Envoy Data Protection Addendum

1. "Company Affiliate" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Company, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;

2. "Company Group Member" means Company or any Company Affiliate;

3. "Company Personal Data" means any Personal Data Processed by Vendor or the relevant Vendor Affiliate on behalf of a Company Group Member pursuant to or in connection with the Principal Agreement;

4. "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under this Addendum, in each case as amended from time to time, including the GDPR, the Data Protection Act 2018 of the United Kingdom and the Swiss Federal Act on Data Protection;

5. "EEA" means the European Economic Area;6. "EU Standard Contractual Clauses" means the clauses approved with Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, supplemented, updated or replaced form time to time;

7. “GDPR” means the General Data Protection Regulation 2016/679 together with any national implementing laws in any Member State of the EEA (“EU GDPR”) and the EU GDPR in such form as incorporated into the laws of the United Kingdom (“UK GDPR”);

8. "Services" means the services and other activities to be supplied to or carried out by or on behalf of Vendor for Company Group Members pursuant to the Principal Agreement;

9. "Subprocessor" means any person (including any third party and any Vendor Affiliate, but excluding an employee of Vendor, of any Vendor Affiliate or of any of their sub-contractors) appointed by or on behalf of Vendor or any Vendor Affiliate to Process Company Personal Data on behalf of any Company Group Member in connection with the Principal Agreement; and

10. "Vendor Affiliate" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Vendor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

3.2.1.instructs Vendor and each Vendor Affiliate (and authorizes Vendor and each Vendor Affiliate to instruct each Subprocessor) to:
‍

3.2.2.warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out in this Addendum on behalf of each relevant Company Affiliate and to receive any communications or notifications in relation to this Addendum on behalf of the relevant Company Affiliate. Except where Data Protection Laws require a Company Affiliate to exercise a right or seek any remedy under this Addendum against Vendor or Vendor Affiliate directly by itself, the parties agree that solely Company shall exercise any such right or seek any such remedy on behalf of the relevant Company Affiliate;

3.2.3.warrants and represents that it will comply with its obligations under the Data Protection Laws and that it has obtained any necessary consents and/or provided any necessary notices, and otherwise has a legitimate ground to disclose the Company Personal Data to Vendor and each Vendor Affiliate to enable Vendor and each Vendor Affiliate to Process Company Personal Data as contemplated by this Addendum and the Principal Agreement.

5.1.1. Company shall act and comply with the obligations, and shall have the rights, of the “data exporter” under Module Two of the EU Standard Contractual Clauses, and Vendor shall act and comply with the obligations as the “data importer” under such Module;

5.1.2.for the purpose of Clause 17, the EU Standard Contractual Clauses shall be governed by the laws of Ireland;

5.1.3.for the purpose of Clause 18(b), the parties agree to submit to the jurisdiction of the courts of Ireland;

5.1.4.in Clause 7, the optional docking clause will not apply;

5.1.5.in Clause 9, Option 2 will apply and the time period for prior notice of Subprocessor changes will be as set forth in Section 7.1 of this Addendum;

5.1.6.in Clause 11, the optional language will not apply;

5.1.7.or the purposes of Annex I, Section A (List of Partis), (i) the data exporter’s and the data importer’s identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in the Principal Agreement or as otherwise communicated by each party to the other party; (ii) Company or the relevant Company Affiliate is a Controller, and Vendor is a Processor; (iii) the activities relevant to the data transferred under the EU Standard Contractual Clauses relate to the provision of the Services pursuant to the Principal Agreement; and (iv) each of the Company’s and the Vendor’s entering into this Addendum shall be treated as, respectively, Company’s and Vendor’s signature of Annex I, Section A, as of the Effective Date of this Addendum;

5.1.8.For the purposes of Annex I, Section B (Description of Transfer): (i) Schedule 1 to this Addendum is incorporated by reference and sets out a description of the Processing of Company Personal Data; (ii) the frequency of the transfer is continuous (for as long as the Company uses the Services); (iii) Company Personal Data will be retained in accordance with Clause 8.5 of the EU Standard Contractual Clauses and this Addendum; (iv) Vendor uses Subprocessors to support the provision of the Services. A list of Subprocessors and the nature of the Processing activities can be found at: https://envoy.com/subprocessors/.

5.1.9.For the purposes of Annex I, Section C (Competent Supervisory Authority), the competent supervisory authority identified in accordance with Clause 13 of the EU Standard Contractual Clauses is the competent supervisory authority communicated by Company to Vendor.

5.1.10.For the purposes of Annex II, data importer has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Company Personal Data as described here https://envoy.com/security-details/#data-security or as otherwise made reasonably available by data importer to the data exporter. Please also refer to Vendor’s compliance certification page at https://envoy.com/compliance-legal/.

5.1.11.In respect of transfers of Company Personal Data originating from the United Kingdom and that is subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner (“UK Addendum”) will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows: (i) In Table 1 of the UK Addendum, the parties’ details and key contact information are located in Sections 5.1.7 of this Addendum; (ii) In Table 2 of the UK Addendum, information about the version of the EU Standard Contractual Clauses, modules and selected clauses which the UK Addendum is appended to is located in Section 5.1 of this Addendum; (iii) In Table 3 of the UK Addendum, the list of parties and the description of the transfer are located in Section 5.1 of this Addendum; Annex II (Technical and Organizational Security Measures) is located in Section 5.1.10 of this Addendum; and the list of sub-processors is located at: https://envoy.com/subprocessors/; and (iv) for the purposes of Table 4 of the UK Addendum, both the importer and the exporter may end the UK Addendum in accordance with its terms. Each of the Company’s and Vendor’s entering into this Addendum shall be treated as, respectively, Company’s and Vendor’s signature of the UK Addendum.

8.2.1.promptly notify Company if Vendor or the relevant Vendor Affiliate receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and

8.2.2.ensure that the Vendor or the relevant Vendor Affiliate does not respond to that request except on the documented instructions of Company, unless otherwise required by Data Protection Laws.

11.3.1.to any individual unless he or she produces reasonable evidence of identity and authority;

11.3.2.outside normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis and Company or the relevant Company Affiliate undertaking an audit has given notice to Vendor or the relevant Vendor Affiliate that this is the case before attendance outside those hours begins; or

11.3.3.for the purposes of more than one audit or inspection, in respect of Vendor or the relevant Vendor Affiliate, in any calendar year, except for any additional audits or inspections which:
‍