permits each Sub-Processor to appoint a Sub-Processor on its behalf. Panaya may continue to use those Sub-Processors already engaged by it, as listed in Annex III, or to engage an additional or replace an existing Sub-Processors to Process Customer Data, subject to the provision of a thirty (30) days prior notice of its intention to do so to the Customer. In case the Customer has not objected to the adding or replacing of a Sub-Processor within such notice period, such Sub-Processor shall be deemed approved by the Customer. In the event the Customer objects to the adding or replacing of a Sub-Processor, within such notice period, Panaya may, under Panaya sole discretion, suggest the engagement of a different Sub-Processor for the same course of services, or otherwise terminate the Agreement.
5.2. Panaya shall, where it engages any Sub-Processor, impose, through a legally binding contract between Panaya and the Sub-Processor, data protection obligations that are no less onerous than, and provide at least the same level of protection as, those set out in this DPA. Panaya shall ensure that such contract will require the Sub-Processor to provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of Data Protection
5.3. Panaya shall remain responsible to the Customer for the performance of the Sub-Processor’s obligations in accordance with this DPA. Panaya shall notify the Customer of any failure by the Sub-Processor to fulfill its contractual obligations.
6. TECHNICAL AND ORGANIZATIONAL MEASURES
6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, and without prejudice to any other security standards agreed upon by the parties, Panaya hereby confirms that it has implemented and will maintain appropriate physical, technical and organizational measures to protect the Customer Data as required under Data Protection Laws to ensure lawful Processing of Customer Data and safeguard Customer Data from unauthorized, unlawful or accidental processing, access, disclosure, loss, alteration or destruction.
6.2. The parties acknowledge that security requirements are constantly changing and that effective security requires the frequent evaluation and regular improvement of outdated security measures.
6.3. The security measures implemented and maintained by Panaya are further detailed in Annex II.
7. SECURITY INCIDENT
7.1. Panaya will notify the Customer without undue delay upon becoming aware of any Security Incident involving the Customer Data. Panaya’ notification regarding or response to a Security Incident under this Section 7 shall not be construed as an acknowledgment by Panaya of any fault or liability with respect to the Security Incident.
7.2. Panaya will: (i) take necessary steps to remediate, minimize any effects of and investigate any Security Incident and to identify its cause; (ii) co-operate with the Customer and provide the Customer with such assistance and information as it may reasonably require in connection with the containment, investigation, remediation or mitigation of the Security Incident; (iii) notify the Customer in writing of any request, inspection, audit or investigation by a Supervisory Authority or other authority; (iv) keep the Customer informed of all material developments in connection with the Security Incident and execute a response plan to address the Security Incident; and (v) co-operate with the Customer and assist Customer with its obligation to notify the affected individuals in the case of a Security Incident.
8. AUDIT RIGHTS
8.1. Panaya shall maintain accurate written records of any and all the Processing activities of any Customer Data carried out under this DPA and shall make such records available to the Customer and applicable Supervisory Authorities upon written request. Such records provided shall be considered Panaya’ Confidential Information and shall be subject to confidentiality obligations.
8.2. Customer may audit Panaya compliance with this DPA and Data Protection Laws by requesting a certificate issued for security verification reflecting the outcome of an audit conducted by a third party auditor (e.g., SOC2 certificate) or a comparable certification or other security certification of an audit conducted by a third-party auditor, within twelve (12) months as of the date of Customer’s request.
8.3. Alternatively, in the event the records and documentation provided subject to Section 8.1 and 8.2 above are not sufficient for the purpose of demonstrating compliance, Panaya shall make
available, solely upon prior reasonable written notice and no more than once per calendar year, to a reputable auditor nominated by the Customer, information necessary to reasonably demonstrate compliance with this DPA, and shall allow for audits, including inspections, by such reputable auditor solely in relation to the Processing of the Customer Data (“Audit”) in accordance with the terms and conditions hereunder. The auditor shall be subject to standard confidentiality obligations (including towards third parties). Panaya may object to an auditor appointed by the Customer in the event Panaya reasonably believes the auditor is not suitably qualified or is a competitor of Panaya. Customer shall bear all expenses related to the Audit and shall (and ensure that each of its auditors shall) over the course of such Audit, avoid causing any damage, injury or disruption to Panaya’s premises, equipment, personnel and business while its personnel are on those premises in the course of such Audit.
