Data Processing Addendum
This Data Processing Addendum ("DPA") is incorporated into and forms a part of the agreement
between Smartsheet Inc. ("Smartsheet") and Customer that governs Customer’s access to and use of
the online Services ("Agreement"). Capitalized terms not defined herein have the meaning given in theAgreement.
1.

Definitions. In this DPA, the following terms (and derivations thereof) have the meanings set
out below:“Controller” means the individual or entity that determines the purposes and means of theProcessing of Personal Data.
“Customer” means the individual or entity that has entered into the Agreement and agreed tothe incorporation of this DPA into the Agreement.
“Customer Content” means any data, file attachments, text, images, reports, personal
information, or other content that is uploaded or submitted to an online Service by Customer orUsers and is Processed by Smartsheet on behalf of Customer.
“Customer Personal Data” means Personal Data that is contained within Customer Content.
“Data Breach” means a breach of security resulting in the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or access to Customer Content.
“Data Protection Laws” means, to the extent applicable to a Party, the data protection or
privacy laws of any country regarding the Processing of Customer Personal Data.
“Data Subject” means an identified or identifiable natural person.
“Parties” or “Party” means Customer and/or Smartsheet as applicable.
“Personal Data” means any information relating to, identifying, describing, or capable of being
associated with a Data Subject or a household.
“Process” means any operation or set of operations performed upon Personal Data, whether or
not by automated means, such as collection, recording, organization, structuring, storage,adaptation, alteration, retrieval, consultation, use, alignment, combination, restriction, erasure,destruction or disclosure by transmission, dissemination or otherwise making available.
“Processor” means the individual or entity that Processes Personal Data on behalf of aController.
“Professional Services” means implementation, configuration, integration, training, advisory,and other professional services related to the online Services that are provided by Smartsheet
and purchased by Customer specified in an Order or SOW.
“Services” means the Subscription Services, Professional Services, and any other online service
or application provided or controlled by Smartsheet for use with the Subscription Services.
“Smartsheet Personnel” means any individual authorized by Smartsheet to Process Customer
Personal Data.
“Subprocessor” means any individual or entity (including any third party but excluding
Smartsheet Personnel) appointed by or on behalf of Smartsheet to Process Customer Personal
Data in connection with the Agreement.

Smartsheet DPA07062020

1

“Subscription Services” means the subscription-based online work collaboration services andapplications that are provided by Smartsheet and purchased by Customer.
“Supervisory Authority” means an independent competent public authority established orrecognized under Data Protection Laws.
“User” means any individual authorized or invited by Customer or another User to access anduse the online Services under the terms of the Agreement.
2.

Roles of Parties.
2.1.

Customer and Smartsheet agree that, as between the Parties, Customer is a Controller
and Smartsheet is a Processor of Customer Personal Data and that each Party is solely
responsible for its compliance with Data Protection Laws applicable to it and for fulfilling
any of its related obligations to third parties, including Data Subjects and Supervisory
Authorities.

2.2.

Customer as Controller.

2.3.

2.2.1.

Customer is solely responsible for the accuracy of Customer Personal Dataand the legality of the means by which Customer acquires Customer PersonalData.

2.2.2.

Customer’s instructions to Smartsheet to Process Customer Personal Data willcomply with Data Protection Laws and be duly authorized, with all necessary
rights, permissions, and consents secured.

Smartsheet as Processor.
2.3.1.

Smartsheet will Process Customer Personal Data only: (a) as instructed byCustomer in writing or as initiated by Users via an online Service; (b) as
necessary to provide the Services and prevent or address technical problems
with an online Service or violations of the Agreement or this DPA; or (c) as
required by applicable law. Annex 1 (Details of Processing of Customer
Personal Data) sets out a description of Smartsheet’s Processing of Customer
Personal Data.

2.3.2.

