Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Services Agreement between Sedra and Customer (the “Agreement”) and applies only to the extent Sedra processes Personal Data on Customer’s behalf and applicable Data Protection Law requires a data processing agreement. Capitalized terms not defined in this DPA have the meanings given in the Services Agreement. If there is a conflict between this DPA and the Agreement, this DPA controls with respect to its subject matter.

1. Definitions

For purposes of this DPA:

“Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process” or “Processing,” “Subprocessor,” and similar terms have the meanings given under applicable Data Protection Law.

“Customer” means the customer party to the Agreement.

“Data Protection Law” means any applicable law or regulation relating to privacy, security, or the Processing of Personal Data, including, where applicable, the GDPR, UK GDPR, Swiss data protection law, and other applicable laws governing Processing under the Agreement.

“GDPR” means Regulation (EU) 2016/679.

“Sedra” means the Sedra contracting entity under the Agreement.

“Standard Contractual Clauses” or “SCCs” means the European Commission standard contractual clauses for the transfer of personal data to processors established in third countries, as amended or replaced from time to time.

“UK Addendum” means the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as amended or replaced from time to time.

2. Roles of the Parties

2.1 Roles. As between the parties, Customer is the Controller or Processor of Personal Data, as applicable, and Sedra is a Processor or subprocessor, as applicable, with respect to Personal Data Processed by Sedra on Customer’s behalf under the Agreement.

2.2 Customer Instructions. Customer instructs Sedra to Process Personal Data as necessary to provide, secure, support, and improve the Services in accordance with the Agreement, applicable Order Forms, Documentation, and Customer’s use of the Services, and as otherwise permitted by this DPA.

2.3 Customer Responsibility. Customer is solely responsible for: (a) the lawfulness of Personal Data Processing under the Agreement; (b) providing all notices and obtaining all consents, permissions, and other rights required under applicable Data Protection Law; (c) the accuracy, quality, and legality of Personal Data; and (d) ensuring that its instructions to Sedra comply with applicable law.

2.4 Sedra Compliance with Instructions. Sedra will Process Personal Data only on Customer’s documented instructions, unless otherwise required by applicable law. If Sedra is required by law to Process Personal Data other than on Customer’s instructions, Sedra will inform Customer of that legal requirement unless prohibited by law.

2.5 Unlawful Instructions; Inability to Comply. Sedra will promptly notify Customer if Sedra determines that: (a) it can no longer meet its obligations under this DPA or applicable Data Protection Law; or (b) in Sedra’s reasonable opinion, an instruction from Customer violates applicable Data Protection Law. In such an event, Sedra may suspend the affected Processing and will await Customer’s further lawful instructions.

2.6 Customer Rights; Limited Remedy. Upon notice under Section 2.5, Customer may, upon reasonable notice, take reasonable and appropriate steps to help ensure that Sedra’s Processing of Personal Data is consistent with Customer’s obligations under applicable law, subject to the confidentiality, security, and audit provisions of this DPA. If the parties are unable to resolve the issue in good faith within a commercially reasonable period, Customer may terminate the affected Order Form(s) or, if necessary, the Agreement, and receive a prompt pro rata refund of any prepaid fees covering the terminated portion of the applicable Subscription Term following the effective date of termination. This termination and refund right is Customer’s sole and exclusive remedy with respect to the subject matter of this Section, except to the extent otherwise required by applicable Data Protection Law.

3. Details of Processing

The details of Processing under this DPA, including the subject matter, duration, nature and purpose of the Processing, categories of Data Subjects, and categories of Personal Data, are described in Annex 1.

4. Confidentiality

Sedra will ensure that persons authorized to Process Personal Data on its behalf are subject to appropriate confidentiality obligations.

5. Security

5.1 Security Measures. Sedra will maintain reasonable administrative, technical, and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, taking into account the nature of the Services and the risks presented by the Processing.

5.2 Security Program. Sedra will maintain a written information security program appropriate to the nature of the Services and the sensitivity of the Personal Data Processed by Sedra.

5.3 Updates to Security Measures. Sedra may update its security measures from time to time, provided that such updates do not materially decrease the overall security of the Services during a then-current paid Subscription Term, except as required to address legal, regulatory, or security issues.

6. Personal Data Breaches

6.1 Breach Notification. Sedra will notify Customer without undue delay after confirming a Personal Data Breach affecting Personal Data Processed by Sedra under this DPA.

6.2 Cooperation. Sedra will provide information reasonably available to Sedra regarding the nature of the Personal Data Breach, the categories of affected data, and Sedra’s remediation efforts, taking into account the nature of the Services and the information available to Sedra.

6.3 No Admission. Sedra’s notification of or response to a Personal Data Breach is not an admission of fault or liability.

7. Public Authority Requests

If Sedra receives a subpoena, court order, warrant, regulatory request, law enforcement request, or other legally binding request from a public authority seeking access to Personal Data processed under this DPA, Sedra will, to the extent legally permitted: (a) promptly notify Customer; (b) use commercially reasonable efforts to direct the requesting party to seek the Personal Data directly from Customer where appropriate; (c) not disclose more Personal Data than is legally required; and (d) reasonably cooperate with Customer, at Customer’s expense, in any effort to challenge, limit, or seek confidential treatment for the requested disclosure. Nothing in this Section requires Sedra to violate applicable law or a binding legal prohibition.

8. Subprocessors

8.1 General Authorization. Customer authorizes Sedra to engage Subprocessors to Process Personal Data in connection with the Services.

8.2 Subprocessor Obligations. Sedra will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those set out in this DPA, to the extent applicable to the services performed by the Subprocessor.

8.3 Responsibility. Sedra will remain responsible for the performance of its Subprocessors’ obligations under this DPA to the extent required by applicable Data Protection Law.

8.4 Subprocessor List and Notice. Sedra will make available a list of its Subprocessors and will provide notice of new Subprocessors as required by applicable Data Protection Law.

8.5 Objections. To the extent required by applicable Data Protection Law, Customer may object to a new Subprocessor on reasonable data protection grounds within ten (10) days after notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Services upon written notice, and Sedra will refund any prepaid fees covering the terminated portion of the applicable Subscription Term.

9. Assistance and Cooperation

9.1 Data Subject Requests. Taking into account the nature of the Processing, Sedra will provide reasonable assistance to Customer to enable Customer to respond to requests from Data Subjects exercising their rights under applicable Data Protection Law.

9.2 Privacy Impact Assessments and Consultations. Taking into account the nature of the Processing and the information available to Sedra, Sedra will provide reasonable assistance to Customer with data protection impact assessments, transfer impact assessments, and consultations with supervisory authorities, in each case only to the extent required by applicable Data Protection Law and reasonably related to Sedra’s Processing of Personal Data under the Agreement.

9.3 Compliance Information. Sedra will make available information reasonably necessary to demonstrate Sedra’s compliance with this DPA, subject to reasonable confidentiality, security, and access limitations.

10. Audits

10.1 Audit Information. Sedra may satisfy its audit and information obligations under this DPA by providing current third-party audit reports, certifications, summaries of controls, security documentation, or other reasonably equivalent information.

10.2 Additional Audits. If the information provided under Section 10.1 is not sufficient under applicable Data Protection Law, Customer may request an additional audit of Sedra’s compliance with this DPA no more than once per year, unless a Personal Data Breach or supervisory authority requirement justifies a more frequent audit.

10.3 Audit Conditions. Any audit must: (a) be conducted on reasonable prior written notice; (b) be limited to matters relevant to Sedra’s Processing under this DPA; (c) be conducted during normal business hours and in a manner that minimizes disruption; (d) be subject to Sedra’s reasonable confidentiality, security, and access requirements; and (e) be carried out by Customer or an independent third party reasonably acceptable to Sedra.

10.4 Costs. Customer will bear its own audit costs and reimburse Sedra for Sedra’s reasonable costs of supporting any additional audit conducted under Section 10.2 and 10.3, except to the extent such audit reveals a material breach of this DPA by Sedra.

11. Return and Deletion

Upon expiration or termination of the Agreement, Sedra will delete or return Personal Data in accordance with the Agreement, except to the extent retention is required by applicable law or reasonably maintained in routine backup systems, provided such retained Personal Data remains protected under this DPA for as long as retained.

12. International Data Transfers

12.1 Transfers Generally. If Sedra transfers Personal Data subject to the GDPR, UK GDPR, or Swiss data protection law to a country that does not provide an adequate level of protection under applicable Data Protection Law, the parties will implement an appropriate transfer mechanism as required by applicable Data Protection Law.

12.2 EEA Transfers. For transfers of Personal Data subject to the GDPR from the EEA to a country outside the EEA that is not subject to an adequacy decision, the SCCs are incorporated by reference and apply as follows: (a) Module Two applies where Customer is a Controller and Sedra is a Processor; (b) Module Three applies where Customer is a Processor and Sedra is a subprocessor; (c) where applicable, Clause 7 is deleted; (d) in Clause 9, Option 2 applies, and Sedra will notify Customer of new Subprocessors in accordance with Section 8 of this DPA; (e) where applicable, Clause 11 is deleted; and (f) Clauses 17 and 18 will be governed by the laws and courts of Ireland.

12.3 UK Transfers. For transfers of Personal Data subject to the UK GDPR from the United Kingdom to a country not recognized as adequate under UK law, the SCCs as modified by Section 12.2 will apply, together with the UK Addendum, which is incorporated by reference. The relevant tables of the UK Addendum will be deemed completed using the information set out in Annexes 1 and 2 and the details of the parties and the Processing under the Agreement.

12.4 Swiss Transfers. For transfers of Personal Data subject to Swiss data protection law from Switzerland to a country not recognized as adequate under Swiss law, the SCCs as modified by Section 12.2 will apply, with references interpreted as necessary to cover Swiss law and Data Subjects, and Clauses 17 and 18 will be governed by the laws and courts of Switzerland.

12.5 Alternative Transfer Mechanisms. If the SCCs or UK Addendum are replaced, amended, or no longer recognized as valid, the parties will cooperate in good faith to implement an alternative lawful transfer mechanism.

13. Region-Specific Terms

To the extent required by applicable Data Protection Law, the region-specific terms in Annex 3 apply.

14. General Terms

14.1 Order of Precedence. If there is a conflict between this DPA and the Agreement, this DPA controls with respect to its subject matter. For clarity, nothing in this DPA restricts Sedra’s right to use de-identified, aggregated, or other information that is not Personal Data, or to process Personal Data as otherwise permitted by applicable law.

14.2 Liability. The liability of each party under this DPA is subject to the exclusions and limitations of liability set out in the Agreement, except to the extent otherwise expressly stated in the Agreement or required by applicable Data Protection Law. Sedra will be liable to Customer under this DPA only for losses to the extent directly caused by Sedra’s breach of this DPA, negligence, or willful misconduct, and only to the extent permitted by applicable Data Protection Law.

14.3 Updates. Sedra may update this DPA from time to time on a prospective basis to address legal, regulatory, security, operational, or technical developments, provided that any material change will not materially reduce Customer’s rights during a then-current paid Subscription Term.

14.4 Governing Law. This DPA is governed by the governing law of the Agreement, unless applicable Data Protection Law requires otherwise for the SCCs, UK Addendum, or similar transfer mechanism.

14.5 Entire Agreement. This DPA forms part of the Agreement and is the parties’ complete agreement regarding its subject matter.

Annex 1: Details of Processing

A. Parties

Data Exporter / Customer:

The Customer identified in the Agreement and applicable Order Form.

Data Importer / Sedra:

The Sedra contracting entity under the Agreement.

B. Subject Matter and Duration of the Processing

Sedra will Process Personal Data as necessary to provide, secure, support, and improve the Services under the Agreement for the duration of the Agreement and any applicable post-termination period during which Sedra retains Personal Data in accordance with the Agreement and this DPA.

C. Nature and Purpose of the Processing

The Processing may include receiving, storing, organizing, structuring, hosting, accessing, analyzing, transmitting, retrieving, disclosing, deleting, and otherwise using Personal Data as necessary to provide, maintain, secure, support, and improve the Services, and as otherwise instructed by Customer through the Agreement, Order Forms, Documentation, and Customer’s use of the Services.

D. Categories of Data Subjects

Data Subjects may include, as applicable:

• Customer personnel and Authorized Users;
• Customer clients, counterparties, customers, vendors, and service providers;
• employees, contractors, directors, officers, and representatives of entities reflected in Customer Data;
• individuals whose information is included in financial, transactional, compliance, audit, investigative, or related datasets submitted by Customer.

E. Categories of Personal Data

Personal Data may include, as applicable:

• name and contact information;
• professional and employment information;
• account identifiers and user credentials;
• transaction records and related financial information;
• customer, client, vendor, or counterparty records;
• communications and associated metadata;
• device, log, telemetry, and usage data associated with the Services;
• any other Personal Data submitted by or for Customer through the Services.

F. Sensitive Data

Customer will not submit special categories of personal data, protected health information, or other data subject to heightened legal or regulatory restrictions unless expressly permitted under the Agreement, the applicable Order Form, and any additional required compliance terms.

G. Frequency of Transfer

Continuous or as initiated by Customer through use of the Services.

H. Competent Supervisory Authority

The supervisory authority determined in accordance with applicable Data Protection Law and, where applicable, the SCCs.

Annex 2: Security Measures

Sedra will maintain security measures appropriate to the nature of the Services and the sensitivity of the Personal Data, which may include, as appropriate:

1. measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
2. measures to restore availability and access to Personal Data in a timely manner after an incident;
3. measures for user authentication, access control, and least-privilege administration;
4. encryption of data in transit and, where appropriate, at rest;
5. logging, monitoring, and incident response procedures;
6. vulnerability management and security patching processes;
7. personnel confidentiality obligations and security awareness measures;
8. vendor and subprocessor risk management measures; and
9. processes for testing, assessing, and evaluating the effectiveness of security measures.

Sedra may update these security measures from time to time, provided that such updates do not materially decrease the overall security of the Services during a then-current paid Subscription Term, except as required to address legal, regulatory, or security issues.

Annex 3: Region-Specific Terms

To the extent required by applicable Data Protection Law, the following apply:

1. EEA / GDPR. Sedra will Process Personal Data in accordance with Article 28 of the GDPR to the extent applicable to Sedra’s role as Processor.
2. United Kingdom. References to the GDPR include the UK GDPR, as applicable, and the UK Addendum applies as set out in Section 12.3.
3. Switzerland. References to the GDPR and SCCs will be interpreted as necessary to reflect Swiss data protection law, including references to the FDPIC where applicable.
4. United States. To the extent Sedra processes Personal Data subject to applicable U.S. privacy laws on Customer’s behalf, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, other applicable U.S. state privacy laws, and other applicable U.S. privacy requirements relating to such Processing, the parties acknowledge that Sedra is acting as a “service provider,” “contractor,” or “processor,” as applicable. Sedra will process such Personal Data only for the purposes described in the Agreement and this DPA and as otherwise permitted by applicable law. Sedra will not: (a) “sell” or “share” such Personal Data; (b) retain, use, or disclose such Personal Data for any purpose other than the purposes described in the Agreement and this DPA, including providing, securing, supporting, and improving the Services as permitted by applicable law; (c) retain, use, or disclose such Personal Data outside the direct business relationship between Customer and Sedra, except as permitted by applicable law; or (d) combine such Personal Data with personal data received from another source except as permitted by applicable law. Sedra certifies that it understands and will comply with these restrictions to the extent required by applicable law.
5. Conflicts. If a region-specific term in this Annex conflicts with another provision of this DPA solely because applicable law requires a different term, the region-specific term will control to that extent.