8.4. Nothing in this DPA will require Panaya to either disclose to Customer or its third-party auditor, or to allow Customer or its third-party auditor to access: (i) any data of any other Panaya’s customer; (ii) Panaya’s internal accounting or financial information; (iii) any trade secret of a Panaya or its Affiliates; (iv) any information that, in Panaya’s reasonable opinion, could compromise the security of any Panaya’s systems or cause any breach of its obligations under applicable law or its security or privacy obligations to any third party; or (v) any information that Customer or its third-party auditor seeks to access for any reason other than the good faith fulfillment of Customer’s obligations under the Data Protection Laws.
9. CROSS BORDER PERSONAL DATA TRANSFERS
9.1. Where the GDPR, UK GDPR or the Swiss FADP is applicable, and the Processing of Customer Data by Panaya (or by a Sub-Processor) includes transfer of Customer Data (either directly or through an onward transfer) to a third country outside the EEA, the UK and Switzerland that is not an Adequate Country, such transfer shall only occur if an appropriate safeguard approved by the applicable Data Protection Law (the GDPR (Article 46), UK GDPR (Article 46) or Swiss FADP (as applicable)) for the lawful transfer of Customer Data under is in place.
9.2. When Customer and Panaya, or Panaya and or its Sub-Processor relies on the Standard Contractual Clauses to facilitate a transfer to a third country that is not an Adequate Country, then:
9.2.1. transfer of Customer Data from the EEA the terms set forth in Annex IV shall apply.
9.2.2. transfer of Customer Data from the UK, the terms set forth in Annex V shall apply; and
9.2.3. transfer of Customer Data from Switzerland, the terms set forth in Annex VI shall apply.
10. TERM, TERMINATION AND CONFLICT
10.1. This DPA shall be effective as of the Effective Date (as defined in the agreement) and shall remain in force until the Agreement terminates or as long as Panaya Processes Customer Data.
10.2. Panaya shall be entitled to terminate this DPA or cease the Processing of Customer Data in the event that Processing of Customer Data under the Customer’s instructions or this DPA infringe applicable legal requirements, provided Customer did not cure such infringement within ten (10) days from receiving applicable notice from Panaya. Alternately, Panaya may, in its sole discretion, suspend the Processing of the Customer Data until such infringement is cured without terminating the DPA.
10.3. Following the termination of this DPA, Panaya shall, at the choice of the Customer, delete all Customer Data Processed on behalf of the Customer and certify to the Customer that it has done so, or, return all Customer Data to the Customer and delete existing copies, unless applicable law or regulatory requirements requires that Panaya continue to store Customer Data. Until the Customer Data is deleted or returned, the parties shall continue to ensure compliance with this DPA. Customer’s choice shall be provided in writing to Panaya, following effect of termination.
10.4. In the event of a conflict between the terms and conditions of this DPA and the Agreement, this DPA shall prevail. For the avoidance of doubt, in the event Standard Contractual Clauses have been executed between the parties, the terms of the Standard Contractual Clauses shall prevail over those of this DPA. Except as set forth herein, all of the terms and conditions of the Agreement shall remain in full force and effect.
ANNEX I
DETAILS OF PROCESSING
This Annex I include certain details of the Processing of Personal Data as required under the Data Protection Laws.
Categories of Data Subjects:
The Customer Data uploaded to Panaya’s system (from Customer’s SAP, Salesforce, Oracle, etc.) such as employee, customers, contact information, etc.
Categories of Personal Data:
Any category of Customer Data uploaded to Panaya’s system (from Customer’s SAP, Salesforce, Oracle, etc.)
Special Categories of Personal Data:
None.
Nature of the processing:
Collection, storage, organization, communication, transfer, host and other types of Processing for the purpose of providing the Services as set out in the Agreement.
Purpose(s) of Processing:
To provide the Services.
Retention Period:
For as long as is it necessary to provide the Service by Panaya; provided there is no legal obligation to retain the Customer Data post termination or unless otherwise requested by the Customer.
Process Frequency:
Continuous basis
ANNEX II
TECHNICAL AND ORGANIZATIONAL MEASURES
The following description reviews the technical and organizational measures implemented by Panaya as a Processor of Customer Data, to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the Processing, and the risks for the rights and freedoms of natural persons.
As part of our data protection compliance process, Panaya has implemented technical, physical and administrative security measures to protect its Customer Data as explained below.
