Data Processing Addendum
This Data Processing Addendum (“Addendum”) forms part of the Terms of Service (“Principal Agreement”) between: (i) Pipedream, LLC, acting on its own behalf and on behalf of its Affiliates (“Vendor”); and (ii) the individual creating a “Free” or “Basic” account, or the entity creating an “Advanced,” “Business,” “Enterprise,” or “Connect” account and thereby entering into this Addendum and the accompanying Principal Agreement (“Customer”).
The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Principal Agreement. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect.
1. Definitions
In this Addendum, the following terms shall have the meanings set out below:
“Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with either party, where control is defined the direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., its implementing regulations, and amendments, including the California Privacy Rights Act and its implementing regulations.
“Data Protection Laws” means all data protection or privacy laws and regulations applicable to the Processing of Personal Data.
“Data Subject” means the person to whom the Personal Data relates.
“EEA” means the European Economic Area;
“Europe” or “European” means the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland.
“GDPR” means either or both the (i) General Data Protection Regulation 2016/679 (EU); (“EU GDPR”), and (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) as the context may require.
“Personal Data” means any User Data entered by Customer or Customer’s Users that (i) relates to an identified or identifiable natural person, or (ii) is defined as “personal data” or “personal information” (or any substantively analogous term) by applicable Data Protection Laws.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
“Restricted Transfer” means: (i) where the EU GDPR applies, a transfer of Personal Data from the EEA to a recipient in a country outside of the EEA which is not subject to a valid adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of Personal Data from the UK to a recipient in a country outside the UK which is not based on adequacy regulations pursuant to Chapter V of the UK GDPR; and (iii) where the Swiss Federal Act on Data Protection of September 25, 2020 (“Swiss FADP”) applies, a transfer of Personal Data from Switzerland to recipient in a country outside Switzerland which has not been recognized to provide an adequate level of protection by the Federal Council.
“Standard Contractual Clauses” means (i) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 (“EU SCCs”); (ii) where the UK GDPR applies, the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under s.119A(1) of the UK Data Protection Act 2018 (version B1.0 of 21 March 2022) as updated or amended (“UK Addendum”); and (iii) where the Swiss Federal Act on Data Protection applies, the EU SCCs with Swiss Amendments (Section 11.3).
“Subprocessor” means a Vendor Affiliate or third party engaged by Vendor or any Vendor Affiliate to Process Personal Data under this Addendum.
“Subprocessor List” means the subprocessor list identifying the Subprocessors that are authorized to Process Personal Data, accessible through Vendor’s website (currently located at https://pipedream.com/docs/subprocessors/.
The terms, “Commission”, “Controller”, “Member State”, “Processing”, “Processor” and “Supervisory Authority” shall have the same meaning as in the GDPR.
2. Processing Personal Data
2.1. This Addendum applies to the Processing of Personal Data by Vendor to provide the Services. For the purposes of this Addendum, Customer is a Controller or a Processor and Vendor is a Processor.
2.2 Vendor shall only Process Personal Data in accordance with the Customer’s documented instructions. Customer instructs Vendor to Process Personal Data to provide the Service in accordance with the Principal Agreement (including this Addendum) and as further specified via Customer and Customer’s Users’ use of the Service. For clarity, Vendor will not Sell or Share, or combine Personal Data with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with another Vendor customer, except as otherwise permitted by the Principal Agreement or applicable Data Protection Law. “Sell,” “Share,” and “personal information” shall have the same meanings as provided for under the CCPA.
2.3. Each party shall comply with its obligations under applicable Data Protection Laws related to Processing Personal Data. Customer shall ensure that any instruction it issues to Vendor complies with applicable Data Protection Laws. Vendor shall inform Customer without undue delay if, in its reasonable opinion, an instruction issued by Customer violates applicable European Data Protection Laws.
2.4. Customer and each Customer Affiliate warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out in section 2.2 on behalf of each relevant Customer Affiliate.
2.5 The agreed subject-matter, the nature, purpose and duration of data processing, the types of Personal Data and categories of Data Subjects are set forth in Appendix 1 to this Addendum.
3. Vendor and Vendor Affiliate Personnel
Vendor and each Vendor Affiliate shall take reasonable steps to ensure the reliability of any personnel and will require such personnel to Process Personal Data in accordance with Customer’s instructions as set forth in this Addendum and to be subject to confidentiality obligations or professional or statutory obligations of confidentiality.
4. Security
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Vendor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in Appendix 2.
5. Subprocessing
5.1. Customer authorizes Vendor and each Vendor Affiliate to engage Subprocessors in accordance with this Section 5 and any restrictions in the Principal Agreement. Vendor or the relevant Vendor Affiliate engaging a Subprocessor shall ensure that such Subprocessor has entered into a written agreement that is no less protective than this Addendum. Vendor shall be liable for the acts and omissions of any Subprocessors to the same extent as if the acts or omissions were performed by Vendor.
5.2. Vendor makes available to Customer a Subprocessor List and at least 15 days prior to authorizing any new Subprocessor to Process Personal Data, Vendor shall provide notice to Customer by updating the Subprocessor List. Within 15 days of receipt of that notice, Customer may notify Vendor in writing of any objections (on reasonable grounds relating to data protection). Should Vendor choose to retain the objected-to Subprocessor, Vendor will notify Customer and Customer may choose to terminate its active agreements with Vendor within thirty (30) days (which shall not relieve Customer of its obligation to pay Vendor for any services already provided).
6. Data Subject Rights
6.1. Taking into account the nature of the Processing, Vendor shall assist Customer by implementing reasonable technical and organizational measures, insofar as this is possible, to allow fulfilment of the Customer’s obligations to respond to requests to exercise Data Subject rights under the Data Protection Laws (“Data Subject Requests”).
6.2. For the avoidance of doubt, Customer is responsible for responding to Data Subject Requests. Vendor shall promptly notify Customer if Vendor receives a Data Subject Request, provided the Data Subject has given sufficient information for Vendor to identify Customer.
7. Personal Data Breach
7.1. Vendor shall notify Customer without undue delay upon Vendor becoming aware of a Personal Data Breach affecting Personal Data, providing Customer with the information required under applicable Data Protection Laws. To the extent Customer requires additional information from Vendor to meet its Personal Data Breach notification obligations under applicable Data Protection Laws, Vendor shall provide reasonable assistance to provide such information to Customer taking into account the nature of Processing and the information available to Vendor.
7.2. Vendor shall take appropriate measures to address and mitigate the adverse effects of the Personal Data Breach.
8. Data Protection Impact Assessment and Prior Consultation
Vendor shall provide reasonable assistance to Customer to meet Customer’s legal obligations under applicable Data Protection Laws to carry out any data protection impact assessments or prior consultations with the competent Supervising Authorities related to Customer’s use of the Service, taking into account the nature of the Processing and information available to Vendor.
9. Deletion or return Personal Data
9.1. Subject to Vendor’s legal obligations, Vendor shall promptly and in any event within 30 days of the date of cessation of any Services involving Processing Personal Data (the “Cessation Date”), delete and procure the deletion of all copies of those Personal Data. Until deletion, Vendor will continue to protect all Personal Data in accordance with this Addendum.
9.2. Customer may by written notice to Vendor within 30 days prior to the Cessation Date require Vendor to return a copy of Personal Data to Customer by secure file transfer in such format as is reasonably notified by Customer to Vendor.
9.3. Vendor shall upon Customer’s written request provide written certification to Customer that it has fully complied with this section 10 within 30 days of the Cessation Date.
10. Audit rights
10.1. Subject to section 10.2, Vendor shall make available to Customer on request the information reasonably necessary to demonstrate compliance with this Addendum, and shall allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer.
10.2. Vendor will allow Customer or an independent auditor appointed by Customer to conduct an audit, subject to the following: (a) Customer and Vendor will mutually agree upon the scope, timing, duration, and control and evidence requirements; (b) Customer is responsible for all costs and fees related to such audit and will reimburse Vendor at its then-current rates for any services performed; and (c) to the extent the audit is conducted by a third-party audit firm, the third-party audit firm is not a competitor of Vendor. Such audit may be subject to additional reasonable confidentiality and security agreements and requirements.
11. Restricted Transfers
To the extent Customer’s use of the Service involves a Restricted Transfer, the Standard Contractual Clauses will apply between Customer (as “data exporter”) and Vendor (as “data importer”) as follows:
11.1 EU Personal Data. In relation to Personal Data protected by the EU GDPR, the EU SCCs will apply (and be incorporated into this Addendum by this reference) completed as follows:
i. Module 2 applies unless the Customer is a Processor in which case Module 3 applies;
ii. in Clause 7, the optional docking clause will not apply;
iii. in Clause 9, Option 2 will apply, and the time period for prior notice of subprocessor changes will be in accordance with the notification process set out in Section 5 of this Addendum;
iv. in Clause 11, the optional redress language will not apply;
v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by the laws of Ireland;
vi. in Clause 18(b), disputes shall be resolved before the courts of Ireland;
vii. Annex I of the EU SCCs shall be deemed completed with the information set out in Appendix 1 to this Addendum; and
viii. Annex II of the EU SCCs shall be deemed completed with the information set out in Appendix 2 to this Addendum.
11.2 UK Personal Data. In relation to Personal Data protected by the UK GDPR (“UK Personal Data”), the UK Addendum will apply as follows:
i. the EU SCCs, completed as set out in Section 11.1 of this Addendum, shall also apply to transfers of UK Personal Data;
ii. the UK Addendum shall be deemed executed (and incorporated into this Addendum by this reference) between the transferring Customer and Vendor, and the EU SCCs shall be deemed amended as specified by Part 2 (Mandatory Clauses) of the UK Addendum in respect of the transfer of UK Personal Data;
iii. Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from within this Addendum and the EU SCCs, completed as set out in Section 11.1 of this Addendum;
iv. the start date of the UK Addendum (as set out in Table 1) shall be the effective date of this Addendum; and
v. Table 4 of the UK Addendum shall be deemed completed “neither party”.
11.3 Swiss Personal Data. In relation to Personal Data protected by the Swiss FADP, the EU SCCs will apply amended and adapted as follows:
i. references to the EU and EU Member States shall mean Switzerland;
ii. under Clause 18(c) of the EU SCCs, data subjects in Switzerland shall also have the right to sue for their rights at their place of habitual residence
iii. references to the GDPR in the EU SCCs shall also include the reference to the equivalent provisions of the Swiss FADP; and
iv. the Swiss Federal Data Protection and Information Commission is the supervisory authority.
11.4 The Standard Contractual Clauses will be subject to the following clarifications:
i. Vendor will allow Customer to conduct audits as described in the SCCs in accordance with Section 10 of this Addendum.
ii. Customer authorizes Vendor to appoint Subprocessors in accordance with Section 5 of this Addendum, and Customer may exercise its right to object to Subprocessors under the Standard Contractual Clauses in the manner set out in Section 5.
iii. Vendor shall return and delete Customer’s data in accordance with Section 9 of this Addendum.
iv. Customer agrees that any assistance that Vendor provides to Customer under the Standard Contractual Clauses shall be provided in accordance with Section 10 of this Addendum.
v. Nothing in this Section 11 of this Addendum varies or modifies the Standard Contractual Clauses nor affects any Supervisory Authority’s or Data Subject’s rights under the Standard Contractual Clauses. If any provision of this Addendum contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
12. General Terms
12.1. This Addendum is subject to the non-conflicting terms of the Principal Agreement. With regard to the subject matter of this Addendum, in the event of conflicts between the provisions of this Addendum and the Principal Agreement arise, the provisions of this Addendum shall prevail with regard to the parties’ data protection obligations.
12.2. This Addendum may be updated by Vendor from time to time to comply with applicable Data Protection Laws applicable to Vendor as a Processor, provided that no update will materially decrease Vendor’s Processor obligations under the Addendum.
12.3. Customer’s remedies (including those of its Affiliates) with respect to any breach by Vendor (including any breach caused by Vendor’s Affiliates and Subprocessors) of the applicable terms of this Addendum, and the overall aggregate liability of Vendor and its Affiliates arising out of, or in connection with the Principal Agreement (including this Addendum) will be subject to any aggregate limitation of liability that has been agreed between the parties under the Principal Agreement.
12.4 Customer is responsible for coordinating all communication with Vendor on behalf of its Affiliates with regard to this Addendum. Customer represents that it is authorized to enter into this Addendum and any transfer safeguards entered into under this Addendum, issue instructions, and make and receive any communications or notifications in relation to this Addendum on behalf of its Affiliates.
12.5 The term of this Addendum will end simultaneously and automatically at the later of (i) the termination of the Principal Agreement or, (ii) when all Personal Data is deleted from Vendor’s systems.
12.6 Customer’s Affiliates may enforce the terms of this Addendum directly against Vendor, subject to the following provisions:
i. Customer will bring any legal action, suit, claim or proceeding which that Affiliate would otherwise have if it were a party to the Principal Agreement (each an “Affiliate Claim”) directly against Vendor on behalf of such Affiliate, except where the Data Protection Laws to which the relevant Affiliate is subject require that the Affiliate itself bring or be party to such Affiliate Claim; and
ii. for the purpose of any Affiliate Claim brought directly against Vendor by Customer on behalf of such Affiliate in accordance with this Section, any losses suffered by the relevant Affiliate may be deemed to be losses suffered by Customer.
12.7 The section headings contained in this Addendum are for reference purposes only and shall not in any way affect the meaning or interpretation of this Addendum.
APPENDIX 1: DETAILS OF PROCESSING OF PERSONAL DATA
A: List of Parties
Data Exporter
The data exporter: Customer
Contact details: The contact information provided by Customer in Customer’s account
Relevant activities: Customer’s use of Vendor’s platform and services, including to house its software code and applications.
Signature and Date: By entering into the Principal Agreement, data exporter is deemed to have signed these Standard Contractual Clauses incorporated herein as of the effective date of the Principal Agreement.
Data exporter role: The data exporter’s role is set forth in the Addendum.
Data Importer
The data importer: Pipedream, LLC
Contact details: privacy@pipedream.com
Relevant activities: Provide application and workflow services.
Signature and Date: By entering into the Agreement, data importer is deemed to have signed these Standard Contractual Clauses incorporated herein as of the effective date of the Principal Agreement.
Data importer role: Processor
B. Description of Transfer
Categories of data subjects
The personal data transferred concern data subjects whose personal data may be included within the software, code or other information Customer transfers to the Vendor platform, in the course of the above services.
Categories of personal data transferred
Customer determines the personal data transferred, pursuant to the services required. They may include, for instance, certain personal data (e.g., email addresses in clear or hashed form) embedded in code, such as for application testing purposes.
Special categories of data (if appropriate)
It is not anticipated or intended that special categories of data will be provided by Customer.
The frequency of the transfer
Transfers will be made on a continuous basis.
Processing operations (including nature, purpose and duration of Processing)
Vendor acts as a processor for the Personal Data Customer submits electronically into Vendor’s platform to obtain application and workflow services in connection with the Principal Agreement.
1. Processing Personal Data to set up, operate, maintain and support the applications
2. Storing Personal Data in secure data centers
3. Providing the Services
The period for which the personal data will be retained
Personal data will be retained for the duration of the Principal Agreement in accordance with Section 9 of the Addendum.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
The subject matter and duration of the processing is outlined above within this Appendix 1. The nature of the specific sub-processing services are further detailed within the Subprocessor List (currently located at: https://pipedream.com/docs/subprocessors).
C. Competent Supervisory Authority
The competent supervisory authority is determined in accordance with Clause 13 of the EU SCCs unless required otherwise by Addendum Sections 11.2 (UK Personal Data) and 11.3 (Swiss Personal Data).
APPENDIX 2: TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
At a minimum, the following technical and organisational measures will be implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons. Data importer shall take commercially reasonable measures designed to ensure that subprocessors have in place measures that are substantively as or more protective, taking into account the personal data to be processed by such subprocessor.
Vendor shall at a minimum ensure the following security measures:
Information security policy: Vendor will implement and adhere to a written information security policy that specifies the security standards it will apply to protect the Personal Data it processes in accordance with this Addendum. The information security policy will mandate the use of appropriate technical and organisational security measures in the Vendor’s organisation to protect Personal Data against unauthorised and unlawful processing and against accidental loss, damage or destruction. It will further describe the measures to be taken in the event of an actual or suspected data or security breach.
Information security officer: Vendor will appoint a duly skilled employee with responsibility for ensuring the security of Personal Data processed by Vendor in its organisation and for reviewing, maintaining and updating the Provider’s information security policy.
Physical security: Access to data processing facilities will be restricted to duly authorised employees and contractors by use of keys, fingerprint readers, or other electronic security measures.
Firewall and antivirus: Where technically feasible, vendor will implement appropriate firewall, anti-virus, anti-spyware and other anti-malware software and technologies on all networks and systems it uses to process Personal Data. Vendor will update its firewall, anti-virus, anti-spyware and other anti-malware software and technologies on a regular basis to ensure that they protect against then-current virus, spyware and other malware threats.
Access controls: Vendor will implement technical access controls that restrict access to Personal Data it processes to duly authorised employees and contractors only. Duly authorised employees and contractors will be permitted to access Personal Data only to the extent necessary for the performance of their duties.
Usernames / passwords: Access to Personal Data will be controlled through access privileges (described above), usernames and confidential passwords. No two employees or contractors may share or use the same username. Employees and contractors will be required to create complex passwords consistent with then-current security best practices.
Back-up: Vendor will take regular, at least weekly, back-ups of the Personal Data that it processes on behalf of Customer. Data back-ups will be stored securely and will be available for data restoration within a reasonable period of time.
Disaster recovery / business continuity: Vendor will implement and adhere to appropriate disaster recovery and business continuity plans that will ensure the availability, security, integrity and (where necessary) restoration of the Personal Data on the occurrence of a force majeure or similar business interruption event. Vendor will provide a copy of its disaster recovery and business continuity plans to Customer upon request.
Power loss: Vendor’s data processing systems will protect against loss, destruction or damage of Personal Data due to failure or interference of any power supply.
Audit: Vendor will audit its compliance with its information security policy on a regular basis and at least once per annum. Any remedial measures identified as necessary following an audit will be reviewed and implemented as appropriate under the circumstances.