Tidewell Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Agreement between Tidewell LLC (“Company”) and Customer, and applies to the extent that Company processes Personal Information (as defined herein) that is part of Customer Data on behalf of Customer in performance of Services under the Agreement. For clarity, the purpose of this DPA is to set out the rights and obligations of the parties in respect of the Personal Information processed by Company in its capacity as a processor or service provider under the Agreement. Capitalized terms that are not defined in this DPA are defined in the Terms of Use.

1. Definitions:
   1. “controller,” “business,” “processor,” “service provider,” “data subject,” “consumer,” “process,” “sale,” “sell,” “business purpose,” and “supervisory authority” (or any equivalent terms) have the meaning set out under Data Protection Laws.
   2. “California Consumer Privacy Act” or “CCPA” means the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 et seq.), as amended by the California Privacy Rights Act of 2020, and its implementing regulations, each as amended or superseded from time to time.
   3. “European Data Protection Laws” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as amended or superseded from time to time (“EU GDPR”); the EU GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the UK European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (together, “UK Data Protection Laws”); and the Swiss Federal Data Protection Act of 19 June 1992 and its Ordinance (“Swiss DPA”).
   4. “Data Protection Laws” means applicable laws governing the privacy and security of Personal Information, including, where applicable, and without limitation, European Data Protection Laws and/or CCPA.
   5. “Permitted Purpose” means processing of Personal Information (i) as necessary for the provision of the Services as set forth in greater detail in Schedule 1; (ii) as otherwise permitted by Data Protection Laws in connection with the Services; and (iii) to comply with legal obligations which do not conflict with Data Protection Laws.
   6. “Personal Information” means any information that identifies relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household in connection with the Services performed for Customer, including without limitation any information that qualifies as “personal information” or “personal data” under the Data Protection Laws applicable to Company.
   7. “Restricted Transfer” means (i) where EU GDPR or the Swiss DPA applies, a transfer of Personal Information from the European Economic Area (“EEA”) including Switzerland to a country outside of the EEA, which is not the subject of an adequacy determination by the European Commission; and (ii) where UK GDPR applies, a transfer of Personal Information from the United Kingdom to any country which is not subject to adequacy regulations pursuant to Section 17A of the UK Data Protection Act.
   8. “Security Breach” means a breach of security leading to unauthorized disclosure, loss, or use of, or unauthorized access to, Personal Information in Company’s possession, custody, or control.
   9. “Sensitive Data” means information that falls within the definition of “special categories of data,” “sensitive data” or “sensitive personal information” under applicable Data Protection Laws.
   10. “Standard Contractual Clauses” means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission’s Implementation Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Information to third countries pursuant to the EU GDPR (“EU SCCs”); and (ii) where the UK Data Protection Laws apply, the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner’s Office under s.119A(1) of the Data Protection Act 2018 (the “UK Addendum”).
2. Scope of DPA
   1. For the avoidance of doubt, it is the intention of the parties that Company be a “service provider” or “processor” of Customer when required by applicable Data Protection Laws and that Customer be a “business” or “controller” when required by applicable Data Protection Laws.
   2. The parties acknowledge and agree that Company will not be required to process any Sensitive Data on behalf of Customer, and Customer will not make Sensitive Data available to Company for processing, unless explicitly agreed in advance in writing between the parties.
   3. If any Data Protection Law imposes additional or overriding obligations to those set forth in this DPA with respect to processing of Personal Information or requires Customer and Company to enter into any additional agreements, including data export instruments, or to implement any additional security or organizational security measures to process Personal Information under the DPA, Customer shall ensure that it complies with the applicable Data Protection Law in advance of disclosing any Personal Information subject to such Data Protection Laws and the parties agree to negotiate such additional obligations, agreements, or security measures in good faith.
3. Customer’s Obligations.
   1. Customer is responsible for obtaining any consents required by applicable Data Protection Laws, as well as providing and ensuring the accuracy of any notices required to disclose Personal Information to Company for use in accordance with the Agreement. Furthermore, Customer warrants that all Personal Information processed by Company in accordance with this DPA has been obtained and made available to Company in accordance with all applicable laws and ensured that there are lawful grounds for processing any and all Personal Information by Company for use in accordance with the Agreement.
   2. Customer is fully responsible for its compliance with the Data Protection Laws. If additional cooperation from Company is required to ensure such compliance, the parties will negotiate in good faith to address the terms of such cooperation, including reimbursement of Company costs for such additional services or support with respect thereto.
4. Company’s Obligations.
   1. Company shall only process Personal Information for the Permitted Purpose and in accordance with Customer’s instructions. Customer acknowledges that Company is reliant on Customer for instructions as to the extent to which Company is entitled to use and process Personal Information, and that Company is not liable for any claim brought by a data subject to the extent that such claim arises from Customer’s instructions. Where Data Protection Laws require Company to process Personal Information under terms other than those of the Agreement, Company shall promptly notify Customer of such legal requirement before processing, unless the Data Protection Laws prohibit such disclosure. Where required by Data Protection Laws, Company shall also notify Customer if Company determines any of Customer's instructions infringe applicable Data Protection Laws.
   2. Schedule 1 Section B hereto sets forth the subject matter, duration, nature, and purpose of processing and the categories of Personal Information and data subject types relevant to the processing to fulfil the Permitted Purpose. If and to the extent that the parties agree pursuant to Section 2(b) hereof that Company will process Sensitive Data on behalf of Customer, the parties will identify the additional categories of Personal Information and types of data subjects which will be the subject of the processing in the applicable written agreement and any additional restrictions or security measures that need to be applied to the Sensitive Data, if any.
5. Cooperation.
   1. Upon request, Company shall provide reasonable cooperation and any necessary assistance to Customer in (i) responding to any inquiries, complaints, or other communication regarding its processing of Personal Information from governmental agencies or law enforcement, (ii) any request from a data subject or consumer to exercise their rights under Data Protection Law (including access, correction, deletion, portability, as applicable) including by assisting with appropriate technical and organizational measures, and (iii) Customer’s obligations under applicable Data Protection Laws with regard to data protection impact assessments, transfer assessments, risk assessments, and other similar requirements where applicable, in each case in so far as possible and taking into account the nature of Company's processing and the Personal Information available to Company. Company shall be obliged to provide such assistance only in so far that the Customer cannot respond to such request on its own. Notwithstanding anything to the contrary in the Agreement, Customer will reimburse Company upon demand for its reasonable costs and expenses in connection with such cooperation. Such expenses will be invoiced to Customer in accordance with the Agreement.
   2. To the extent permitted by law, Company shall promptly notify Customer of any request, complaint, claim, or other communication received by Company from a third-party regarding its processing of Personal Information.
6. Security Breach. Company shall promptly notify Customer in the event Company becomes aware of a Security Breach and in no instance more than seventy-two (72) hours after becoming aware. Company will take reasonable steps to remediate the Security Breach and will provide updates regarding remediation efforts to Customer at reasonable intervals. Company shall reasonably cooperate in Company’s investigation of the Security Breach. To the extent that a Security Breach gives rise to a requirement under Data Protection Laws to provide (i) notification to public authorities, individuals, or other persons, or (ii) undertake other remedial measures (including, without limitation, notice, credit monitoring services and the establishment of a call center to respond to inquiries (each of the foregoing a “Remedial Action”)), at Customer’s request, Company shall, at Company’s cost, undertake such notices and Remedial Actions. The timing, content, and manner of effectuating any notices shall be determined by Company; however, Company will provide Customer a reasonable opportunity to advise upon notices and will consider Customer’s advice in good faith.
7. Restricted Transfers. If and to the extent that performance of any Services requires the transfer of Personal Information from Customer to Company which is a Restricted Transfer, the parties agree that the applicable terms attached as Schedule 3 to this DPA shall govern such Restricted Transfer.
8. Security.
   1. Company shall implement and maintain an information security program that establishes reasonable and appropriate technical, organizational, and physical safeguards designed to protect Personal Information in its control or possession, taking into account the nature of Company’s processing. A description of Company’s information security program is attached as Schedule 2 to this DPA. To the extent required by applicable Data Protection Laws, upon request, Company shall make available to Customer information reasonably necessary to demonstrate compliance with this obligation.
   2. The technical, organizational, and physical measures listed in Schedule 2 are subject to technological process and advancement. As such, Company may implement alternative, adequate measures, which meet or exceed the security level of the measures described in Schedule 2 and will notify Customer only if Company’s implementation of alternative security measures results in a material diminution of the security of Company’s overall information security program.
   3. Upon Customer’s written request no more than once per twelve (12) month period, Company shall provide customer-facing documentation on the current state of Company’s information security program and/or third-party certification or security assessment documentation. If after reviewing such information and documentation Customer determines, in its reasonable discretion, that an audit is necessary to investigate Company’s compliance its obligations under this DPA, Company will submit its facilities, networks and systems, and its data files and documentation related to the Processing of Personal Information to auditing by Customer to ascertain compliance with this DPA upon the request of Customer. The parties will mutually agree upon the scope, timing, and cost-reimbursement for such audit prior to its commencement. If such audit identifies, or Customer otherwise determines based on its reasonable belief, that Company has not or is not processing Personal Information in compliance with Data Protection Laws or this DPA, Customer may take actions that, in Customer’s reasonable discretion, are appropriate to stop and/or remediate Company’s noncompliant Processing of Personal Information including, but not limited to, exercising termination rights under the Agreement.
9. Subprocessors. The parties agree that Company may use subprocessors to perform or assist in the performance of the Services under the Agreement. Company shall remain responsible for subprocessors’ performance under the Agreement and shall enter into an agreement with subprocessors that impose materially the same obligations as set forth in this DPA. Company also agrees that any subprocessors who have access to Personal Information are bound to process Personal Information in accordance with Company's instructions and are subject to obligations to maintain confidentiality. Company maintains a list of subprocessors at https://www.gettechtape.com/tidewell/subprocessors and will update the list prior to using a new subprocessor. Notwithstanding any provision of the Agreement to the contrary, Company’s update to the list serves as notice of the subprocessor change. Customer may object to Company’s use of a subprocessor on reasonable data security and privacy grounds within ten (10) business days of Company first listing a subprocessor. The parties will confer in good faith to resolve Customer’s objection or develop a workaround plan. If after at least thirty (30) days of good faith negotiations, Customer’s objection has not been resolved or a work around plan developed, Company may choose to refrain from using such subprocessor to process Customer’s Personal Information or to allow Customer to terminate the Agreement.
10. Export or Deletion. Company shall retain, permit export of, and delete Personal Information hosted or stored on its systems in the provision of the Services in accordance with Section 6.6 of the Terms of Use, which applies to Personal Information as if fully set forth in this DPA. Deactivating a Property under the Agreement does not trigger Company's deletion obligations. Personal Information retained by Company remains subject to this DPA until it is deleted.
11. Additional Provisions
    1. Company agrees that it will not: (1) sell or share Personal Information as those terms are defined by Data Protection Laws; (2) combine Personal Information received from or on behalf of Customer with Personal Information received from other sources or the data subject unless otherwise permitted to do so under Data Protection Laws; or (3) process Personal Information for any purposes outside the direct business relationship with Customer or as permitted by Data Protection Laws. Company certifies that it understands the foregoing restrictions and will comply with them.
    2. Company further agrees to: (1) provide at least the same level of privacy protection with respect to the Personal Information as is required by applicable Data Protection Laws; (2) notify Customer in writing if it can no longer comply with Data Protection Laws with respect to its processing of Personal Information; and (3) permit Customer to cease the transfer of Personal Information to Company or limit any access by Company to Personal Information in order to mitigate and remediate any unauthorized use of Personal Information or otherwise take any reasonable steps to stop any unauthorized use of Personal Information, all upon reasonable notice to Company.
    3. Notwithstanding the foregoing, Company shall have the right to retain, use, or disclose de-identified or aggregated data derived from Personal Information (“Aggregated Data”), provided that (1) Aggregated Data shall not include any Personal Information; (2) Company adopts reasonable measures to prevent such Aggregated Data from being reasonably linked to or associated with a particular natural person or household; (3) Company publicly commits to maintain and use such Aggregated Data in a deidentified form and to not attempt to re-identify the Aggregated Data, except that Company may attempt to re-identify the data solely for the purpose of determining whether its deidentification processes are compliant with Data Protection Laws.

Schedule 1: Data Processing Description

1. List of parties

Data Controller/Exporter:

Data Processor/Importer:

2. Description of Processing/Transfer

Schedule 2: Data Security Statement

Where applicable to the Services provided and for its own infrastructure, Company implements reasonable and appropriate technical, organizational, and physical safeguards designed to protect against unauthorized processing (such as unauthorized access, collection, use, copying, modification, disposal or disclosure, unauthorized, unlawful, or accidental loss, destruction, acquisition, or damage) Customer Personal Information in Company custody or control.

1. Standards. Company’s data security policies, procedures, and practices are informed by various data security standards, such as the ISO/IEC 27001 Information Security Standard, the Statement on Standards for Attestation Engagements No. 18, and the NIST Cybersecurity Framework.
2. Security Policies. Company will implement, maintain, and monitor, at all times, a comprehensive, written information security program, aligned to industry standards and that contains appropriate administrative, technical, and physical safeguards designed to protect the security, confidentiality, or integrity of Personal Information in Company custody or control (“Information Security Program”). Such Information Security Program summary information shall be available for the Customer’s review, on the Customer’s request, in accordance with the DPA. Company reviews and, as necessary, revises its Information Security Program at least annually.
3. Access Controls. Company will maintain appropriate access controls designed to restrict physical and logical access to Personal Information in Company custody or control to only those necessary for the provision of Services. The controls include, but are not limited to:

• monitoring and logging physical and logical access to Company systems that contain Personal Information;
• reviewing successful and failed access attempts for systems that contain Personal Information to identify potentially malicious activity;
• ensuring personnel accessing systems that store Personal Information use unique individual access credentials that meet industry standards for password strength; and
• maintaining a program for the periodic review of access and removal of access to for those personnel that no longer require access.

4. Secure Infrastructure. Company maintains a secure infrastructure program that meets industry standards for:

• segmentation, ensuring Personal Information is logically separated from Company data and that of other Company customers;
• firewall and network architecture, including considerations for internal and external communications;
• intrusion detection and prevention;
• encryption for data at rest and in motion;
• device hardening and standard configuration, including the removal of system defaults and unused ports and services;
• malware detection and prevention designed to protect Company systems, including those that store Personal Information or connect to customer environments; and
• security event and incident monitoring, including alerting, response, remediation, and log protection and retention procedures.

5. Threat Monitoring. Company implements industry standard controls to detect or prevent unauthorized devices from connecting to the network that provides Services. Additionally, Company implements controls for:

• vulnerability awareness, including industry awareness and regular vulnerability scans and penetration testing;
• vulnerability management, including patch management; and
• security incident response plans for the identification, escalation, mitigation, and resolution of suspected security incidents.

6. Training. Company requires its employees to attend and complete periodic information security education and awareness training.

Schedule 3: Applicable Standard Contractual Clauses and Supplemental Terms

1. Incorporation of EU Standard Contractual Clauses

The parties agree that the EU SCCs are hereby incorporated by reference into this DPA in accordance with the terms below.

Module 2: Controller to processor module applies when Customer is the EEA-based data exporter and Controller and Company is the data importer and Processor.

2. EU Standard Contractual Clause Optional Provisions

Where the EU SCCs identify optional provisions (or provisions with multiple options) the following shall apply in the following manner:

1. Clause 7 (Docking Clause) shall apply;
2. In Clause 9(a) (Use of sub-processors) – Option 2 shall apply with the time period for notice and objection as indicated in the DPA.
3. In Clause 11(a) (Redress) – the optional provision shall not apply;
4. For purposes of Clause 13(a), the relevant provision shall apply based on the establishment of the Data Exporter with the Irish Data Protection Commission selected as supervisory authority if no other supervisory authority is competent pursuant to the terms of Clause 13(a);
5. In Clause 17 (Governing Law) – Option 1 shall apply with Ireland selected; and
6. In Clause 18 (Choice of forum and jurisdiction) - the courts of Ireland shall have jurisdiction.
7. Annex I to the SCCs shall be completed with the details set forth in Schedule 1 to the DPA.
8. Annex II to the SCCs shall be completed with the details set forth in Schedule 2 to the DPA (Data Security Statement).
9. Annex III to the SCCs shall be completed with the details set forth in the Company’s subprocessor list as specified in the DPA.

3. Supplementary Terms to Standard Contractual Clauses
   1. Documentation and compliance. For the purposes of Clause 8.9(b) the review and audit provisions in the Agreement and DPA shall apply.
   2. Liability. For the purposes of Clause 12(a), the liability of the parties shall be limited in accordance with the limitation of liability provisions in the Agreement.
   3. Signatories. Notwithstanding the fact that the SCCs are incorporated herein by reference without being signed directly, Company and Customer each agrees that their execution of the Agreement is deemed to constitute its execution of the SCCs as of the date thereof, and that it is duly authorized to do so on behalf of, and to contractually bind, the Data Exporter or Data Importer (as applicable) accordingly.
4. Swiss Law Provisions

With respect to Personal Information transferred from Switzerland governed by Swiss law:

1. references to the EU, member states and GDPR in the SCCs are amended to refer to Switzerland, the Swiss DPA (as it may be updated or replaced from time to time), and the Swiss Federal Data Protection and Information Commissioner; and
2. In Clause 17 (Governing Law) the laws of Switzerland shall govern, and in Clause 18 (Choice of forum and jurisdiction) the courts of Switzerland shall have jurisdiction.

5. UK Addendum

With respect to Personal Information transferred from the United Kingdom governed by UK Data Protection Laws:

1. The information required by Tables 1 – 3 of the template International Data Transfer Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it may be revised from time to time (the “Template UK Addendum”) is provided in the Agreement, DPA, and Order Form.
2. References to the EU, member states and GDPR in the Standard Contractual Clauses are amended to refer to the United Kingdom, the UK Data Protection Act 2018 (as it may be updated or replaced from time to time), and the UK Information Commissioner’s Office (the “ICO”).
3. In Clause 17 (Governing Law), the laws of England and Wales shall govern, and in Clause 18 (Choice of forum and jurisdiction), the courts in London, England shall have jurisdiction. A data subject may also bring legal proceedings against the data exporter and/or data importer before appropriate courts in England and Wales.
4. If there is any inconsistency or conflict between UK Data Protection Laws (including the Template UK Addendum) and the SCCs including this UK Addendum, UK Data Protection Laws including the Template UK Addendum will govern data transfers from the United Kingdom. To the extent required by UK Data Protection Laws the Template UK Addendum is incorporated herein.
5. If the meaning of any provision of the SCCs including this section is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
6. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
7. Although Clause 5 of the SCCs says that the SCCs prevail over all related agreements between the parties, the parties agree that this UK Addendum will supersede other provisions of the SCCs regarding data transfers from the United Kingdom.