The security objectives of Panaya are identified and managed to maintain a high level of security and consists of the following (concerning all data assets and systems):
Panaya ensures the protection of the data servers store the Customer Data from unwanted physical access. Customer Data is stored on Amazon Web Services (AWS) virtual private cloud. Please see AWS’s security measures here. Customers can choose to be hosted in either the US production environment or in the European production environment. The US main data center is located in North Virginia on the East coast with a backup location in Oregon on the West coast. The main data center of the European production environment is located in Dublin, Ireland with a backup location in Frankfurt, Germany. Panaya also secures physical access to its offices by ensuring that only authorized individuals such as employees and authorized external parties (maintenance staff, visitors, etc.) can access Panaya’s offices by using security locks and an alarm system, amongst other measures as well.
Access to Panaya’s database is highly restricted in order to ensure that only the relevant personnel who have received prior approval can access the database. Panaya has also implemented appropriate safeguards related to remote access and wireless computing capabilities. Employees are assigned with private passwords that allow strict access or use to Personal Data, all in accordance with such employee’s position, and solely to the extent such access or use is required. There is constant monitoring of access to the Personal Data and the passwords used to gain access. Panaya is using automated tools to identify non-human login attempts and rate-limiting login attempts to minimize the risk of a brute force attack.
User authentication measures have been put in place in order to ensure that access to Customer Data is restricted solely to those employees who have been given permission to access it and to ensure that the Customer Data is not accessed, modified, copied, used, transferred or deleted without specific authorization for such actions to be done. Any access to Customer Data, as well as any action performed involving the use of Customer Data requires a password and user name, which is routinely changed, as well as blocked when applicable. Each employee is able to perform actions solely in accordance with the permissions granted to him by Panaya. Furthermore, Panaya conducts ongoing reviews of the employees who have been given authorization to access Customer Data, in order to assess whether such access is still required. Panaya revokes access to Customer Data immediately upon termination of employment. Authorized individuals can only access Customer Data that are located in their individual profiles.
Panaya has implemented a central read-only log repository which provides easy search and alerting capabilities. All actions in Panaya’s system are logged and log data is being reviewed on a regular basis. Panaya does not allow its customers to access logs. However, in case of a court order or official investigation, Panaya will provide the required information.
Panaya puts a lot of effort and invests a lot of resources into ensuring that Panaya’s security policies and practices are being complied with, including by continuously providing employees with training with respect to such security policies and practices. Panaya strives to raise awareness regarding the risks involved in the processing of Customer Data. In addition, Panaya has implemented applicable safeguards for its hardware and software, including by installing firewalls and anti-virus software on it applicable hardware and software, in order to protect against malicious software.
All transfers of Customer Data from Panaya to its Sub-Processors are protected by the use of encryption safeguards, including the encryption of the Customer Data prior to the transfer of any Customer Data.
Panaya ensures the transparency of input controls, including changing and the deletion of data.
Panaya maintains backup policies and associated measures. Such backup policies include permanent monitoring of operational parameters as relevant to the backup operations. Furthermore, Panaya’s servers include an automated backup procedure. Panaya also conducts regular controls of the condition and labelling of data storage devices for data security. Panaya ensures that regular checks are carried out to determine whether it is possible to undo the backup, as required and applicable. Notwithstanding the above, Panaya does not provide any back up services and it is Customer’s sole responsibility to back up Customer Data.
Panaya has ensured all documents, including without limitations, agreements, privacy policies, online terms, etc. are compliant with the Data Protection Law, including by implementing Data Processing Agreement and where needed Standard Contractual Clauses.
All of Panaya’s employees are required to execute an employment agreement which includes confidentiality provisions as well as applicable provisions binding them to comply with applicable data security practices. In the event of a breach of an employee’s obligation or noncompliance with Panaya’s policies, Panaya implements certain repercussions in order to ensure compliance with Panaya’s policies. In addition, prior to Panaya’s engagement with a Sub-Processor, Panaya undertakes diligence reviews of such Sub-Processor. Panaya ensures that it enters into data protection agreements with all of its customers and Sub-Processors.
External penetration test is performed on an annual basis. The penetration tests include, among others, procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own. The penetration tests and security scans are performed by a reputable third-party vendor. In addition, Panaya conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment. Actions are taken to remediate identified deficiencies on a timely basis. Vulnerability scans is performed using external tools, in order to detect potential security breaches
Panaya operations, policies and procedures are audited regularly to ensure Panaya meets all the Service Organization Control (SOC2) standards expected as a SaaS platform. Compliance certifications and attestations are assessed by a third-party, independent auditor and result in a certification, audit report, or attestation of compliance. Panaya’s systems and services were audited and verified by such SOC2 compliance certification.
Measures and assurances regarding U.S. government surveillance have been implemented by Panaya, and Panaya agrees and hereby represents it maintains the following additional safeguards:
ANNEX III
LIST OF SUB-PROCESSORS
| Name | Processing Region | Description of the processing | Transfer mechanism |
| Amazon Web Services (AWS), Inc. | EU/US | Hosting | SCC |
| Jira | US | Internal task management and correspondence | SCC |
ANNEX IV
EU INTERNATIONAL TRANSFERS AND SCC
b) In Clause 9, option 2 (general written authorization) shall apply and the method for appointing and time period for prior notice of Sub-Processor changes shall be as set forth in the Sub-Processer Section of the DPA.
c) In Clause 11, the optional language will not apply, and Data Subjects shall not be able to lodge a complaint with an independent dispute resolution body.
d) In Clause 17, option 1 shall apply. The parties agree that the Standard Contractual Clauses shall be governed by the laws of the EU Member State in which the Customer is established (where applicable).
e) In Clause 18(b) the parties choose the courts of the Republic of Ireland, as their choice of forum and jurisdiction.
4.a.2. “Data Importer”: Panaya
4.a.3. Roles: (A) With respect to Module Two: (i) Data Exporter is a Controller and (ii) the Data Importer is a
4.a.4. Data Exporter and Data Importer Contact details: As detailed in the Agreement.
4.a.5. Signature and Date: By entering into the Agreement and DPA, Data Exporter and Data Importer are deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
b) The frequency of the transfer and the retention period of the Personal Data is as described in Annex I (Details of Processing) of this DPA.
c) The Sub-Processors which Personal Data is transferred to are listed in Annex III.
ANNEX V
UK INTERNATIONAL TRANSFERS AND SCC
Annex 1A: List of Parties: shall be completed as set forth in Section 2 within Annex IV above.
Annex 1B: Description of Transfer: shall be completed as set forth in Annex I above.
Annex II: Technical and organizational measures including technical and organizational measures to ensure the security of the data: shall be completed as set forth in Annex II above.
Annex III: List of Sub Processors: shall be completed as set forth in Annex III above.
5.1.4. Table 4 ending this Addendum when the Approved Addendum Changes: shall be completed as “neither party”.
ANNEX VI
SUPPLEMENTARY TERMS FOR SWISS DATA PROTECTION LAW TRANSFERS ONLY
The following terms supplement the Clauses only if and to the extent the Clauses apply with respect to data transfers subject to Swiss Data Protection Law, and specifically the FDPA:
ANNEX VII
US DATA PROTECTION LAWS ADDENDUM
This US Privacy Law Addendum (“US Addendum”) adds specification applicable to US Data Protection Laws. All terms used but not defined in this US Data Protection Laws Addendum shall have the meaning set forth in the DPA.
1.3. If, and to the extent applicable, Panaya shall assist Customer in respect of a Consumer request to limit the use of its Sensitive Personal Information (“SPI”) by Panaya.
1.4. Panaya certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from Selling any Customer Data.
2.3. Panaya shall provide information necessary to enable Customer to conduct and document any data protection assessments required by US Data Protection Laws. Notwithstanding the above, Panaya is responsible for only the measures allocated to it.
2.4. Panaya shall provide assistance and procures that its subcontractors will provide assistance, as Customer may reasonably request, where and to the extent applicable, in connection with any obligation by Customer to respond to Consumer’s requests for exercising their rights under the US Data Protection Laws. Including without limitation, by taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s respective obligation. Panaya acknowledges and confirms that it does not receive any monetary goods, payments or discounts in exchange for Processing the Customer Data.
2.5. Each party shall, taking into account the context of Processing, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The parties are hereby establishing a clear allocation of the responsibilities between them to implement these measures. Panaya technical measures are detailed in the DPA and Annexes above.
2.6. The Processing instructions, including the nature of Processing, purpose of Processing, the duration of Processing, the type of Personal Data and categories of Data Subjects, are set forth in Annex I above.
2.7. In addition to the Audit rights under Section 8 of the DPA, under US Data Protection Laws and subject to Customer’s consent, Panaya my alternately, in response to Customer’s on premise audit request, initiate a third-party auditor to verify Panaya’s compliance with its obligations under this US Data Protection Laws. During such audit, Panaya will make available to the third-party auditor all information necessary to demonstrate such compliance.
2.8. Each party will comply with the requirements set forth under US Data Protection Laws with regards to processing of de-identified data; as such term is defined under the applicable US Data Protection Law.
