Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the FazDesk Terms of Use or other written agreement under which FazDesk Inc. (“FazDesk”) provides the Service to Customer (the “Agreement”). It applies to the extent FazDesk Processes Customer Personal Data on Customer’s behalf. Customer accepts this DPA when it accepts the Agreement; a signed copy is available on request at contact@fazdesk.com.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement (including “Affiliate,” “Customer Data,” “Device,” “End User,” “Order,” and “Service”).

“Account Data” means personal data about Customer’s administrators and users that FazDesk Processes as an independent controller to manage Customer’s account, billing, support, and the security of the Service, as described in the Privacy Notice.

“Applicable Data Protection Law” means all laws relating to privacy and data protection that apply to the Processing of Customer Personal Data under the Agreement, which may include U.S. state privacy laws such as the California Consumer Privacy Act, as amended (the “CCPA”); Regulation (EU) 2016/679 (the “EU GDPR”); the EU GDPR as incorporated into United Kingdom law and the UK Data Protection Act 2018 (together, the “UK GDPR”); and the Swiss Federal Act on Data Protection (the “FADP”), in each case only to the extent applicable.

“Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing” (and “Process”), and “Supervisory Authority” have the meanings given in Applicable Data Protection Law. “Controller” includes a “business,” and “Processor” includes a “service provider” or “processor,” as those terms are used in U.S. state privacy laws.

“Customer Personal Data” means Personal Data contained in Customer Data that FazDesk Processes on Customer’s behalf under the Agreement. It does not include Account Data.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data on systems operated by FazDesk, its Affiliates, or its Subprocessors. It is the same event as a “Security Incident” under the Terms of Use.

“Restricted Transfer” means a transfer of Customer Personal Data that is subject to the EU GDPR, the UK GDPR, or the FADP to a country that the competent authority has not recognized as providing an adequate level of protection.

“SCCs” means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

“Subprocessor” means any third party or FazDesk Affiliate that FazDesk engages to Process Customer Personal Data.

“Subprocessor List” means the list of Subprocessors that FazDesk provides to Customer on request at contact@fazdesk.com, together with the hosting provider and any Affiliate identified in Customer’s Order, as updated under Section 6.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0, as amended.

2. Scope and Roles

2.1 Roles. Customer is the Controller of Customer Personal Data and FazDesk is its Processor. If Customer Processes Customer Personal Data as a Processor on behalf of its own clients (for example, as a managed service provider), FazDesk is Customer’s sub-processor, and Customer warrants that its Controller has authorized Customer’s instructions, including the appointment of FazDesk.

2.2 Account Data. FazDesk Processes Account Data as an independent Controller under the Privacy Notice. This DPA does not apply to Account Data.

2.3 Details of Processing. The subject matter, duration, nature, and purpose of the Processing, and the types of Personal Data and categories of Data Subjects, are described in Annex 1.

2.4 Order of Precedence. If this DPA conflicts with the Agreement as to the Processing of Customer Personal Data, this DPA controls. If the SCCs or the UK Addendum apply and conflict with this DPA, the SCCs or the UK Addendum control.

3. Customer’s Instructions and Obligations

3.1 Instructions. The Agreement, this DPA, and Customer’s configuration and use of the Service are Customer’s complete documented instructions to FazDesk for the Processing of Customer Personal Data. Additional or different instructions require FazDesk’s written agreement.

3.2 Customer’s Responsibilities. Customer is responsible for (a) having a lawful basis for the Processing of Customer Personal Data and for its instructions; (b) providing all notices to, and obtaining all consents and authorizations from, End Users and other Data Subjects that Applicable Data Protection Law requires, including as described in Section 4 of the Terms of Use; (c) the accuracy and quality of Customer Personal Data; and (d) ensuring that its instructions comply with Applicable Data Protection Law.

3.3 Restricted Data. Customer will not use the Service to Process data that applicable law prohibits Customer from Processing in this way, and remains responsible for the obligations described in Section 5.7 of the Terms of Use.

4. FazDesk’s Obligations

4.1 Processing on Instructions. FazDesk will Process Customer Personal Data only on Customer’s documented instructions under Section 3.1, including with regard to transfers, unless required to do otherwise by applicable law. In that case FazDesk will inform Customer of the legal requirement before Processing, unless the law prohibits it.

4.2 Unlawful Instructions. FazDesk will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until Customer confirms or changes the instruction.

4.3 Confidentiality. FazDesk will ensure that persons authorized to Process Customer Personal Data are bound by appropriate obligations of confidentiality and have access only to the extent needed to provide, secure, and support the Service.

4.4 Security. FazDesk will implement and maintain the technical and organizational measures described in Annex 2. FazDesk may update those measures from time to time, provided the update does not materially reduce the overall protection of Customer Personal Data.

4.5 Data Subject Requests. Taking into account the nature of the Processing, FazDesk will assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights. The Console lets Customer access, export, and delete Customer Personal Data. If FazDesk receives a request directly from a Data Subject that relates to Customer Personal Data, FazDesk will direct the Data Subject to Customer and will not otherwise respond, unless required by law.

