Data Processing Addendum

Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Virtik USA, Inc. ("Virtik") and the customer entity identified in that agreement ("Customer") for Customer's use of the Virtik platform (the "Agreement").

1. Definitions

1.1 "Applicable Data Protection Law" means all laws relating to the processing of Personal Data applicable to a party's performance, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

1.2 "Personal Data" means any information relating to an identified or identifiable natural person that is processed under the Agreement. Where CCPA applies, it includes "personal information" as defined there.

1.3 "Customer Personal Data" means Personal Data contained in Customer Data as defined in the Agreement, processed by Virtik on Customer's behalf.

1.4 "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in GDPR. "Business", "Service Provider", "Contractor", "Sell" and "Share" have the meanings given in CCPA.

1.5 "Subprocessor" means a third party engaged by Virtik to process Customer Personal Data.

1.6 "Security Incident" has the meaning given in Section 1.17 of the Terms, applied to Customer Personal Data. Whether Virtik was at fault is not part of the definition.

1.7 "Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Decision 2021/914.

1.8 "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

1.9 "Sensitive Data" means special categories of personal data under GDPR Article 9, data relating to criminal convictions under Article 10, and "sensitive personal information" under CCPA.

1.10 Capitalized terms that this DPA uses but does not define, including Terms (the Terms of Service and Online SaaS Subscription Agreement, LEG-001), Administrator, Order, Order Form, Master Services Agreement, General Cap, Enhanced Cap and Provider Order, have the meanings given in the Agreement, and in the Terms where the Agreement does not define them.

2. Scope and Incorporation

2.1 This DPA applies to Virtik's Processing of Customer Personal Data on Customer's behalf.

2.2 This DPA is incorporated into and forms part of the Agreement. Where Customer contracts online, this DPA applies without separate signature. Where Customer requires an executed copy, Virtik will provide one on request.

2.3 If Customer has entered a superseding negotiated data processing agreement executed by both parties, that agreement governs.

3. Roles of the Parties

3.1 Three distinct roles apply, and conflating them is the most common error in agreements of this kind. Each is stated separately below.

3.2 Customer-controlled operational data — Virtik is Processor / Service Provider. For camera and video data, audio where Customer enables it, still images, detections and detection metadata, alerts, spatial models and Virtual Sites, personnel and patrol records, geolocation, incident records and communications content within Customer's tenant:

(a) Customer is the Controller and Business. Customer decides which cameras exist, their fields of view, whether audio is captured, who is monitored and when, what alerts fire, who may see what, and retention.

(b) Virtik is the Processor and Service Provider, acting only on Customer's documented instructions.

(c) Customer is responsible for establishing a lawful basis, providing required notices, obtaining required consents, and completing any assessment or consultation Applicable Data Protection Law requires. Virtik does not determine the purposes of this Processing and does not assess the lawfulness of Customer's configuration.

3.3 Account, billing, security and business-operations data — Virtik is an independent Controller. For Customer's account records, authorised user account data, billing and tax records, support correspondence (other than attachments and other content that contain Customer Data, which Virtik Processes as Processor under Section 3.2), and Virtik's own security telemetry and audit records, Virtik acts as an independent Controller for the purposes of providing, securing, billing and supporting the service and meeting its own legal obligations. That Processing is governed by the Virtik Privacy Policy (LEG-002) and not by this DPA's Processor obligations.

3.4 Virtik's security telemetry is generated for Virtik's own security purposes and is not Customer-instructed Processing, even where it concerns activity within Customer's tenant.

3.5 Security Provider deployments. Where Customer is an approved Security Provider that uses the Service for its own customers, Customer may itself be a Processor for its customer. Virtik is then Customer's Subprocessor, Customer remains responsible to Virtik for passing on its customer's instructions on terms consistent with this DPA, and Module Three applies where the SCCs apply, as Section 16.2 states. Security Provider commercial activation requires Virtik's written approval and a Provider Order that Virtik has executed (Section 5.8 of the Terms). This Section applies to a Customer only under such an executed Provider Order, and nothing in this DPA represents that a Provider Order template or automated activation exists.

