Swoop Data Processing Agreement (DPA)

Preamble

THIS SWOOP DATA PROCESSING AGREEMENT (the "DPA") is entered into by and between the Customer as shown in the signature block ("Partner / Customer") and Prezi Inc., the owner of the Swoop brand, located at 2041 East Street, PMB610, Concord, CA 94520 USA ("Prezi Inc. or "Swoop""). This DPA governs the processing of Personal Data processed by Swoop for or on behalf of Partner / Customer in connection with the services provided by Swoop and as detailed in the Swoop Terms of Use.

Recitals

1. Partner / Customer has subscribed to the Swoop Terms of Use for receiving certain services from Swoop as described in Swoop's "Order Form" previously executed or accepted by other means by the Partner / Customer.
2. To comply with the General Data Protection Regulation (defined below), the Parties are required to enter into this DPA. Accordingly, Partner / Customer's engagement with Swoop is conditioned upon the agreement to this DPA.
3. In case of conflict or inconsistency the following documents prevail: Standard Contractual Clauses (SCC), this DPA, Swoop Order Form, Swoop Terms of Use.
4. This DPA shall remain in effect as long as Swoop carries out Personal Data processing operations on behalf of Partner / Customer or until the termination of the Swoop Services (and all Personal Data has been returned or deleted in accordance with Section 8).

1. Definitions

"Applicable Privacy Law(s)" means the relevant data protection and privacy laws and regulations to which Partner / Customer is subject, including, where applicable, EU Data Protection Law.

"Authorized Persons" means any person who processes Personal Data on Swoop's behalf, including Swoop's employees, officers and contractors who are under a strict duty of confidentiality (whether a contractual or statutory duty) and that they process the Personal Data only for the purposes listed in Section 2.1.

"Authorized Subprocessor" means a third-party subcontractor, agent, reseller, or auditor who has a need to know or otherwise access Personal Data to enable Swoop to perform its obligations under this DPA or the Partner / Customer Agreement, and who is either (a) listed on the list available here: https://prezi.com/legal-new/subprocessors (such URL may be updated by Prezi from time to time, subject to Swoop's compliance with Section 3.1) or (ii) otherwise specifically authorized by Partner / Customer to do so under Section 3.1 of this DPA.

"Partner / Customer Agreement" means collectively the Swoop Order Form and the Business Terms of Use

"Data Controller", "Data Exporter" means Partner / Customer.

"Data Processor", "Data Importer" means Swoop.

"EU Data Protection Law" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR").

"General Data Protection Regulation" means the European Union Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

"Standard Contractual Clauses (SCC)" means the agreement executed by and between Data Controller and Data Processor and attached hereto as Annex D pursuant to the Annex to the European Commission's implementing decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

"Personal Data" means any information provided or made available to Swoop, by or on behalf of Partner / Customer, in connection with the Services and which relates to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. For the avoidance of doubt, Personal Data includes personally identifiable information.

"Process" and its cognates mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Security Breach" means a security incident leading to an accidental, unauthorized or unlawful destruction, loss, alteration, disclosure of, or access to, Personal Data

"Security Measures" means technical and organizational security measures to meet the requirements of EU Data Protection Law, and in particular, to protect against the occurrence of Security Breaches and to preserve the security, integrity and confidentiality of Personal Data.

"Subprocessor" means any entity which provides processing services to Swoop in furtherance of Swoop's processing on behalf of Partner / Customer.

"Supervisory Authority" means an independent public authority which is established by a European Union member state pursuant to Article 51 of the General Data Protection Regulation having jurisdiction over the processing of any Personal Data under this DPA.

All terms not defined herein shall have the meaning as ascribed to them in the Prezi Business Terms of Use.

2. Nature and Scope of Data Processing

2.1

Swoop (acting as Data Processor on behalf of the Data Controller) shall only process Personal Data for the purpose of providing, supporting and improving Swoop's Services in accordance with the Prezi Business Terms of Use.

2.2

Swoop shall ensure that any Authorized Person is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and that they process the Personal Data only for the purposes listed in Section 2.1.

2.3

The categories of Personal Data processed and the categories of data subjects to this DPA are described in Annex A to this DPA.

3. Subprocessing

3.1

Partner / Customer acknowledges and agrees that Swoop may (a) engage its affiliates and the Subprocessors listed here (such URL may be updated by Swoop from time to time, subject to compliance with the remainder of this Section 3) to access and process Personal Data in connection with the Services; and (b) from time to time engage additional third parties for the purpose of providing the Services, including without limitation the processing of Personal Data, as further set out in this Section 3.

3.2

In the event that Swoop wants to contract with another affiliate or Subprocessors not listed in the affiliates and Subprocessors list referenced in Section 3.1 above, Swoop will, at least ten (10) days before engaging with the new Subprocessors to access or participate in the processing of Personal Data, add such third party to the List and notify Partner / Customer of that update via email. Partner / Customer may object to such an engagement in writing within ten (10) days of receipt of the notice by Swoop.

3.3

If Partner / Customer reasonably objects to an engagement in accordance with Section 3.2, Swoop shall provide Partner / Customer with a written description of commercially reasonable alternative(s), if any, to such engagement, including without limitation modification to the Services. If Swoop, in its sole discretion, cannot provide any such alternative(s), or if Partner / Customer does not agree to any such alternative(s) if provided, Data Processor may terminate this DPA.

3.4

If Partner / Customer does not object to the engagement of a third party in accordance with Section 3.2 within ten (10) days of notice by Swoop, that third party will be deemed an Authorized Subprocessor for the purposes of this DPA.

3.5

Swoop shall, by way of contract or other legal act under EU Data Protection Law or European Union member state law on personal data protection (including without limitation approved codes of conduct and standard contractual clauses), ensure that every Authorized Subprocessor is subject to obligations regarding the processing of Personal Data that are no less protective than those to which Swoop is subject under this DPA.

3.6

Swoop shall be liable to Partner / Customer for the acts and omissions of Authorized Subprocessors to the same extent that Data Processor would itself be liable under this DPA had it conducted such acts or omissions.

4. Security Measures and Breach Notification

4.1

Swoop will implement and maintain appropriate technical and organizational security measures to meet the requirements of EU Data Protection Law, and in particular, to protect against the occurrence of Security Breaches and to preserve the security, integrity and confidentiality of Personal Data ("Security Measures"). Such Security Measures shall take into account industry standards, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk of a Security Breach and potential impact on the rights and freedoms of natural persons. At a minimum, Swoop shall implement the Security Measures identified in Annex B of this DPA.

4.2

In the event of a security breach involving Partner / Customer's Personal Data, Swoop shall promptly (and in no event later than 48 hours of Swoop becoming aware of such security breach) inform Partner / Customer and provide written notification of the security breach. Such notification shall include a description of the security breach, and a description of the measures taken or proposed to be taken by Swoop to address the security breach, including, where appropriate, measures to mitigate its possible adverse effects.

4.3

Swoop shall cooperate with Partner / Customer regarding the investigation of security breaches and the notification to the Supervisory Authority and Partner / Customer's data subjects regarding such security breaches.

4.4

Swoop shall provide reasonable help with the preparation of data protection impact assessments of the Services as is reasonable in light of the Personal Data that is being processed, and, where necessary, with carrying out consultations with any Supervisory Authority.

4.5

The content and provision of any notification, public/regulatory communication or press release concerning the security breach (Communication) shall be solely at Partner / Customer's discretion. If and to the extent Swoop is referenced by name in any such Communication, Swoop, shall be provided with an opportunity to review and approve the Communication for accuracy, such approval shall not be unreasonably withheld. Such review shall be honoured to the extent that this process would not prevent Partner / Customer to comply with its notification requirements, in particular taking into account the limited time window during which the Partner / Customer must notify the Supervisory Authority. Delay on the Partner / Customer's part is not a basis for not providing Swoop opportunity to review the Communication.

5. Disclosure of Personal Data

5.1

In the event that Swoop receives a subpoena, court order, warrant or other legal demand from a third party (including law enforcement or other public or judicial authorities) seeking the disclosure of Personal Data, Swoop shall not, unless otherwise required by applicable law or advised by counsel that it is so required by applicable law, disclose any information. In such event Swoop shall immediately notify Partner / Customer in writing of such request, and unless otherwise required by applicable law, reasonably cooperate with Partner / Customer if it wishes to limit, challenge or protect against such disclosure, to the extent permitted by applicable laws.

6. Audits & Certification

6.1

If a Supervisory Authority requires an audit of Swoop regarding the processing of Partner / Customer's Personal Data in order to ascertain or monitor Partner / Customer's compliance, Swoop will cooperate with such audit of the controls stated in this DPA. Partner / Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time Swoop expends for any such audit, in addition to the rates for services performed by Swoop

6.2

Upon request, Swoop will provide Partner / Customer a summary of audit reports, Swoop's privacy and security policies and/or other documentation reasonably required by Partner / Customer to verify Swoop's compliance with this DPA.

6.3

If a Report does not provide, in Partner / Customer's reasonable judgment, sufficient information to confirm Swoop's compliance with the terms of this DPA, then Partner / Customer or an accredited third-party audit firm agreed to by both Partner / Customer and Swoop may audit Swoop's compliance with the terms of this DPA during regular business hours, with reasonable advance notice (of at least 15 business days) to Swoop and subject to reasonable confidentiality procedures. Partner / Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time Swoop expends for any such audit, in addition to the rates for services performed by Swoop. Before the commencement of any such audit, Partner / Customer and Swoop shall mutually agree upon the scope, timing, and duration of the audit. Partner / Customer shall promptly notify Swoop with information regarding any non-compliance discovered during the course of an audit. Partner / Customer may not audit Swoop more than once annually, unless otherwise required by a Supervisory Authority or Applicable Privacy Laws.

7. Data Transfers outside the EEA

7.1

Swoop will, at all times, provide an adequate level of protection for the Personal Data, wherever processed, in accordance with the requirements of Applicable Privacy Laws.

7.2

Where Swoop processes Personal Data under this DPA that originates from the EEA and/or Switzerland, Swoop shall comply with (and require any Subcontractor to comply with) the SCCs, which are incorporated by reference and form an integral part of this DPA as Annex D. For the purposes of the descriptions in the SCCs and only as between Swoop and Partner / Customer, Swoop agrees that it is a "data importer" and Partner / Customer is the "data exporter" under the SCCs under the conditions outlined in Annex A and Annex B of this DPA.

8. Data Return and Deletion

8.1

Swoop and Partner / Customer agree that on the termination of the data processing services or upon Partner / Customer's reasonable request, Swoop shall, and shall cause any Subprocessors to, at the choice of Partner / Customer, return all the Partner / Customer Personal Data and copies of such data to Partner / Customer or securely destroy the data.

8.2

Swoop will only retain Partner / Customers information to the extent: (a) Swoop is required by law to maintain such information; or (b) it is needed for Swoop to address any issues or inquiries that Partner / Customer may have. Swoop shall dispose such information by destroying it or erasing it.

8.3

Swoop will provide reasonable assistance to Partner / Customer regarding any requests from Partner / Customer data subjects in respect of access to or the rectification, erasure, restriction, portability, or deletion of Personal Data that Swoop processes for Partner / Customer. In the event that a data subject sends such a request directly to Swoop, it will promptly send such request to Partner / Customer.

9. General Provisions

9.1 Termination

This DPA and the Swoop Contract will terminate simultaneously and automatically with the termination of the Partner / Customer Agreement.

9.2 Limitation of Liability

Partner / Customer's remedies, including those of its affiliates, arising from any breach by Swoop of the terms of this DPA will be subject to any aggregate limitation of liability that applies to Partner / Customer under the Partner / Customer Agreement.

9.3 Governing Law and Dispute Resolution

This document shall be compliant with applicable laws and regulation. To the extent required by applicable Privacy Laws, this DPA shall be governed by the law of the applicable jurisdiction. In all other cases, this DPA shall be governed by the law of the same jurisdiction as the Swoop contract. Any dispute arising out of or relating to this DPA shall be resolved in accordance with the provisions of the Prezi Business Terms of Use, unless mandatory regulations of Applicable Privacy Laws provide otherwise.

9.4 Additional Terms

All issues not provided for by this DPA shall be regulated by the Swoop contract and the Prezi Business Terms of Use.

Annex A: Details of the Processing

Categories of Data Subjects:

Swoop users (Natural person, adult)

Purpose of the transfer:

Providing Swoop Services outlined in the Prezi Business Terms of Use.

Categories of Personal Data:

• Account Information
• Payment Information
• Support Information
• Content Information (User content)

Annex B: Security Measures

Description of the technical and organizational security measures implemented by Swoop:

1. Physical Access Controls

Swoop implements suitable measures in order to prevent unauthorized persons from gaining physical access to systems (namely database and application servers and related hardware) where Data are processed or used. This is accomplished by:

• All production infrastructure responsible for processing and storing Partner / Customer data is within a physically secure data center provided by Amazon Web Services (AWS). AWS has strict security measures deployed and described in the their security & compliance white papers which can be found at https://aws.amazon.com/whitepapers/#security. Swoop employees does not have physical access to the data center facilities.
• The Swoop office buildings are protected with security guards during the night, while certain areas are also equipped with closed-circuit cameras.
• Employees need to use badges, which are required to access the Swoop office area.
• Swoop guests need to register themselves in the reception area.
• Swoop has implemented a physical and visitor access policy to protect company assets.

2. Electronic Access Controls

Swoop implements suitable measures (including industry standard encryption) to prevent its systems from being used by unauthorized persons. This is accomplished by:

• Identification of all authorized user to Swoop's systems.
• Access to data processing systems is logged, monitored, and tracked.
• Authorized users are required to have a password set up on their laptops and workstations. Password complexity and full disk encryption is enforced. Screen lock after a certain time period is also enforced.
• Multi-factor authentication for accessing high risk systems is enforced.
• Allowing only key-based authentication for SSH access.
• Industry standard TLS encryption between client to server and server to server communication.

3. Data Management Controls

Swoop ensures that the persons entitled to use its systems are only able to access the data within the scope and to the extent covered by their respective access permission (authorization) and that Personal Data cannot be read, copied or modified or removed without authorization. This is accomplished by:

• Employee policies and training in respect of each employee's access rights and management of Personal Data.
• Effective and measured disciplinary action against individuals who access Personal Data without authorization.
• Automated monitoring of systems access to Personal Data with automatic thresholds to alert on suspicious access.
• Release of data to only authorized persons.

4. Data Transfer Controls

Swoop implements suitable measures to prevent Personal Data from being read, copied, altered or deleted by unauthorized parties during the transfer of data. This is accomplished by:

• Use of firewall to protect the gateways and pipelines through which the data travels.
• Industry standard TLS encryption between client to server and server to server communication.
• Avoiding to store personal data on mobile storage media for transportation purposes and on laptops or other mobile devices or only with strong encryption protection.
• Employee policies and training in respect of data management and transfer of Personal Data.

5. Data Integrity Controls

Swoop implements suitable measures to ensure that it is possible to check and establish whether and by whom Personal Data have been added, modified or deleted in data processing systems. This is accomplished by:

• Identification and authentication of Authorized Persons with rights to input, as well as for the reading, alteration and deletion of stored data.
• Logging and tracking of authorization by Swoop personal in the event of an official request of adding, modifying or deleting data.
• Only Authorized Persons are allowed to "impersonate" Partner / Customers upon incidents or in relation to a support request. Impersonation requires providing a business reason. The provided business reasons are reviewed periodically.

6. Control Verification and Auditing

Swoop implements suitable measures to ensure that, in the case of commissioned processing of Personal Data, the data are processed strictly in accordance with the instructions of the Partner / Customer. This is accomplished by:

• Upon request Swoop will provide Partner / Customer a summary of audit Reports, Swoop's privacy and security policies and/or other documentation reasonably required by Partner / Customer to verify Swoop's compliance with this DPA.
• In the event the Reports does not provide, in Partner / Customer's reasonable judgment, sufficient information to confirm Swoop's compliance with the terms of this DPA, then Partner / Customer or an accredited third-party audit firm agreed to by both Partner / Customer and Swoop may audit Swoop's compliance with the terms of this DPA during regular business hours, with reasonable advance notice (of at least 15 business days) to Swoop and subject to reasonable confidentiality procedures. Partner / Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time Swoop expends for any such audit, in addition to the rates for services performed by Swoop. Before the commencement of any such audit, Partner / Customer and Swoop shall mutually agree upon the scope, timing, and duration of the audit. Partner / Customer shall promptly notify Swoop with information regarding any non-compliance discovered during the course of an audit. Partner / Customer may not audit Swoop more than once annually.

7. Availability Controls

Swoop implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss, and that Swoop is able to restore the availability and access to Personal Data in a timely manner in the event of a Security Breach. This is accomplished by:

• Services' architecture upholds industry best practices of infrastructure redundancy, resiliency and rapid recovery.
• Services are actively monitored by tracking uptime and overall availability.
• Automatic alerts are triggered when service interruption is detected.
• Services are deployed in multiple data centers for redundancy.
• Backup is stored in another region and available for restore in case of failure.

8. Data Isolation Controls

Swoop implements suitable measures to ensure that data collected for different purposes can be processed separately. This is accomplished by:

• Access to data is separated through application security for the appropriate users.
• Data is stored, where reasonably possible, in separate databases to fulfil the individual purpose of processing and/or function.
• Reports and batch processing are designed for only specific purposes and functions, so data collected for specific purposes is processed separately.

9. Quality Controls

• Swoop regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures it has in place for ensuring the security of its processing of Personal Data.

Annex C: Authorized Subprocessors

This is the current list of Authorized Subprocessors as at the date of this DPA. Swoop is not responsible for keeping updated the table below. An updated list will be maintained online under Authorized Processors List Page.

Annex D: Standard Contractual Clauses

– EU Standard Contractual Clauses

COMMISSION IMPLEMENTING DECISION (EU) 2021/914

of 4 June 2021

on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council

SECTION I

Clause 1 – Purpose and scope

Clause 2 – Effect and invariability of the Clauses

Clause 3 – Third-party beneficiaries

Clause 4 – Interpretation

Clause 5 – Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6 – Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7 – Docking clause

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8 – Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Instructions

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter 'sensitive data'), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter 'onward transfer') if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

Clause 9 – Use of sub-processors

Clause 10 – Data subject rights

Clause 11 – Redress

Clause 12 – Liability

Clause 13 – Supervision

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14 – Local laws and practices affecting compliance with the Clauses

Clause 15 – Obligations of the data importer in case of access by public authorities

15.1 Notification

15.2 Review of legality and data minimisation

SECTION IV – FINAL PROVISIONS

Clause 16 – Non-compliance with the Clauses and termination

Clause 17 – Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.

Clause 18 – Choice of forum and jurisdiction

APPENDIX

EXPLANATORY NOTE:
It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can be achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

ANNEX I

A. LIST OF PARTIES

Data exporter(s):

[Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

Data importer(s):

[Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Swoop users (Natural person, adult)

Categories of personal data transferred

• Contact and Account Information,
• Payment Information,
• Support Information (if applicable),
• Content Information (if applicable).

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Not Applicable, no sensitive data will be transferred to Swoop.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous

Nature of the processing

The nature of the processing may include the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

Purpose(s) of the data transfer and further processing

Operation and Provision of the Swoop Services to the relevant Swoop Users of the Partner / Customer.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

As set out in Section 8 of the DPA.

Swoop. disposes of Personal Data by

1. destroying it,
2. erasing it, or
3. anonymizing it.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Swoop. may use others to help providing its Services. This may include application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, fraud detection. Third-party service providers may have access to Swoop Users' personal data as reasonably necessary to perform these tasks on Swoop.'s behalf and are obligated not to disclose or use it for other purposes. All Swoop service providers must meet Swoop.'s security and privacy standards before they gain access to any of Swoop Users' information.

Further, the matter, nature and duration of the processing is the same as Swoop's data processing itself.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

Name: Data Protection Commission

21 Fitzwilliam Square South

Dublin 2 D02 RD28

Country: Ireland

Address: Postfach 3163, 65021 Wiesbaden

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

• Measures of encryption of personal data,
• Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
• Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
• Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing
• Measures for user identification and authorisation
• Measures for the protection of data during transmission (encryption in transit)
• Measures for the protection of data during storage (encryption at rest)
• Measures for ensuring physical security of locations at which personal data are processed
• Measures for ensuring events logging (extended security logging, preserving audit trails)
• Measures for ensuring system configuration, including default configuration
• Measures for internal IT and IT security governance and management (based on SOC 2/COSO, NIST CSF, and PCI/DSS)
• Measures for certification/assurance of processes and products (SOC 2 Type 2)
• Measures for ensuring data minimisation
• Measures for ensuring data quality
• Measures for ensuring limited data retention
• Measures for ensuring accountability
• Measures for allowing data portability and ensuring erasure
• Measures set out in Annex B (Security Measures) of the DPA

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

Further, measures specific to transfers to Swoop's sub-processors are the same as Swoop's own technical and organisational measures.

ANNEX III

LIST OF SUB-PROCESSORS

Please see "Annex C: Authorized Subprocessors" of this Data Processing Agreement.

Annex E: AI Sub-Processing and Data Use Addendum

This Addendum forms part of and supplements the Data Processing Agreement ('DPA') between the parties. Except as expressly modified herein, the DPA remains in full force and effect.

1. Roles of the Parties

For the purposes of this Addendum, Customer acts as a Controller (or Processor, as applicable) and Swoop acts as a Processor. Any AI Sub-Processor (including OpenAI) engaged by Swoop shall act as a Sub-Processor within the meaning of Article 28 of the GDPR.

2. Appointment of Sub-Processors (Article 28(2)–(4))

Customer provides general written authorization for Swoop to engage AI Sub-Processors to support AI functionality.

Swoop shall:

• enter into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those set out in this DPA, in accordance with Article 28(4);
• remain fully liable for the performance of its Sub-Processors' obligations; and
• inform Customer of any intended changes concerning the addition or replacement of Sub-Processors, thereby giving Customer the opportunity to object on reasonable data protection grounds.

3. Processing Instructions and Purpose Limitation (Article 28(3)(a))

Swoop shall ensure that AI Sub-Processors process Customer Data:

• only on documented instructions from Swoop (as Processor) acting on behalf of Customer; and
• strictly for the purpose of providing the AI-enabled Services.

AI Sub-Processors shall not:

• process Customer Data for their own purposes;
• disclose Customer Data to unauthorized third parties; or
• use Customer Data beyond what is necessary to provide the Services.

4. Prohibition on Model Training and Secondary Use

AI Sub-Processors shall not use Customer Data to train, retrain, fine-tune, or otherwise improve any machine learning or artificial intelligence models, nor for product development or analytics unrelated to the Services, unless expressly authorized in writing by Customer.

For the avoidance of doubt, Customer Data is used solely for inference and service provision, not for model training.

5. Confidentiality (Article 28(3)(b))

Swoop shall ensure that persons authorized to process Customer Data (including Sub-Processor personnel) are subject to confidentiality obligations, whether contractual or statutory.

6. Security of Processing (Article 28(3)(c), Article 32)

Swoop shall implement, and shall require its Sub-Processors to implement, appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• encryption of Customer Data in transit and, where appropriate, at rest;
• measures to ensure ongoing confidentiality, integrity, availability, and resilience;
• access controls based on least privilege; and
• regular testing and evaluation of security measures.

7. Assistance to Controller (Article 28(3)(e)–(f))

Taking into account the nature of processing, Swoop shall assist Customer, including via its Sub-Processors, in:

• responding to data subject requests under Chapter III GDPR; and
• ensuring compliance with obligations relating to security, breach notification, DPIAs, and prior consultation.

8. Personal Data Breach Notification (Article 33)

Swoop shall notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Data processed by an AI Sub-Processor and shall provide sufficient information to allow Customer to meet its notification obligations.

9. Data Retention and Deletion (Article 28(3)(g))

At the choice of Customer, Swoop shall ensure that AI Sub-Processors:

• delete or return all Customer Data upon termination of the Services; and
• delete existing copies unless retention is required by Union or Member State law.

Retention shall in all cases be limited to what is strictly necessary for service provision.

10. Audit and Demonstration of Compliance (Article 28(3)(h))

Swoop shall make available to Customer all information necessary to demonstrate compliance with this Addendum and shall allow for and contribute to audits or inspections, including those conducted by Customer or an independent auditor mandated by Customer, subject to reasonable confidentiality and security controls.

11. International Data Transfers (Chapter V GDPR)

Where Customer Data is transferred outside the EEA/UK, Swoop shall ensure that such transfers are subject to appropriate safeguards, including Standard Contractual Clauses or other lawful transfer mechanisms, and shall ensure that Sub-Processors provide an equivalent level of protection.

12. Order of Precedence

In the event of any conflict between this Addendum and other terms governing AI functionality, this Addendum shall prevail with respect to processing of Customer Data by AI Sub-Processors.