4.6 Other Assistance. Taking into account the nature of the Processing and the information available to it, FazDesk will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities that Applicable Data Protection Law requires of Customer in relation to the Service. FazDesk may charge reasonable fees for assistance that requires material effort beyond the standard functionality of the Service.

4.7 Requests from Public Authorities. If FazDesk receives a legally binding request from a public authority for access to Customer Personal Data, FazDesk will (a) notify Customer promptly, unless the law prohibits it; (b) try to redirect the authority to request the data directly from Customer; (c) review the legality of the request and challenge it where there are reasonable grounds to consider it unlawful; and (d) disclose only the minimum Customer Personal Data that the request lawfully requires.

5. U.S. State Privacy Laws

5.1 Service Provider. To the extent the CCPA or a similar U.S. state privacy law applies, FazDesk acts as Customer’s service provider or processor, and the business purpose for which FazDesk Processes Customer Personal Data is to provide, secure, and support the Service as described in the Agreement (the “Business Purpose”).

5.2 Restrictions. FazDesk will not (a) sell or share Customer Personal Data, as those terms are defined in the CCPA; (b) retain, use, or disclose Customer Personal Data for any purpose other than the Business Purpose or as otherwise permitted by the CCPA; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between FazDesk and Customer; or (d) combine Customer Personal Data with personal information that FazDesk receives from or on behalf of another person, or collects from its own interactions with Data Subjects, except as the CCPA permits.

5.3 Compliance. FazDesk will comply with its obligations under applicable U.S. state privacy laws, will provide the same level of privacy protection that those laws require of Customer, and will notify Customer if it determines that it can no longer meet those obligations. FazDesk understands and will comply with the restrictions in this Section 5.

5.4 Customer Rights. Customer may take reasonable and appropriate steps to ensure that FazDesk uses Customer Personal Data consistently with Customer’s obligations under those laws, including through Section 8, and, on notice, may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

6. Subprocessors

6.1 Authorization. Customer gives FazDesk general authorization to engage Subprocessors. The Subprocessors in use on the effective date of this DPA are those on the Subprocessor List.

6.2 Obligations. FazDesk will engage each Subprocessor under a written agreement that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides. FazDesk remains responsible for its Subprocessors’ performance of those obligations.

6.3 Notice of Changes. FazDesk will give at least thirty (30) days’ notice before a new Subprocessor begins Processing Customer Personal Data, by email to Customer’s account contact, together with the updated Subprocessor List.

6.4 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by notice to contact@fazdesk.com within thirty (30) days after FazDesk’s notice. The parties will discuss the objection in good faith. If they cannot resolve it within thirty (30) days after the objection, Customer may terminate the affected Subscription by written notice, and FazDesk will refund, or cause the Authorized Reseller or Affiliate that sold the Subscription to refund, any prepaid fees covering the period after termination.

6.5 Emergency Replacement. If FazDesk must replace a Subprocessor urgently for reasons of security or service continuity, it may do so without advance notice and will notify Customer as soon as practicable afterward; Section 6.4 then applies.

7. Personal Data Breach

7.1 Notification. FazDesk will notify Customer without undue delay, and in any event within seventy-two (72) hours after confirming a Personal Data Breach, by email to Customer’s account contact and to any security contact Customer has designated to FazDesk.

7.2 Content. The notice will describe, to the extent known: the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned; its likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for more information. Where FazDesk cannot provide all of this at once, it will provide the information in phases without undue delay.

7.3 Response. FazDesk will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach, and will provide the information reasonably required by Customer to meet its own notification obligations. As Controller, Customer is responsible for any notification to Supervisory Authorities and Data Subjects. FazDesk will not notify Customer’s Data Subjects or regulators about the Personal Data Breach on Customer’s behalf without Customer’s consent, unless required by law.

7.4 Exclusions. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data — such as pings, port scans, failed login attempts, or denial-of-service attacks — are not Personal Data Breaches. FazDesk’s notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

8. Information and Audits

8.1 Information. On written request, FazDesk will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including descriptions of its security measures, responses to reasonable security questionnaires, and any independent audit reports or certifications FazDesk holds at the time.

8.2 Audits. If the information under Section 8.1 is not sufficient to demonstrate compliance, or a Supervisory Authority requires it, Customer may audit FazDesk’s compliance with this DPA no more than once in any twelve (12) month period, except after a Personal Data Breach. Customer will give at least thirty (30) days’ written notice and agree the scope in advance. Audits will be conducted during normal business hours, by Customer or by an independent auditor bound by confidentiality obligations, without access to other customers’ data and without unreasonable disruption to FazDesk’s operations. Each party bears its own costs, except that Customer will reimburse FazDesk’s reasonable costs for any audit that requires more than two (2) business days of FazDesk personnel time.

9. Data Location and International Transfers

9.1 Hosting Location. FazDesk hosts Customer Personal Data in the hosting zone located in Customer’s own country, as identified in the Order.