3.6 CCPA. With respect to Processing under Section 3.2, Virtik is a Service Provider. Virtik will not: (a) Sell or Share Customer Personal Data; (b) retain, use or disclose it except to perform the services, or as otherwise permitted by CCPA; (c) retain, use or disclose it outside the direct business relationship; or (d) combine it with personal information received from another source, except as CCPA permits. Virtik certifies that it understands and will comply with these restrictions.

3.7 Neither party is a joint controller with the other, and nothing in the Agreement creates joint control.

4. Customer Instructions

4.1 Virtik will Process Customer Personal Data only: (a) as set out in the Agreement, this DPA and Schedule 3; (b) as further instructed in writing by Customer where consistent with the Agreement; and (c) as required by law.

4.2 Customer's use and configuration of the platform constitutes its instructions. Additional instructions outside the platform's functionality are subject to agreement, including as to cost.

4.3 Virtik will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance of that instruction until it is amended or confirmed. This is not a legal opinion and does not transfer to Virtik the Controller's obligation to assess lawfulness.

4.4 Customer warrants that its instructions comply with Applicable Data Protection Law and that it has all necessary rights, notices and lawful bases.

4.5 Sensitive Data. Customer must not instruct Virtik to Process Sensitive Data unless Customer has confirmed a lawful basis and satisfied every additional condition applicable to it. Biometric Processing is additionally restricted by the Agreement and the AI Use and Human Oversight Terms (LEG-007). Virtik does not enable biometric identification, verification or facial recognition by default or by purchase of a Plan, and does not represent that the Service performs biometric identification.

5. Confidentiality and Personnel

5.1 Virtik will treat Customer Personal Data as Customer's Confidential Information.

5.2 Virtik will ensure that personnel with access are subject to a duty of confidentiality that survives termination of their engagement.

5.3 Virtik makes no representation in this DPA about how access to production systems is granted, reviewed or recorded, and does not state that it keeps access records. The only audit records that Virtik states are those that Section 6.2 and Schedule 6 describe (Security Addendum Sections 2.1 and 3.1).

5.4 Virtik makes no representation in this DPA about personnel screening.

5.5 Virtik makes no representation in this DPA about the cadence of personnel training.

6. Security Obligations

6.1 Virtik will implement the technical and organisational measures that Schedule 6 and the Security Addendum (LEG-015) state, to protect Customer Personal Data, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of Processing. Except as the next sentence provides, a measure that those documents do not state is not represented, and the matters that the Security Addendum lists as not represented limit this Section. Where GDPR, the UK GDPR or Swiss data protection law applies to the Processing, Virtik will also take the measures that Article 32 of GDPR (or the equivalent provision of that law) requires of a Processor, and neither Schedule 6 nor the Security Addendum limits that obligation or states that every such measure is in place.

6.2 The measures that the Service's implementation and configuration provide include multi-tenant isolation, role-based access control, HTTPS and HTTP Strict Transport Security configured for its web applications, multi-factor authentication that Virtik makes available to users of the Service, audit records of certain administrative and security events (the Service's client-facing database roles cannot read, change or delete the main audit table, and Virtik does not represent that audit records are complete, tamper-proof or immutable as against privileged Virtik access), and least-privilege database grants for the client-facing roles. They do not represent the deployed state of any particular environment.

6.3 This DPA does not state a cryptographic standard, key-management practice, hosting region, or backup frequency, retention or restoration objective, and Virtik makes no representation about them or about whether, how often or for how long backups are kept. Deleted data may persist in any backup until it expires. This Section 6.3 does not limit the obligation in the last sentence of Section 6.1.

6.4 Virtik does not currently hold SOC 2 attestation, ISO 27001 certification, HIPAA compliance certification, or FedRAMP authorization, and makes no representation that it does. Where Customer's own obligations require a certification Virtik does not hold, Customer is responsible for determining whether the platform is appropriate for its use.

6.5 Virtik may update its measures provided the level of protection is not materially reduced.

6.6 Customer is responsible for the security of Customer Systems, credentials, permission configuration, device management, and the choices it makes about what data enters the platform and who may see it.

7. Subprocessors

7.1 Customer generally authorises Virtik to engage Subprocessors to Process Customer Personal Data.

7.2 Virtik will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains responsible for its Subprocessors' performance.

7.3 The current list is maintained at /legal/subprocessors (LEG-009). It classifies the third parties that the Service's code integrates with as Virtik-managed subprocessors, infrastructure providers and the payment processor, providers and connectors that Customer supplies, and services whose use Virtik has not verified. Only the first group is subject to Section 8. A vendor listed in Section 1.3 of the list is listed without a stated role, and Section 8 applies to a Subprocessor before it Processes Customer Personal Data. The list states no processing location, transfer mechanism or agreement status.

7.4 The Subprocessor List states no agreement status for any entry, as Section 7.3 states. Virtik will impose on each Subprocessor that Processes Customer Personal Data on Virtik's behalf the obligations stated in Section 7.2.

8. Subprocessor Notice and Objection

8.1 Virtik will give Customer at least 30 days' prior notice before a new or replacement Material Subprocessor Processes Customer Personal Data. "Material Subprocessor" means a Subprocessor that hosts, stores, analyses or otherwise Processes the content of Customer Personal Data in order to provide the Service to Customer. It does not include a Subprocessor that receives only account, contact or technical data (such as request metadata) needed to deliver, secure or bill for the Service, or a third-party service that Customer itself connects or directs.

8.2 Virtik gives the notice by email to Customer's Administrator, or to the contact designated in the Order Form, and updates the Subprocessor List (LEG-009) to show the change by the date on which it takes effect, and the Subprocessor List applies to Customer in the version that is current under this Section 8, without a new acceptance and, under a Master Services Agreement or an Order Form, without an amendment (Section 2.7 of the Terms states the same rule for a Customer that contracts online). The notice will identify the Subprocessor, the Processing it will perform and the date from which it will Process Customer Personal Data. Virtik does not offer a subscription or other automated notification service for these changes.

8.3 Customer may object by written notice to privacy@virtik.ai within 15 days after Virtik's notice, stating reasonable and legitimate data protection grounds for the objection. A written notice under Section 8.3, 8.4 or 8.6 sent to that address satisfies Section 26.1 of the Terms (or Section 13.1 of the Master Services Agreement).

8.4 On a timely objection the parties will discuss it in good faith. Virtik may (a) not proceed with the change as to Customer, or (b) propose a change that addresses the objection. If the objection is not resolved within 30 days after Virtik receives it (the "Resolution Period"), Customer may, by written notice given within 15 days after the Resolution Period ends, terminate the affected Service component or, if that component cannot be separated from the rest of the Service, the affected Order, effective on a date before the new or replacement Material Subprocessor begins to Process Customer Personal Data. Virtik will not allow that Subprocessor to begin to Process the objecting Customer's Customer Personal Data until the objection is resolved, until the 15-day period for Customer's notice has ended without a notice, or until the termination has taken effect. On a termination under this Section 8.4, Customer pays no early-termination charge and is not liable for Fees allocable to the period after the effective termination date, and Virtik will refund the prepaid Fees allocable to that period for the terminated component, calculated and paid as Section 16.19 of the Terms provides; the Fees allocable to the terminated component are determined by Virtik acting reasonably and in good faith by reference to the price list or the Order for that component, and where the component cannot be priced separately the whole affected Subscription is the terminated component. That refund is an express exception to the general rule in Section 16.6 of the Terms (Section 16.6(g)). Termination under this Section 8.4, with that refund, is Customer's only remedy for the objection and for Virtik's proceeding with the change; it does not limit a remedy for a breach of this DPA or a right that Applicable Data Protection Law or the SCCs give Customer or a Data Subject.

8.5 Absence of a timely objection is deemed approval of that change.

8.6 Emergency replacement. Subject to Section 16.5(b), where Virtik must replace a Subprocessor urgently to maintain the security or continuity of the Service, Virtik may give shorter notice than Section 8.1 requires and will give notice as soon as practicable, and the replacement Subprocessor may begin to Process Customer Personal Data before the Resolution Period ends. Customer may object within 15 days after that notice on the grounds in Section 8.3. If the objection is not resolved within 30 days after Virtik receives it, Customer may terminate the affected Service component (or the affected Order if it cannot be separated) by written notice, effective on the date stated in the notice, and the charge, release and refund in Section 8.4 apply.

8.7 Other Subprocessors. Virtik will reflect the engagement of any Subprocessor that is not a Material Subprocessor in the Subprocessor List before that Subprocessor Processes Customer Personal Data. No termination right under Section 8.4 applies to a Subprocessor that is not a Material Subprocessor. Where the SCCs apply, Virtik gives Customer written information about every addition or replacement of a Subprocessor on the list at least 30 days in advance, as Section 16.5(b) states; Customer may object to that change under Section 8.3 within 15 days after that information, the parties will discuss the objection in good faith, and Virtik will not begin to Process that Customer's Customer Personal Data with that Subprocessor under the SCCs before that 30-day period has run. Virtik gives that information by email to Customer's Administrator, or to the contact designated in the Order Form, as Section 8.2 provides for a Material Subprocessor.

9. Data Subject Rights Assistance

9.1 The Service provides the functionality that it then supports for Customer to access, correct, export and delete Customer Personal Data within its tenant, so that Customer may respond to Data Subject requests itself. Virtik does not represent that the Service provides self-service functionality for every category of Customer Personal Data.

9.2 Where Customer cannot fulfil a request through that functionality, Virtik will provide reasonable assistance, at Customer's cost where the assistance is substantial.

9.3 Virtik will not respond directly to a Data Subject in respect of Customer-controlled data. Where Virtik receives such a request it will, without undue delay, inform the Data Subject that they must contact the relevant organisation, and inform Customer where Virtik can identify the tenant concerned. Virtik will not search other customers' tenants to locate a Data Subject, because doing so would itself be a disproportionate intrusion into other Data Subjects' information.

10. Security Incident Assistance

10.1 Virtik will notify Customer without undue delay after Virtik confirms a Security Incident affecting Customer Personal Data. Virtik confirms a Security Incident when, acting reasonably and without delaying its investigation, it determines that the Security Incident has occurred or reasonably believes, as Section 1.17 of the Terms provides, that it has occurred. Where the SCCs apply, Clause 8.6(c) controls as to the notification of a personal data breach: the data importer notifies the data exporter without undue delay after having become aware of the breach. This DPA states no stricter formulation than Applicable Data Protection Law and the SCCs require, and none of them fixes a number of hours for a processor's notice to its controller. Where Module Three applies, Clause 8.6(c) also provides for notice to the controller where appropriate and feasible, and Virtik will give it where Customer has given Virtik the controller's contact details in writing.

10.2 Notification will include, to the extent known: the nature of the incident, categories and approximate number of records affected, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases as an investigation progresses.

10.3 Virtik will take reasonable steps to contain and remediate, and will provide information reasonably necessary for Customer to meet its own notification obligations.

10.4 Notification is not an admission of fault or liability.

10.5 An unsuccessful attempt, or an event that does not compromise the security of Customer Personal Data — including pings, port scans, failed log-ins and denial-of-service attempts that do not result in access — is not a Security Incident.

10.6 Operational notification objective. Where reasonably practicable, Virtik's objective is to give the notice in Section 10.1 within 72 hours after it confirms the Security Incident. That 72-hour period is an operational notification objective only. It is not an unconditional contractual guarantee or a warranty. A notice given after 72 hours is not by itself a breach of this DPA, of Section 19 of the Terms or of the Agreement. A failure to notify without undue delay is a breach of this Section and of Section 19.5 of the Terms, and Virtik's liability for the loss that failure causes is subject to the Enhanced Cap under Section 21.3(b) of the Terms; it does not make the underlying Security Incident a Qualifying Security Incident.

10.7 Customer's own obligations. Virtik's notice to Customer is separate from any notification that Customer must make to a Supervisory Authority, to Data Subjects or to others as a Controller (including under GDPR Articles 33 and 34) or otherwise. Those obligations, and the periods in which they must be met, are determined by Applicable Data Protection Law and run from the Controller's own awareness, and they are Customer's responsibility. Where Customer is a Processor for another Controller, Customer is responsible for notifying that Controller.

11. Data Protection Impact Assessments and Regulatory Consultation

11.1 Virtik will provide reasonable assistance with a data protection impact assessment or prior consultation with a Supervisory Authority relating to the platform, to the extent Customer cannot reasonably obtain the information itself and it relates to Virtik's Processing.

11.2 Assistance may be provided through documentation, questionnaire responses, or the Security Addendum (LEG-015). Virtik may charge for substantial assistance.

11.3 Customer is responsible for conducting its own assessment. Only Customer knows its purposes, its premises, who it monitors and why — the facts on which any assessment turns.

12. Government and Law Enforcement Requests

12.1 If Virtik receives a request from a public authority for Customer Personal Data, Virtik will, unless legally prohibited: (a) notify Customer without undue delay; (b) inform the authority that Virtik is a Processor and that the request should be directed to Customer; and (c) not disclose unless legally compelled.

12.2 Where legally compelled, Virtik will disclose only the minimum required and will seek to challenge a request that appears unlawful, overbroad, or inconsistent with international comity.

12.3 Virtik's handling of legal process is described in the Law Enforcement Request Guidelines (LEG-020).

12.4 Virtik will maintain a record of requests received to the extent lawful.

13. Return and Deletion

13.1 On expiry or termination, Virtik will make Customer Personal Data available for export through the export functionality that the Service then provides, and otherwise with reasonable assistance (including, where technically feasible, in a commonly used machine-readable format), for the period stated in the Agreement (30 days under Section 10.7 of the Terms and Section 5.6 of the Master Services Agreement). Section 16.18 of the Terms applies in addition where Regulation (EU) 2023/2854 applies.

13.2 After that period Virtik will delete or de-identify Customer Personal Data, except to the extent retention is required by law or is necessary to establish, exercise or defend legal claims. Where the SCCs apply, Virtik will delete Customer Personal Data rather than de-identify it if Customer so chooses by written notice, and the certification under Section 13.4 states whether Virtik has deleted or de-identified it.

13.3 This DPA states no deletion period and no backup-expiry period. Deleted data may persist in backups until the backups expire, as Section 13.4 states.

13.4 On Customer's written request, once Virtik has deleted or de-identified Customer Personal Data in accordance with this Section 13, Virtik will confirm that in writing. The confirmation is a manual act and does not state that no copy remains in backups, in which deleted data may persist until the backups expire. Where the SCCs apply, Virtik will on Customer's written request also provide the certification of deletion that Clause 8.5 of the SCCs requires, as a written statement signed by an authorized representative of Virtik that states whether Virtik has deleted or de-identified the Customer Personal Data in accordance with Section 13.2 (and, where Customer has chosen deletion under Section 13.2, that Virtik has deleted it), and which states the backup exception and any retention that applicable law requires.

14. Audits and Compliance Information

14.1 Virtik will make available information reasonably necessary to demonstrate compliance with this DPA, primarily through the Security Addendum (LEG-015) and responses to reasonable security questionnaires.

14.2 Where Applicable Data Protection Law or, where they apply, Clause 8.9 of the SCCs entitles Customer to audit, and the information in 14.1 is insufficient, Customer may request an audit on reasonable prior written notice, no more than once in any twelve-month period unless required by a Supervisory Authority or following a Security Incident affecting Customer.

14.3 An audit must be during business hours, must not unreasonably disrupt operations, must be subject to confidentiality, must not access another customer's data or Virtik's multi-tenant infrastructure in a way that could affect other customers, and must be conducted by Customer or an independent auditor that is not a Virtik competitor. Customer bears the cost.

14.4 Virtik does not currently offer a third-party audit report, because it holds no SOC 2 attestation or ISO 27001 certification. Virtik grants no audit right beyond Sections 14.1 to 14.3: the information described in Section 14.1, and an audit only where Applicable Data Protection Law or Clause 8.9 of the SCCs entitles Customer to one, on the conditions in Sections 14.2 and 14.3 to the extent those Clauses permit.

15. International Data Transfers

15.1 Virtik is established in the United States and Customer Personal Data may be Processed there and in other locations where Virtik or its Subprocessors operate. This DPA names no hosting region.

15.2 Where Virtik Processes Personal Data subject to GDPR, UK GDPR or Swiss law and transfers it to a country without an adequacy decision, the transfer is governed by Sections 16 and 17.

15.3 Virtik will not transfer Customer Personal Data to a jurisdiction without a valid transfer mechanism in place.

15.4 Data residency is not offered as a commitment.

16. European Commission Standard Contractual Clauses

16.1 Where GDPR applies and Section 15.2 is engaged, the SCCs are incorporated by reference and apply to the transfer.

16.2 Module selection. The SCCs are the clauses in the Annex to Commission Implementing Decision (EU) 2021/914, and a reference in this Section 16 to a Clause is a reference to a Clause of the SCCs. The data exporter is Customer and the data importer is Virtik USA, Inc., as Schedule 1 states. The Modules apply as follows:

(a) Module Two (controller to processor) applies to Processing under Section 3.2 where Customer is a controller of the Customer Personal Data.

(b) Module Three (processor to processor) applies where Customer is itself a processor acting on behalf of another controller, including where Section 3.5 applies. Customer then confirms that its controller's instructions are consistent with this DPA, as Section 3.5 provides.

(c) Customer will state in the Order Form, or by written notice to Virtik before the first transfer, whether it acts as a controller or as a processor for the Customer Personal Data. Where Customer states nothing, Module Two applies.

(d) Module One (controller to controller) is not selected. Virtik's Processing as an independent Controller under Section 3.3 is governed by the Privacy Policy (LEG-002), and Virtik will rely on the transfer mechanism that Applicable Data Protection Law requires for that Processing, if any. Module Four does not apply.

16.3 The following are pre-populated where the SCCs apply, and are set out in the Schedules: data exporter and importer (Annex I.A), the Annex I.B processing description, Annex II technical and organisational measures. Annex III (list of sub-processors) is completed only where Clause 9(a), Option 1 (specific prior authorisation) applies. Section 16.5(b) selects Option 2, so no Annex III is completed, and the agreed list for the purposes of Clause 9(a) is the Subprocessor List (Schedule 7).

16.4 In the event of a conflict between the SCCs and this DPA, the SCCs prevail.

16.5 Elections. Where the SCCs apply: (a) Clause 7 (docking clause), which is optional, is not included; (b) in Clause 9(a), Option 2 (general written authorisation) applies, the agreed list is the Subprocessor List (Schedule 7), and the time period for the specific written notice of intended changes to that list (additions or replacements of sub-processors) is at least 30 days in advance, as Sections 8.1 and 8.7 state. The notice under Section 8.2 (for a Material Subprocessor) and the written information under Section 8.7 (for any other Subprocessor) are the information that Clause 9(a) requires, and Customer's right to object under Section 8.3, which applies to every such change, is the right to object that Clause 9(a) gives; the termination right in Section 8.4 applies only to a Material Subprocessor. Where Module Three applies, Clause 9(a) requires the notice to be given to the controller and Virtik gives it to Customer and, where Customer has given Virtik the controller's contact details in writing, also to that controller; Virtik also informs Customer, as data exporter, of the engagement of the sub-processor. Section 8.6 (emergency replacement) does not shorten the Clause 9(a) period for a Customer to which the SCCs apply: for that Customer, a replacement Subprocessor begins to Process Customer Personal Data only after that period has run or Customer has agreed in writing to an earlier date; (c) in Clause 11(a), the optional wording on an independent dispute resolution body is not included; (d) Clause 13 and Annex I.C are as Section 16.6 states; and (e) Clauses 17 and 18 are as Section 16.7 states.

16.6 Supervisory authority (Clause 13 and Annex I.C). Clause 13(a) contains three alternative wordings, and only the alternative that corresponds to the data exporter's circumstances applies, as indicated in Annex I.C: (a) where the data exporter is established in an EU Member State, the supervisory authority responsible for ensuring the exporter's compliance with GDPR as regards the data transfer; (b) where the data exporter is not established in an EU Member State but falls within the territorial scope of GDPR under Article 3(2) and has appointed a representative under Article 27(1), the supervisory authority of the Member State in which the representative is established; and (c) where the data exporter is not established in an EU Member State, falls within Article 3(2) and is not required to appoint a representative under Article 27(2), the supervisory authority of one of the Member States in which the Data Subjects whose Personal Data is transferred under the SCCs in relation to the offering of goods or services to them, or whose behaviour is monitored, are located. Customer, as data exporter, identifies its competent supervisory authority in the Order Form or by written notice to Virtik before the first transfer, and that statement is Annex I.C for that Customer; Virtik does not choose it. Under Clause 13(b), Virtik, as data importer, submits itself to the jurisdiction of and cooperates with the competent supervisory authority as that Clause provides. This Section does not state that Virtik has an establishment or a representative in the European Union. Where Customer states none, the competent supervisory authority is the one that the alternative of Clause 13(a) that corresponds to Customer's circumstances designates.

16.7 Governing law and courts (Clauses 17 and 18). For Module Two and Module Three, Clause 17, Option 1 applies and Option 2 is not selected: the SCCs are governed by the law of Ireland, which the Parties designate as the law of an EU Member State that allows for third-party beneficiary rights. Under Clause 18(a) and (b), any dispute arising from the SCCs is resolved by the courts of Ireland, and under Clause 18(c) a Data Subject may also bring legal proceedings against the data exporter or the data importer before the courts of the Member State in which the Data Subject has habitual residence. The Parties submit themselves to the jurisdiction of the courts of Ireland, as Clause 18(d) provides. This Section 16.7 applies only to the SCCs. The laws of the State of Delaware and the exclusive Delaware forum under Section 26.9 of the Terms (or Section 13.10 of the Master Services Agreement) continue to govern this DPA, the Agreement and every other matter, including any claim between the parties that is not a claim under the SCCs.

17. United Kingdom Transfers

17.1 Where UK GDPR applies, the UK Addendum is incorporated and applies to the transfer, with the SCCs as the approved clauses it modifies.

17.2 For the UK Addendum: Table 1 (Parties) is as Schedule 1 and the Agreement state; Table 2 (Selected SCCs, Modules and Selected Clauses) is the SCCs as Section 16 incorporates them, Modules Two and Three, Clause 7 not included, the optional wording in Clause 11(a) not included, and Clause 9(a) Option 2 with the notice period in Section 16.5(b); and Part 2 (Mandatory Clauses) is the Mandatory Clauses of the Approved Addendum, as revised under Section 18 of those Mandatory Clauses. Table 3 (Appendix Information): Annex 1A (List of Parties) is Schedule 1 and the Agreement; Annex 1B (Description of Transfer) is Schedules 1, 2, 4 and 5; Annex II (Technical and organisational measures) is Schedule 6, which states only the measures that Section 6.2 and Schedule 6 state as configured and makes no other representation; and Annex III (List of Sub processors) is not applicable because Clause 9(a) Option 2 (general written authorisation) applies, the agreed list being the Subprocessor List (LEG-009), as Schedule 7 and Section 16.5(b) state. Table 4 (Ending this Addendum when the Approved Addendum changes): neither Party.

17.3 Where Swiss law applies, references are adapted so that the Federal Data Protection and Information Commissioner is the competent authority and the protection extends to legal entities where Swiss law requires.

18. California Service Provider and Contractor Terms

18.1 Section 3.6 applies. In addition:

18.2 Virtik will not Sell or Share Customer Personal Data, and does not do so.

18.3 Virtik will provide reasonable assistance with consumer requests to know, delete, correct and opt out, as described in Section 9.

18.4 Virtik will notify Customer if it determines it can no longer meet its Service Provider obligations.

18.5 Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data by Virtik, including as provided in Section 14.

18.6 Virtik will not use Customer Personal Data for cross-context behavioural advertising and does not do so.

19. Conflict and Order of Precedence

19.1 Where terms conflict as to the Processing of Personal Data, the following applies, highest first:

1. the SCCs and UK Addendum, where they apply, as to the transfers they cover;
2. a negotiated data processing agreement executed by both parties;
3. this DPA;
4. the Security Addendum, as to security measures;
5. the rest of the Agreement, including any Order Form and any Master Services Agreement;
6. Documentation.

19.2 An Order Form or a Master Services Agreement may vary this DPA only where it expressly identifies the provision of this DPA that it varies and the variation does not reduce a protection that Applicable Data Protection Law requires. Section 26.11 of the Terms and Section 1.4 of the Master Services Agreement rank the documents in the same way as to Personal Data, so that no document is ranked above a document that ranks it.

19.3 Law and forum of the SCCs. The SCCs are governed by the law and subject to the courts that Section 16.7 states, and the UK Addendum by the law and courts that it specifies. Section 26.9 of the Terms and Section 13.10 of the Master Services Agreement do not apply to them, and Section 16.7 gives the law and courts of Ireland no jurisdiction over any other matter.

20. Term, Survival and Liability

20.1 This DPA takes effect when the Agreement does and continues while Virtik Processes Customer Personal Data.

20.2 Sections 5, 6, 8, 9, 10, 12, 13, 14, 16, 19 and 20 survive termination, and Sections 6, 8, 10 and 16 apply for as long as Virtik holds Customer Personal Data.