Smartsheet will ensure that Smartsheet Personnel: (a) access Customer
Personal Data only to the extent necessary to perform Smartsheet’s
Processing obligations under this DPA and the Agreement; (b) are bound byconfidentiality obligations with respect to Customer Personal Data
substantially as protective as those set forth in this DPA and the Agreement;and (c) are subject to appropriate training relating to the Processing ofCustomer Personal Data.

2.3.3.

Smartsheet will not disclose Customer Personal Data to a third party formonetary or other consideration except as otherwise permitted under thisDPA or the Agreement.

2.3.4.

At Customer’s written request and to the extent Customer is unable to accessthe relevant information on its own, Smartsheet will provide reasonableassistance to Customer in relation to data protection impact assessments andconsultations with Supervisory Authorities, taking into account the nature of
Smartsheet’s Processing of Customer Personal Data and the information
available to Smartsheet.

Smartsheet DPA07062020

22.3.5.

3.

4.

Smartsheet will not assess the type or substance of Customer Content toidentify whether it is Customer Personal Data or subject to any specific legal
requirements.

Security.
3.1.

Smartsheet will implement and maintain technical, physical, and organizationalmeasures and controls designed to protect and secure Customer Content (including thereturn and deletion thereof) in accordance with the Agreement.

3.2.

Customer acknowledges that, through its Users, Customer: (a) controls the type andsubstance of Customer Content; and (b) sets User permissions to access Customer
Content; and therefore, Customer is responsible for reviewing and evaluating whether
the documented functionality of an online Service meets Customer’s required security
obligations relating to Customer Personal Data under Data Protection Laws.

Subprocessors.
4.1.

Subprocessors will be identified at www.smartsheet.com/legal/subprocessors.
Customer authorizes Smartsheet to use any such Subprocessors subject to the terms
and conditions of this Section 4.

4.2.

Smartsheet will carry out appropriate due diligence on each Subprocessor and have awritten agreement with each Subprocessor that includes provisions for Processing
Customer Personal Data that are substantially as protective as those set out in this DPA.

4.3.

Smartsheet is responsible for Subprocessors’ acts and omissions, including a
Subprocessor’s appointment of another Subprocessor.

4.4.

New Subprocessors; Right to Object.
4.4.1.

Customer must fill out the form available atwww.smartsheet.com/legal/subprocessor-notification to receive notificationsof new Subprocessor appointments by Smartsheet. Following submission ofsuch form, Smartsheet will provide prior written notice to Customer if
Smartsheet intends to appoint new Subprocessors; provided, however, that
Smartsheet will notify Customer in writing without undue delay after theappointment of a new Subprocessor if direct involvement of such
Subprocessor is necessary for maintaining the availability and security of theonline Services or Customer Content.

4.4.2.

If Customer objects to a new Subprocessor on a reasonable basis related tothe Processing of Customer Personal Data, Customer must notify Smartsheet
in writing within fifteen (15) days after receiving an appointment notice;otherwise, Smartsheet will deem the appointment of the new Subprocessor
authorized by Customer. Upon receipt of an objection notice from Customer,
Smartsheet will use reasonable efforts to make available to Customer achange in the online Services or recommend a commercially reasonableconfiguration or use of the online Services to avoid the Processing ofCustomer Personal Data by the new Subprocessor. If Smartsheet cannot
address Customer’s objection pursuant to the foregoing efforts, Smartsheet
will notify Customer within fifteen (15) days of receipt of Customer’s objection
notice. Customer may then, by written notice to Smartsheet within thirty (30)days of Smartsheet’s notice, terminate this DPA and any affected Services andSmartsheet DPA07062020

3

receive a refund of prepaid fees covering the terminated portion of theapplicable Service.
5.

6.

7.

Data Subject Requests.
5.1.

Smartsheet will provide Customer access to Customer Personal Data via the online
Services to allow Customer to respond to Data Subject requests relating to Customer
Personal Data.

5.2.

Smartsheet will notify Customer in writing without undue delay of any requests
Smartsheet receives directly from a Data Subject relating to Customer Personal Data,and Smartsheet may respond directly to a Data Subject request: (a) to confirm that such
request relates to Customer; (b) as required by applicable law; or (c) with the writtenconsent of Customer.

5.3.

At Customer’s written request and to the extent Customer is unable to access Customer
Personal Data on its own, Smartsheet will provide reasonable assistance to Customer inaccessing Customer Personal Data for Customer to respond to such Data Subject
requests. To the extent legally permitted, Customer will be responsible for any expenses
attributable to Smartsheet’s assistance efforts outside the normal course of business.

Data Breach.
6.1.

Smartsheet will notify Customer in writing without undue delay upon Smartsheet
becoming aware of a Data Breach.

6.2.

Smartsheet will investigate and, as necessary, mitigate or remediate a Data Breach inaccordance with Smartsheet’s security incident policies and procedures (“BreachManagement”).

6.3.

Subject to Smartsheet’s legal obligations, Smartsheet will provide Customer withinformation available to Smartsheet as a result of its Breach Management, including thenature of the incident, specific information disclosed (if known), and any relevant
mitigation efforts or remediation measures (“Breach Information”), for Customer tocomply with its obligations under Data Protection Laws as a result of a Data Breach.

6.4.

If Customer requires information relating to a Data Breach in addition to the BreachInformation, at Customer’s sole expense and written request and to the extent
Customer is unable to access the additional information on its own, Smartsheet willreasonably cooperate with Customer as requested by Customer to attempt to collectand provide such additional information.

Audit Rights.
7.1.

Smartsheet will use external auditors to annually audit and verify the adequacy of its
security measures and controls (“Audit”). The Audit will: (a) be performed byindependent third party security professionals at Smartsheet's selection and expense;(b) include testing of the security measures and controls of the online Services,performed according to AICPA SOC2 standards or such other alternative standards
substantially equal to AICPA SOC2, that results in the generation of, at a minimum, aSOC2 report or the substantive equivalent; and (c) include penetration testing of theonline Services and result in the generation of a penetration test report. The reports
generated by the Audit (“Reports”) will be made available to Customer upon written

Smartsheet DPA07062020

4request no more than annually subject to the confidentiality obligations of theAgreement or a mutually-agreed non-disclosure agreement. For clarity, each Report will
only discuss the online Services in general commercial availability at the time the Report
was issued; subsequently released Services, if covered by a Report, will be in the next
annual iteration of such Report.
7.2.

8.

If Customer requires information for its compliance with Data Protection Laws inaddition to the Reports, at Customer’s sole expense and written request and to theextent Customer is unable to access the additional information on its own, Smartsheet
will allow for and cooperate with a Customer mandated audit by a third party auditor inrelation to the Smartsheet’s Processing of Customer Personal Data (“Customer Audit”),
provided that:
7.2.1.

Customer provides Smartsheet reasonable advance notice including theidentity of the auditor and the anticipated date and scope of the Customer
Audit;

7.2.2.

Smartsheet approves the auditor by notice to Customer, with such approval
not to be unreasonably withheld;

7.2.3.

Customer and the auditor act to avoid causing any damage, injury, ordisruption to Smartsheet’s premises, equipment, or business in the course ofsuch Customer Audit; and7.2.4.

Customer initiates only one Customer Audit in any calendar year unlessotherwise required by a Supervisory Authority.

International Transfers.
8.1.

With respect to any international transfer of Customer Personal Data from Customer toSmartsheet or via onward transfer to a third country (“International Transfer”) thatwould be prohibited by applicable Data Protection Laws in the absence of a lawful datatransfer mechanism, during the authorized period of access to and use of the online
Services, Smartsheet will: (a) maintain its self-certification to the EU-U.S. and Swiss-U.S.
Privacy Shield self-certification program operated by the United States Department ofCommerce (collectively, “Privacy Shield”); and (b) comply with each of the Privacy
Shield principles (including, without limitation, ‘Accountability for Onward Transfer’)with respect to the Processing of Customer Personal Data.

8.2.

If Privacy Shield compliance fails as a lawful data transfer mechanism for anInternational Transfer, the Parties agree that the Standard Contractual Clauses issued by
the European Commission under decision 2010/87/EU (“SCC”) will go into immediate
effect between the Parties, subject to the following clarifications:
8.2.1.

for purposes of SCC Clause 5(a), Section 2.3 (Smartsheet as Processor) of thisDPA is deemed an instruction by Customer to Process Customer PersonalData;

8.2.2.

for purposes of SCC Clauses 5(h) and 11, Section 4 (Subprocessors) of this DPA
satisfies Smartsheet’s obligations in such SCC clauses;

8.2.3.

for purposes of SCC Clause 5(j), Customer must request in writing a copy of
Smartsheet’s Subprocessor agreements and Smartsheet may remove allcommercial information, or terms unrelated to the SCCs, from such copies;

Smartsheet DPA07062020

59.

8.2.4.

for purposes of SCC Clause 5(f) and 12(2), Section 7 (Audit Rights) of this DPA
satisfies Smartsheet’s obligations in such SCC clauses;

8.2.5.

for purposes of SCC Clause 12(1), Smartsheet will provide certification ofdeletion only upon Customer’s written request;

8.2.6.

for purposes of SCC Appendix 1, the information set forth in Annex 1 of thisDPA will be deemed to complete such Appendix; and8.2.7.

for purposes of SCC Appendix 2, the security measures and controls set forthin the Agreement will be deemed to complete such Appendix.

General.
9.1.

Amendment; Waiver. Unless otherwise expressly stated herein, this DPA may be
modified only by a written agreement executed by an authorized representative of eachParty. The waiver of any breach of this DPA will be effective only if in writing, and nosuch waiver will operate or be construed as a waiver of any subsequent breach.

9.2.

Severance. If any provision of this DPA is held to be unenforceable, then that provision isto be construed either by modifying it to the minimum extent necessary to make it
enforceable (if permitted by law) or disregarding it (if not permitted by law), and therest of this DPA is to remain in effect as written. Notwithstanding the foregoing, ifmodifying or disregarding the unenforceable provision would result in failure of an
essential purpose of this DPA, the entire DPA will be considered null and void.

9.3.

Order of Precedence. Regarding the subject matter of this DPA, in the event of any
conflict between this DPA and any other written agreement between the Parties(including the Agreement), this DPA will govern and control. Any data processing
agreements that may already exist between Parties are superseded and replaced by thisDPA in their entirety.

9.4.

Notices. Unless otherwise expressly stated herein, the parties will provide notices under
this DPA in accordance with the Agreement, provided that all such notices may be sent
via email.

9.5.

Governing Law and Jurisdiction. Unless prohibited by Data Protection Laws, this DPA isgoverned by the laws stipulated in the Agreement and the Parties to this DPA hereby
submit to the choice of jurisdiction and venue stipulated in the Agreement, if any, withrespect to any dispute arising under this DPA.

9.6.

Enforcement. Regardless of whether Customer or its affiliate(s) or a third-party is a
Controller of Customer Personal Data, unless otherwise required by law: (a) only
Customer will have any right to enforce any of the terms of this DPA against Smartsheet;and (b) Smartsheet’s obligations under this DPA, including any applicable notifications,will be to only Customer.

9.7.

Liability. As between the Parties to this DPA, each Party’s liability and remedies under
this DPA are subject to the aggregate liability limitations and damages exclusions set
forth in the Agreement.

9.8.

Variations in Data Protection Laws. If any variation is required to this DPA as a result of achange in or subsequently applicable Data Protection Law, then either Party may
provide written notice to the other Party of that change in law. The Parties will thendiscuss and negotiate in good faith any variations to this DPA necessary to address suchchanges, with a view to agreeing and implementing those or alternative variations as

Smartsheet DPA07062020

6

soon as practicable, provided that such variations are reasonable with regard to thefunctionality and performance of the Services and Smartsheet’s business operations.
9.9.

Reservation of Rights. