Global Data Processing Addendum

Last updated: July 12, 2024

This Global Data Processing Addendum (this “Addendum”) is incorporated into the Agreement and is effective as of the Agreement or Order Form (defined in the Agreement) signature date (the “Effective Date”) by and between SOCi, Inc. and its affiliates as applicable (“SOCi”) and Customer (as defined in the Agreement). SOCi and Customer are referred to individually as a “Party” and collectively as the “Parties.”

Whereas the Parties entered into one or more agreements in which SOCi agreed to perform Services (as defined below) on behalf of Customer (the “Agreement”), and the Parties wish to amend the Agreements to address requirements imposed by applicable Privacy Laws, the Parties agree as follows:

1. Definitions
   1. “Privacy Laws” means applicable statutes, regulations or other laws pertaining to privacy or data protection, processing of Personal Information, and/or information security, including, but not limited to, the EU General Data Protection Regulation 2016/679 (“GDPR”); United Kingdom General Data Protection Regulation applicable by virtue of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“UK GDPR”); the revised Swiss Federal Act on Data Protection (“revFADP”); Brazil Law No. 13,709/2018 (General Law for the Protection of Personal Data or “LGPD”); Personal Information Protection and Electronic Documents Act (“PIPEDA”); California Consumer Privacy Act, Cal. Civ. Code 1798.100 et seq. (“CCPA”), as amended including by the California Privacy Rights Act (“CPRA”); the Virginia Consumer Data Protection Act, Code of Virginia title 59.1, Chapter 52 (“VCDPA”); the Colorado Privacy Act, Colorado Rev. Stat. 6-1-1301 et seq. (“CPA”), the Utah Consumer Privacy Act, Utah Code 13-61-101 et seq. (“UCPA”), the Connecticut Act Concerning Personal Data Protection and Online Monitoring, Conn. PA 22-15 § 1 et seq. (“PDPOM”); the Personal Information Protection Law of the People’s Republic of China (“PIPL”); and any other applicable federal or state laws or regulations regarding information privacy that are in effect or will come into effect during the term of the Agreements.
   2. “2021 Standard Contractual Clauses” means the standard contractual clauses annex to European Commission Implementing Decision (EU) 2021/914 for the transfer of Personal Information to Third Countries (and any successor clauses).
   3. “UK Addendum” means the International Data Transfer Addendum to the 2021 Standard Contractual Clauses, issued by the Information Commissioner’s Office of the United Kingdom.
   4.  “Third Countries” means countries that are not recognized by the Privacy Laws as countries providing adequate protection of Personal Information.
   5. The terms “business,” “business purposes,” “consumer,” “controller,” “data subject,” “personal data,” “personal information,” “process” or “processing,” “processor,” “Sell,” “sensitive data,” “sensitive personal information,” “service provider,” “Share,” “subcontractor,” and “supervisory authority” shall have the meanings given to those terms in the Privacy Laws to the extent such meanings are materially similar to the meaning of terms in effect on the Effective Date.  In the event of a conflict in the meanings of terms among the Privacy Laws, the Parties agree that only the meanings in applicable Privacy Laws will apply.
   6. Capitalized terms not otherwise defined shall have the meaning given to them in the Agreements.
2. Terms of Data Processing 
   1. Data Processing Exhibit – The Parties acknowledge and agree that the details of the processing are provided in Exhibit A, attached hereto.
   2. Data Processing Instructions – SOCi shall process the Covered Personal Information for the duration of the Agreement (unless otherwise agreed in writing) only (a) as necessary to effect SOCi’s obligations under the Agreements and/or (b) on documented and customary instructions from Customer, unless otherwise required by applicable law.
   3. Compliance with Obligations – SOCi represents and warrants that SOCi, its employees, agents, subcontractors, and sub-processors (a) understand and shall comply with the Privacy Laws and this Addendum while providing the Services, (b) will provide the level of privacy protection required by the Privacy Laws, and (c) shall provide Customer with all reasonably-requested assistance to enable Customer to fulfill its own obligations under the Privacy Laws. Upon the reasonable request of Customer and in accordance with the requirements of the applicable Privacy Laws, SOCi shall make available to Customer information in SOCi’s possession necessary to demonstrate SOCi’s compliance with this subsection and with applicable Privacy Laws in a manner consistent with SOCi’s obligations under the applicable Privacy Laws.
   4. Audit Rights – Customer shall have the right to take reasonable and appropriate steps to monitor SOCi’s compliance with this Addendum. SOCi shall cooperate with an audit initiated by Customer, provided that such audit will not unreasonably interfere with the normal conduct of SOCi’s business.  Upon the reasonable request of Customer, SOCi shall make available to Customer all information in SOCi’s possession necessary to demonstrate SOCi’s compliance with SOCi’s obligations under this Addendum and the Privacy Laws with respect to Covered Personal Information.
   5. Compliance Remediation; Termination Rights – SOCi agrees to notify Customer promptly if SOCi determines that it can no longer meet its obligations under applicable Privacy Laws.  Upon receiving notice from SOCi in accordance with this subsection, Customer may direct SOCi to take steps as reasonable and appropriate to remediate unauthorized use of Covered Personal Information or terminate the Agreements upon thirty (30) days’ notice.
   6. Changes to Privacy Laws – To the extent this Addendum requires a Party to comply with the Privacy Laws, compliance will be in accordance the Privacy Laws as in force and applicable at the time of performance and, if the relevant obligation is not then a requirement under the Privacy Laws, it shall not apply until it is so required. The Parties agree to cooperate in good faith to enter into additional terms to address any modifications, amendments, or updates to the applicable Privacy Laws.
   7. Obligations at Termination – When the Agreements expire, SOCi will discontinue processing and destroy Covered Personal Information without undue delay unless otherwise instructed by Customer.
   8. Impact Assessments – If applicable, SOCi shall, upon the reasonable request of Customer, provide Customer with such assistance and information as is reasonably necessary to enable Customer to carry out privacy impact assessments, data protection impact assessments, and required consultations with supervisory authorities under applicable Privacy Laws.
3. Limitations on Processing of Covered Personal Information
   1. Data Restrictions – SOCi will not: (a) Sell or Share Covered Personal Information, (b) retain, use, or disclose Covered Personal Information for any purpose other than the limited purposes specified in the Agreements and Exhibit A hereto, such as providing the Services to Customer; or (c) unless permitted by applicable Privacy Laws (i) retain, use, or disclose Covered Personal Information outside the direct business relationship with Customer; or (ii) retain, use, or disclose Covered Personal Information for any commercial purpose not specified in the Agreements or Exhibit A hereto.
   2. Subcontractors; Sub-processors – SOCi shall engage subcontractors or sub-processors that process Covered Personal Information only with Customer’s general written authorization.  SOCi’s sub-processors and subcontractors currently listed in Appendix A (as of the date this DPA is executed) are deemed pre-approved.  SOCi shall notify Customer of any intended changes concerning the addition or replacement of subcontractors or sub-processors as described in Appendix A below. Further, SOCi shall ensure that SOCi’s subcontractors or sub-processors who collect, process, store, or transmit Covered Personal Information on SOCi’s behalf agree in writing to the same restrictions and requirements that apply to SOCi in this Addendum and the Agreements with respect to Covered Personal Information, as well as to comply with applicable Privacy Laws.
   3. Right to Object – Customer may object in writing to SOCi’s appointment of a new subcontractor or sub-processor by notifying SOCi in writing within 30 calendar days of receipt of notice in accordance with Section 3.2. In the event Customer objects, SOCi will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid processing of Covered Personal Information by the objected-to new subcontractor or sub processor without unreasonably burdening Customer. If SOCi is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the applicable ordering or purchasing documents with respect only to those Services which cannot be provided by SOCi without the use of the objected-to new subcontractor or sub-processor by providing written notice to SOCi. SOCi will refund Customer any prepaid fees covering the remainder of the term of such ordering or purchasing documents following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
4. Consumer and Data Subject Requests
   1. Taking into account the nature of processing and the information available to SOCi, SOCi shall assist Customer by taking appropriate technical and organizational measures, insofar as this is reasonably practicable, for the fulfillment of Customer’s obligations under Privacy Laws to respond to consumers’ requests to exercise their rights.
   2. Referral of Direct Requests – SOCi, to the extent SOCi is able to identify that the request is from a consumer whose Covered Personal Information was submitted to the Services by Customer, agrees promptly to refer to Customer applicable consumer requests submitted directly to SOCi related to Covered Personal Information.
   3. For the purposes of this section, the term “consumer” shall include the term “data subject” as each is defined in the applicable Privacy Laws.
5. Security Controls
   1. Duty of Confidentiality – SOCi, its employees, agents, subcontractors, and sub-processors are subject to a duty of confidentiality with respect to the Covered Personal Information.
   2. Security Measures – SOCi shall implement and maintain reasonable and appropriate technical and organizational security measures, procedures, and practices appropriate to the nature of the Covered Personal Information to protect such Covered Personal Information from unauthorized access, destruction, use, modification, or disclosure (“Security Measures”). Such Security Measures shall meet or exceed applicable industry standards and any obligations set forth in the Agreements or applicable law.
   3. Access Controls – SOCi shall implement appropriate access controls restricting access to Covered Personal Information to only such employees, agents, subcontractors, and sub-processors as need to know the information in order to perform their obligations in furtherance of the Agreements.
   4. Security Incident – SOCi will inform Customer without undue delay upon SOCi’s having become aware of any confirmed unauthorized access, destruction, use, modification, or disclosure (each, a “Security Incident”) of any Covered Personal Information (to include, without limitation, any personal data breach as defined by applicable law). SOCi will provide Customer with any information and cooperation reasonably requested by Customer regarding such Security Incident.  SOCi shall not provide notice of such Security Incident without the prior written consent of Customer unless required by applicable law.
   5. Encryption – SOCi will ensure that Covered Personal Information in SOCi’s control is sufficiently protected against unauthorized access and use, including by appropriate encryption, tokenization, or other substantially similar safeguards.
   6. Security Program – SOCi shall implement a comprehensive written security program that includes industry-standard administrative, technical, and physical safeguards designed to ensure the confidentiality, security, and integrity of Covered Personal Information (“Security Program”).  Upon Customer’s reasonable request, SOCi will provide Customer with documentation that demonstrates its compliance with this Section.
6. Inquiries
   1. Notification of Regulatory Inquiry – In the event that SOCi receives any regulatory inquiry or correspondence regarding Covered Personal Information in which SOCi or Customer is named (an “Inquiry”), SOCi shall, to the extent not prohibited by applicable law or any regulatory authority:
      1. Promptly notify Customer of such Inquiry;
      2. Provide Customer with all copies of documents and correspondence relating to the Inquiry without unduly delay after receipt or delivery of such documents or correspondence;
      3. Not disclose any confidential information of Customer or any affiliated party to the applicable authority without Customer’s prior written consent.
   2. Response to Inquiry – SOCi shall take all other measures necessary to respond to or otherwise address the Inquiry adequately and in a timely manner.
7. Cross-Border Data Transfers
   1. Transfer Mechanisms – As applicable to Customer’s use of the Services, with regard to any transfers of Covered Personal Information from the European Economic Area, the United Kingdom, or Switzerland to countries that do not provide adequate protection for such data (as determined by the applicable Privacy Laws) (“Data Transfers”), and except as provided in Sections 7.2 and 7.3 below, the Data Transfers will be conducted pursuant to the EU-U.S. Data Privacy Framework (“DPF”) for Personal Data transferred from the European Economic Area, the UK Extension to the EU-U.S. DPF for Personal Data transferred from the United Kingdom (and Gibraltar), and the Swiss-U.S. Data Privacy Framework for Personal Data transferred from Switzerland, unless the Parties agree to enter into the 2021 Standard Contractual Clauses in support of such transfer.
   2. Transfers from the UK – Where the Parties have agreed to the enter into the 2021 Standard Contractual Clauses as an alternative mechanism to the DPF for Data Transfers from the United Kingdom, the UK Addendum (including all Part 2 Mandatory Clauses) is hereby incorporated by reference when it is available and is a valid transfer mechanism under applicable Privacy Laws.  The Parties further agree to the following provisions with respect to the UK Addendum:
      1. Table 1 (Parties): The contents of Table 1 (Parties) shall be completed with details provided in Exhibit A.
      2. Table 2 (Selected SCCs, Modules, and Selected Clauses):
         1. The Addendum EU SCCs shall be the Approved EU SCCs.
         2. Module Two (controller-to-processor) will apply.
         3. In Clause 7, the Parties do not permit docking.
         4. In Clause 9(a), the Parties select Option 2 and a time period of 30 days.
         5. In Clause 11, the Parties do not select the independent dispute resolution option.
      3. Table 3 (Appendix Information): The list of parties and the description of the transfers are provided in Exhibit A, Part A and Exhibit B, Part A.  The technical and organizational measures including technical and organizational measures to ensure the security of the data are provided in Exhibit B, Part B.
      4. Table 4 (Ending this Addendum when the Approved Addendum Changes): The Parties agree that Exporter may end the Addendum as set out in Section 19 of the UK Addendum.
      5. Conflicts: In the event of any conflict or inconsistency between this Addendum and the UK Addendum with respect to UK data subjects, the UK Addendum shall prevail.
   3. Transfers from the EEA – Where the Parties have agreed to the enter into the 2021 Standard Contractual Clauses as an alternative mechanism to the DPF for Data Transfers from the European Economic Area and from Switzerland, or for Data Transfers for which the DPF is not available, the 2021 Standard Contractual Clauses are hereby incorporated by reference when they are available and are a valid transfer mechanism under applicable Privacy Laws.  The Parties further agree to the following provisions with respect to the 2021 Standard Contractual Clauses:
      1. Identity of the Parties: The data exporter is Customer, and the data importer is SOCi.  Module Two (controller-to-processor) will apply to transfers involving Covered Personal Information.
      2. Conflicts: In the event of any conflict or inconsistency between this Addendum and the 2021 Standard Contractual Clauses, the 2021 Standard Contractual Clauses shall prevail.
      3. Appendices: Responses to the Annexes to the 2021 Standard Contractual Clauses are provided in Exhibit A, Part A and Exhibit B, attached hereto.
      4. Transfer Impact Assessments: Upon Customer’s request, SOCi will make available to Customer its documented assessment of its processing of Covered Personal Information hereunder for the purpose of Clause 14.
      5. Specific Provisions: The following specific provisions apply to the 2021 Standard Contractual Clauses:
         1. In Clause 7, the Parties do not permit docking.
         2. In Clause 9(a), the Parties select Option 2 and a time period of 30 days.
         3. In Clause 11, the Parties do not select the independent dispute resolution option.
         4. In Clause 17 (Option 2), the Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, or if the date exporter is not established in an EU Member State, they shall be governed by the laws of the Republic of Ireland.
         5. In Clause 18(b), disputes shall be resolved before the courts of the Republic of Ireland.
      6. For data transfers governed by Switzerland’s revFADP, the 2021 Standard Contractual Clauses also apply to the transfer of information relating to an identified or identifiable legal entity where such information is protected similarly as Personal Data under revFADP until such laws are amended to no longer apply to a legal entity. In such circumstances, general and specific references in the 2021 Standard Contractual Clauses to GDPR or EU or Member State Law shall have the same meaning as the equivalent reference in revFADP.
   4. Transfers from Brazil – The Parties agree to amend this Addendum and adopt such mechanism for restricted transfers as is required by Brazil’s data protection domestic authority and provided that such mechanism is compatible with this Addendum.
8. Miscellaneous
   1. Severability – If any provision of this Addendum shall be found to be void by a court of law, such provision shall be deemed to be severable from the other provisions of this Addendum, and the remainder of this Addendum shall be given effect, as if the Parties had not included the severed provision.
   2. Survival – All representations, warranties, and indemnities shall survive the termination and/or expiration of this Addendum and shall remain in full force and effect. All of a Party’s rights and privileges — to the extent they are fairly attributable to events or conditions occurring or existing on or prior to the termination and/or expiration of this Addendum — shall survive termination and shall be enforceable by that Party.
   3. General – Except as expressly set forth herein, the terms of the Agreements shall remain unmodified and in full force and effect. In the event of a conflict between the terms of the Agreements and the terms of this Addendum, the terms of this Addendum shall control.  Headers are for convenience and do not affect the interpretation of the terms of this Addendum.

EXHIBIT A

DETAILS OF DATA PROCESSING

A. PARTIES

B. PROCESSING TERMS

EXHIBIT B

CROSS-BORDER DATA TRANSFERS

A. DESCRIPTION OF CROSS-BORDER DATA TRANSFERS (IF APPLICABLE)

B. TECHNICAL & ORGANIZATIONAL MEASURES

Data Importer will, at a minimum, implement the following types of security measures:

SOCi has implemented technical and administrative safeguards to protect Personal Data or Personal Information (as defined under applicable Privacy Laws), where applicable to the SOCi Platform and Subscription Services, against security incidents, which include the following security measures (all capitalized terms used herein are defined in Customer’s Agreement or as defined under applicable Privacy Laws):

• Information security policy: SOCi has implemented a written information security policy that mandates the use of appropriate technical and organizational security measures in SOCi’s organization to protect Personal Data or Personal Information (as defined under applicable privacy laws) against unauthorized and unlawful processing and against accidental loss, damage or destruction as well as appropriate measures in the event of an actual or suspected data or security breach.

• Security Function: SOCi has designated a security committee tasked with responsibility for the development, implementation, and maintenance of the SOCi’s information security practice. SOCi employs a VP of Information Security to oversee the information security function and a Virtual Security Team (VST) to actively manage security issues.

• Physical security: SOCi’s Servers hosting Customer Data are secured in Amazon Data Centers and Google Cloud. Refer to https://aws.amazon.com/compliance/data-center/controls/ and/or https://cloud.google.com/security/compliance for details. 

• Logical security:  SOCi supports and recommends customers’ use of Single-Sign-On. To the extent that customers use customized login for its SOCi instance, SOCi saves a secure hash of the password, not the password itself.

• Network security: SOCi relies on Amazon Web Services and Google Cloud network protection features to protect Personal Data and to safeguard from threats. SOCi also conducts independent pen tests and periodic assessment of security setup. SOCi has implemented appropriate network security controls both in internal network and cloud network systems.

• Encryption: SOCi encrypts data at rest, uses HTTPS by default for all internet traffic and uses secure protocols to connect to Social Media service providers and other third-party systems. All encryption utilizes industry standard encryption techniques.

• Access controls: SOCi has implemented role-based access controls that restrict access to Personal Data it processes to duly authorized employees and contractors who require access only to the extent necessary for the performance of their duties. SOCi has appointed a system administrator with overall responsibility for granting, changing, or voiding data access privileges to its data processing systems. Access is controlled by multiple technical systems, and administrative access is logged.

• Usernames and Passwords: Access to Personal Data is controlled through access privileges (described above), usernames, and confidential passwords. No two Users may share or use the same username. Users will be required to change their passwords on a regular basis. All User passwords have a minimum character requirement.

• Back-up: SOCi has taken and will continue to take regular, at least weekly, back-ups of the Personal Data that it processes on behalf of the data exporter. Data back-ups are stored securely in different availability zones and will be available for data restoration in the event of catastrophic system failure and non-catastrophic system failure or user error.

• Disaster Recovery and Business Continuity: SOCi has implemented appropriate disaster recovery and business continuity plans that ensure the availability, security, integrity, and (where necessary) restoration of the Personal Data on the occurrence of a business interruption event. Business continuity and incident response processes are tested at least annually.

• Audit: SOCi will audit its compliance with the agreement between SOCi and Customer and its information security policy at least once per annum or in the event of a material change. Any remedial measures identified as necessary following an audit will be remediated in the order of severity. SOCi has multiple independent audits performed each year.  A copy of SOCi’s current audit reports will be provided upon request.

• Secure Disposal: SOCi has implemented policies and procedures regarding the disposal of Personal Data and tangible property containing Personal Data, taking into account available technology so that Personal Data cannot be practicably read or reconstructed.

Appendix A

SUB-PROCESSORS

SOCi uses certain sub-processors (“Sub-processors”) to assist in providing limited services on its behalf.

SOCi’s Sub-processors provide infrastructure, data storage, system logging services, and other tools that facilitate the delivery of the Services, including customer support and email communications. These sub-processors may be provided access to covered personal information, but only to the extent necessary to support the Services.

As part of SOCi’s commitment to keep Covered Personal Information secure, SOCi evaluates Sub-processors’ privacy and security practices prior to engaging them. SOCi also requires Sub-processors to enter into data processing agreements that protect Covered Personal Information and incorporate data protection obligations consistent with applicable Privacy Laws.

In the event SOCi removes or adds new Subprocessors, It will post updates at https://www.soci.ai/subprocessors at least thirty (30) days before doing so. For questions about SOCi’s Subprocessors, please reach out to [email protected]. Customers may subscribe to receive regular updates about SOCi’s Subprocessors at https://www.soci.ai/signup-subprocessors.

Customer authorizes SOCi to engage the following Sub-processors listed at https://www.soci.ai/subprocessors.

SOCi is a US-headquartered company with engineering and customer success teams. We primarily store Covered Personal Information in the United States. To facilitate our global operations, SOCi may transfer such information to, and access it from, subcontractors in other countries (shown in the table at https://www.soci.ai/subprocessors) for the purposes described in the Addendum and/or the Agreement.  Whenever SOCi transfers Customer Covered Personal Information originating in the EEA, the UK, or Switzerland with a Sub-processor or subcontractor outside the EEA, the UK, or Switzerland, SOCi implements appropriate safeguards, consistent with the applicable Privacy Laws of the territory from which the Covered Personal Information is exported.