20.3 Each party's liability under this DPA, including, as between Virtik and Customer and to the extent Clause 12 of the SCCs and Applicable Data Protection Law permit, liability under the SCCs, is subject to the limitations and exclusions in the Agreement, including the General Cap and, for the breaches that Section 21.3 of the Terms identifies, the Enhanced Cap.

20.4 Nothing in the Agreement or this DPA limits (a) a Data Subject's rights under Applicable Data Protection Law or the liability of a party to a Data Subject under Clause 12 of the SCCs, or (b) any liability that cannot lawfully be limited. Where a limitation in the Agreement would contradict the SCCs as between the parties, the SCCs prevail to that extent only.

20.5 Virtik may update this DPA on at least 30 days' notice to Customer where the update is required by Applicable Data Protection Law or by a modification of the SCCs or the UK Addendum by the authority that issued them, or reflects a change to the Subprocessor List made as Section 8 states, and where it does not reduce a protection that Applicable Data Protection Law requires. Any other change requires Customer's written agreement. Under a Master Services Agreement, Section 13.9 of that agreement governs amendment, except that a change that Section 8 permits is not an amendment and except that a modification of the SCCs or the UK Addendum by the authority that issued them applies to the transfers it covers from its effective date.

Schedules

Schedule 1 — Processing Description

Schedule 2 — Categories of Personal Data and Data Subjects

Categories of Personal Data (as configured by Customer): identifiers and contact details of authorised users; role and permission data; authentication metadata; images and video of individuals captured by Customer Systems; audio where Customer enables it; detection metadata referring to individuals; geolocation and patrol tracks of personnel; communications content; incident records; visitor records where Customer configures them; and device and log data.

Categories of Data Subjects: Customer's authorised users and administrators; Customer's employees and contractors; visitors to Customer's premises; members of the public within the field of view of Customer Systems; and Customer's own customers where present at monitored premises.

Sensitive Data: none, unless Customer configures Processing that captures it, in which case Section 4.5 applies.

Schedule 3 — Customer Instructions

Virtik's standing instructions are: Process Customer Personal Data solely to provide, maintain, secure and support the platform in accordance with Customer's configuration; retain according to Customer's configured retention; make it available to those Customer's permission configuration authorises; transmit to integrations Customer enables; and delete on Customer's instruction or in accordance with Section 13.

Schedule 4 — Processing Duration

Duration follows the Subscription Term and the periods in Section 13. This DPA states no retention period.

Schedule 5 — Nature and Purpose by Data Category

Schedule 6 — Technical and Organisational Measures

This Schedule states the measures that the Service's implementation and configuration provide, as Section 6.2 states. A measure that is not listed in it is not represented by this Schedule. Where the SCCs apply, this Schedule is Annex II to the SCCs. It lists only the measures stated below and does not describe any other measure that Annex II would otherwise ask for. Nothing in this Schedule limits the obligation in the last sentence of Section 6.1, and this Schedule does not state that every measure that Article 32 of GDPR requires is in place.

Measures stated as configured: multi-tenant isolation; role-based access control; HTTPS and HTTP Strict Transport Security configured for the web applications; multi-factor authentication available to users of the Service; audit records of certain administrative and security events, which the Service's client-facing database roles cannot read, change or delete in the main audit table (Virtik does not represent that audit records are complete, tamper-proof or immutable as against privileged Virtik access); least-privilege database grants for the client-facing roles; server-side validation of writes; origin validation and rate limiting on selected endpoints (Virtik does not represent that a limit is shared across server instances).

Virtik makes no representation in this Schedule about encryption at rest or key management, backup and restoration, vulnerability management, penetration testing, business continuity and disaster recovery, physical security of hosting locations, secure development lifecycle, logging retention, personnel access to production systems, or key rotation.

Schedule 7 — Subprocessors

Maintained at /legal/subprocessors (LEG-009), which is the agreed list for Clause 9(a), Option 2 of the SCCs. Annex III of the SCCs, which Clause 9(a), Option 1 would require, is not completed.

Schedule 8 — Transfer Mechanisms

Schedule 9 — Contacts

Language. This DPA is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT