Subscriber and PRIOS agree as follows:

1. Subscriber Instructions.

Subscriber instructs PRIOS to Process (defined below) Your Data as necessary to provide PrinciplesUs products or services and as otherwise authorized or permitted under this DPA and the Service Terms, including as specified in Schedule 1 (Scope of Processing).  Additionally, Subscriber authorizes PRIOS to Process information that cannot reasonably be linked to or associated with Subscriber or any data subject (“Deidentified Data”) to improve PrinciplesUs products or services. PRIOS will (a) take reasonable measures to ensure the Deidentified Data cannot be associated with a data subject and (b) publicly commit to maintain and use Deidentified Data in deidentified form and not attempt to reidentify Deidentified Data except to assess the sufficiency of the deidentification process. This DPA, the Service Terms, and any instructions provided by Subscriber through configuration tools made available by PRIOS constitute Subscriber’s documented instructions regarding PRIOS’s Processing of Your Data.  Additional instructions provided by Subscriber (if any) require prior written agreement by Subscriber and PRIOS. As between Subscriber and PRIOS, all  of Your Data is the sole and exclusive property of Subscriber.

2. Subscriber Role and Responsibilities.

With respect to Your Data, Subscriber is a controller and/or business as each of those terms are defined under Applicable Law. Subscriber will comply with the obligations applicable to it under Applicable Law with respect to the Processing of Your Data. Subscriber will have sole responsibility for the legality of Your Data and the means by which Subscriber acquired Your Data and ensure that Subscriber has provided all notices, obtained all consents and has all necessary rights to provide Your Data to PRIOS for PRIOS to Process in accordance with this DPA. Subscriber is responsible for responding to requests from data subjects to exercise rights under Applicable Law regarding Your Data (each, a “Data Subject Request”). Subscriber will inform PRIOS of any Data Subject Request that PRIOS must comply with and provide the information necessary for PRIOS to comply with the request.

3. PRIOS Role and Responsibilities.

With respect to Your Data, PRIOS is a processor and/or service provider as each of those terms are defined under Applicable Law. “Process” or “Processing” means any operation or set of operations which is performed on Your Data, whether or not by automated means, such as the access, collection, use, storage, disclosure, dissemination, combination, recording, organization, structuring, adaption, alteration, copying, transfer, retrieval, consultation, disposal, restriction, erasure and/or destruction of Your Data. As a part of providing PrinciplesUs products or services:

(a) PRIOS will:

(i) Process Your Data solely: (A) in a manner consistent with documented instructions provided by Subscriber as specified in Section 1, including with regard to transfer of Your Data to a third country; and (B) as required by all data protection and privacy laws, rules, and regulations applicable to PrinciplesUs, including but not limited to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the GDPR as incorporated into United Kingdom law by the Data Protection 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR”), and the California Consumer Privacy Act (“CCPA”) (collectively, “Applicable Law”);

(ii) to the extent permitted by Applicable Law, amend, correct, or erase Your Data at Subscriber’s written request and provide a means for Subscriber to update and make accurate Your Data Processed by PRIOS;

(iii) to the extent permitted by Applicable Law, notify Subscriber of any third party request (whether a Data Subject Request or otherwise) to (A) restrict the Processing of Your Data; (B) port Your Data to a third party; or (C) access, rectify, or erase Your Data. PRIOS will use commercially reasonable efforts to assist Subscriber, at Subscriber’s reasonable written request, in complying with Subscriber’s obligations under Applicable Law to respond to requests or complaints directed to Subscriber with respect to Your Data Processed by PRIOS, to the extent that Subscriber does not have access to such Your Data through Subscriber’s use of PrinciplesUs;

(iv) taking into account the nature of the Processing and the information available to PRIOS and at the written request of Subscriber, reasonably cooperate and assist Subscriber in conducting a data protection impact assessment and ensuring Subscriber’s other compliance with Applicable Law;

(v) ensure that PRIOS personnel Processing Your Data are subject to obligations of confidentiality;

and

(vi) keep all Your Data compartmentalized or otherwise logically distinct from other information of PRIOS or its personnel, suppliers, customers or other third parties.

(b) Without limiting the instructions under Section 1, PRIOS will not:

(i) Process Your Data for any purpose other than the specific purpose of providing PrinciplesUs products of services, including any Processing of Your Data for any commercial purpose, other than providing PrinciplesUs products or services;

(ii) Process any Your Data outside the direct business relationship between Subscriber and PRIOS;

(iii) sell or share (as defined by Applicable Law) Your Data;

(iv) ) combine Your Data with Personal Information Company receives from individuals or other customers, except as permitted by Applicable Law

or

(v) except as otherwise provided in this DPA with respect to Subprocessors, disclose Your Data to any other entity without first, except to the extent prohibited by Applicable Law, notifying Subscriber of the anticipated disclosure (so as to provide Subscriber the opportunity to oppose the disclosure and obtain a protective order or seek other relief); or obtaining Subscriber’s prior consent to the disclosure.

PRIOS will use commercially reasonable efforts to inform Subscriber if PRIOS becomes aware or reasonably suspects that Subscriber’s instructions regarding the Processing of Your Data may breach any Applicable Law. Notwithstanding the foregoing, Subscriber acknowledges and agrees that such notification will not constitute a general obligation on the part of PRIOS to monitor or interpret the laws applicable to Subscriber and such notification will not constitute legal advice to Subscriber.

4. Subprocessors.

PRIOS will not engage another processor to Process Your on behalf of Subscriber for the purpose of fulfilling PRIOS’ obligations with respect to the provision of PrinciplesUs under the Service Terms (a “Subprocessor”) without authorization from Subscriber. Subscriber hereby provides its general written authorization for and specifically consents to PRIOS’ engage of the Subprocessors listed at https://principlesus.com/principlesus-list-of-subprocessors/ or its successor URL. PRIOS will notify Subscriber of the appointment of any new Subprocessors by updating the list available at such URL and sending Subscriber an email concerning such updates at least thirty (30) days prior to engaging a new Subprocessor. Subscriber may object to new Subprocessors within ten (10) business days of such notice by sending an email to support@principles.com. If Subscriber objects to the new Subprocessors, PRIOS and Subscriber will cooperate in good faith to resolve Subscriber’s objection. If the parties are unable to resolve Subscriber’s objection within ten (10) days, then either party may terminate the Service Terms only with respect to those aspects of PrinciplesUs products or services that PRIOS indicates cannot be provided without the objected-to Subprocessor. We will ensure that Subprocessors are bound by written agreements that require them to provide at least the level of data protection required of us by this DPA. PRIOS will remain liable to you for the performance of any Subprocessors.

5. Data Transfers.

5.1 Overview. If Your Data that originates in the European Economic Area (“EEA“), the United Kingdom (“UK“) or Switzerland is transferred by Subscriber to PRIOS for Processing in a country not subject to an adequacy decision in accordance with Applicable Law (“Data Transfer”), the parties will conduct such Data Transfer in accordance with this Section 5.  Any Data Transfer will be conducted pursuant to the SCCs, as defined below, which are incorporated into the DPA by this reference. If an alternative transfer mechanism for legitimizing Data Transfers (an “Alternative Mechanism”)  becomes available during the term of this DPA, and PRIOS notifies Subscriber that Data Transfers can be conducted in compliance with Applicable Law pursuant to the Alternative Mechanism, the parties will rely on the Alternative Mechanism to legitimize Data Transfers instead of the provisions that follow.

5.2 Transfers Subject to the UK GDPR. For any of Your Data subject to the UK GDPR, defined below, the Data Transfer will be conducted pursuant to the UK IDTA, defined below, which is  hereby incorporated by reference.  The information needed to complete the tables to the UK IDTA is provided in the Schedules to this DPA.  

5.3 Transfers Subject to Swiss Data Protection Law. For any of Your Data subject to the Swiss Federal Act on Data Protection of 19 June 1992 (the “FADP”),   any Data Transfers will be conducted pursuant to the SCCs, defined below, with the following modifications:

(a) the competent supervisory authority in Annex I.C under Clause 13 shall be the Federal Data Protection and Information Commissioner insofar as the data transfer is governed by the FADP;

(b) references in the SCCs Module 2 to a “Member State” or “EU Member State” will not be read to prevent data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence; and 

(c) references to “GDPR” in the SCCs will be understood as references to the FADP.

5.4 Details for the Standard Contractual Clauses and UK Addendum. The parties agree to comply with the general clauses with Module Two (Controller-to-Processor) of the SCCs, defined below, (which are deemed executed as of the effective date of this DPA), with Subscriber is the “Data Exporter” or “Exporter” and PRIOS is the “Data Importer” or “Importer”.

“SCCs” means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on SCCs for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Text with EEA relevance), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914, as may be replaced or superseded by the European Commission. The parties make the following choices for implementing the SCCs:

(a) the option under Section I, Clause 7 shall not apply;

(b) the parties select option 2 in Section II, Clause 9 and agree on ten (10)business days as the notice period for additions or replacements of new Subprocessors;

(c) the optional language in Section II, Clause 11(a) is omitted;

(d) the parties select option 2 of Section II, Clause 17 and specify governing law as the law of Ireland;

(e) for Section II, Clause 18(b), disputes will be resolved in the courts of Ireland;

(f) details in Schedule 1 of this DPA will be used to complete Annex I of the SCCs Module II and Tables 1, 3 and 4 of the UK Addendum;

(g) details of Section 6 and Schedule 2 of this DPA will be used to complete Annex II of the SCCs Module 2 and Table 3 of the UK Addendum;

(h) details in Section 4 of this DPA will be used to complete Annex III of the SCCs Module 2 and Table 3 of the UK Addendum; and

(i) any audits required under the SCCs Module 2 will be conducted pursuant to Section 7 of this DPA.

“UK GDPR” means the GDPR as incorporated into United Kingdom law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced).  

“UK IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf. Neither party can terminate the UK IDTA pursuant to Table 4 and Section 19 thereof without the written consent of the other.

6. Security Safeguards.

PRIOS will implement and maintain appropriate technical and organizational measures consistent with industry standards designed to protect the confidentiality, integrity, and availability of InformationYour Data, protect Your Data against Security Breach (defined below), and provide the level of protection required by Applicable law in accordance with in Schedule 2 (Security Measures), which may be amended without reducing the level of security provided.

7. Audits.

Taking into account the nature of Processing and the information available to PRIOS, PRIOS will provide commercially reasonable efforts to assist Subscriber in Subscriber’s efforts to comply with Subscriber’s obligations to secure Your Data by providing the information and assistance described in Section 7. Subject to the forthcoming, PRIOS will make available to Subscriber information necessary to demonstrate compliance with its obligations in this DPA. Any such information, including but not limited to Audit Information, will be deemed the Confidential Information of PRIOS under the Service Terms. Where required by Applicable Law, and no more than once per calendar year, at Subscriber’s reasonable request and with advance written notice, PRIOS will make available to Subscriber records and information demonstrating its compliance with this DPA (“Audit Information”) and allow an independent third party, agreed to by the parties, to conduct an audit to verify such compliance on behalf of Subscriber. Subscriber acknowledges and agrees that Subscriber will exercise its audit rights under this DPA by instructing PRIOS to comply with the audit measures described in this Section. Upon written request and no more than one per calendar year, PRIOS will use commercially reasonable efforts to provide (on a confidential basis) a summary copy of our penetration testing report(s) to Subscriber as well as written responses (on a confidential basis) to reasonable requests for Audit Information. 

8. Security Breach.

If PRIOS becomes aware of any actual Security Breach (defined below), PRIOS will take commercially reasonable efforts to, without undue delay: (a) notify Subscriber of the Security Breach and any third-party legal processes relating to the Security Breach; and (b) help Subscriber investigate, remediate, and take any action required under Applicable Law regarding the Security Breach. “Security Breach” means a breach of security leading to any unlawful or accidental loss, destruction, alteration, or unauthorized Processing of Your Data under PRIOS’s possession or control, that is notifiable under Applicable Law. The obligations in this Section do not apply to incidents that are caused by Subscriber or Subscriber’s personnel or users or to unsuccessful attempts or activities that do not compromise the security of Your Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems. PRIOS’s obligation to notify a Security Breach under this Section is not and will not be construed as an acknowledgement by PRIOS of any fault or liability of PRIOS with respect to such Security Breach.

9. Return of Destruction of Personal Information.

Upon written request by Subscriber or when PRIOS no longer is required to Process Your Data to fulfill its obligations under the Service Terms, PRIOS will return all Your Data to Subscriber or destroy all Your Data and all copies thereof, except to the extent that PRIOS is required under Applicable Law to keep a copy of Your Data for a specified period of time. The certification of deletion contemplated by Section 8.5 of the SCCs will be provided on Subscriber’s written request.

10. Limitation of Liability.

Each party and each of their Affiliates’ liability, taken in aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the ‘Limitation of Liability’ section of the Service Terms and any reference in such section to the liability of a party means aggregate liability of that party and all of its Affiliates under the Service Terms (including this DPA).  In no event shall either party’s liability be limited with respect to any individual’s data protection rights under Applicable Law.