9.2 Access from Other Countries. FazDesk, its Affiliates, and its Subprocessors may access and Process Customer Personal Data from other countries to the extent needed to provide, secure, and support the Service. Customer authorizes those transfers, subject to this Section 9.

9.3 EU Restricted Transfers. For Restricted Transfers subject to the EU GDPR, the SCCs are incorporated into this DPA and apply as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Customer is the “data exporter” and FazDesk is the “data importer”; (c) the optional docking clause in Clause 7 applies; (d) in Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 6.3; (e) the optional language in Clause 11 does not apply; (f) in Clause 13, the competent Supervisory Authority is the one determined in accordance with Clause 13(a); (g) in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; (h) in Clause 18(b), disputes are resolved before the courts of Ireland; and (i) Annexes I, II, and III of the SCCs are completed by Annex 1, Annex 2, and the Subprocessor List, respectively.

9.4 UK Restricted Transfers. For Restricted Transfers subject to the UK GDPR, the UK Addendum is incorporated into this DPA: Table 1 is completed with the parties’ details in Annex 1; Table 2 is completed with the selections in Section 9.3; Table 3 is completed by Annex 1, Annex 2, and the Subprocessor List; and in Table 4 either party may end the UK Addendum as set out in its Section 19.

9.5 Swiss Restricted Transfers. For Restricted Transfers subject to the FADP, the SCCs apply as set out in Section 9.3 with these changes: references to the EU GDPR are read as references to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; and “Member State” in Clause 18(c) includes Switzerland, so that Data Subjects in Switzerland may bring claims where they habitually reside.

9.6 Other Transfer Requirements. Where other Applicable Data Protection Law restricts a transfer of Customer Personal Data, the parties will cooperate in good faith to put in place any mechanism, assessment, or filing that the law requires. If FazDesk adopts an alternative lawful transfer mechanism recognized by Applicable Data Protection Law, that mechanism applies instead, to the extent it covers the transfer.

10. Return and Deletion

10.1 Export. For thirty (30) days after termination or expiration of the Agreement or the applicable Subscription, Customer may export Customer Personal Data as described in Section 8.5(d) of the Terms of Use.

10.2 Deletion. After that period, FazDesk will delete Customer Personal Data within ninety (90) days and will confirm the deletion in writing on Customer’s request. Copies in backups are deleted as backups expire in FazDesk’s ordinary backup cycle and remain subject to this DPA until then.

10.3 Legal Retention. FazDesk may retain Customer Personal Data to the extent and for as long as applicable law requires. It will keep any retained data confidential and Process it only for the purpose for which the law requires its retention.

11. Liability

Each party’s liability arising out of or related to this DPA, including the SCCs and the UK Addendum where they apply, is subject to the exclusions and limitations of liability in the Agreement, and counts toward the aggregate cap in the Agreement, except to the extent such limitations are not permitted by Applicable Data Protection Law or the SCCs (including as to the rights of Data Subjects under them).

12. General

12.1 Term. This DPA remains in effect for as long as FazDesk Processes Customer Personal Data.

12.2 Governing Law. This DPA is governed by the law that governs the Agreement, except where the SCCs or the UK Addendum require otherwise.

12.3 Changes. FazDesk may update this DPA in the manner described for the Terms of Use in Section 10.1 of the Terms of Use. An update will not materially reduce the protection of Customer Personal Data except where required by law.

Annex 1 — Details of Processing

A. Parties

Signature and date: by Customer’s acceptance of the Agreement, or as set out in a signed copy of this DPA.

B. Description of the Processing

C. Competent Supervisory Authority — as determined under Section 9.3(f), where the SCCs apply.

Annex 2 — Technical and Organizational Measures

1. Encryption in transit. Communications between the Agent, the Console, and FazDesk’s infrastructure are encrypted using TLS.
2. Access control — Console. Role-based permissions let Customer control which of its users can access which Devices and which remote access features.
3. Access control — FazDesk personnel. Access to Customer Personal Data is limited to personnel who need it to operate, secure, or support the Service, is granted by role, and is removed when no longer needed. Personnel are bound by confidentiality obligations.
4. Remote sessions. Remote desktop, terminal, and file-transfer sessions require an authenticated Console user with the appropriate permissions to start the session against an enrolled Device; there is no ambient or background remote access. Where available, Customer can enable on-screen session notifications, consent prompts, and a remote-desktop privacy screen. Remote session content is relayed and not stored.
5. Logging and monitoring. Authentication events, administrative actions, and remote session metadata are logged and used for security monitoring and investigation.
6. Hosting location and separation. Each Customer’s data is hosted in the hosting zone in Customer’s own country, and each Customer account’s data is logically separated from other accounts.
7. Vulnerability and change management. Security updates are applied to the Service infrastructure and the Agent; Agent updates are distributed through the Service.
8. Incident response. FazDesk maintains a process to detect, triage, contain, and investigate security events and to notify Customers under Section 7.
9. Subprocessor management. Subprocessors are engaged under written agreements as described in Section 6.

Annex 3 — Subprocessors

The Subprocessors authorized under Section 6.1 are those on the Subprocessor List, which FazDesk provides to Customer on request at contact@fazdesk.com.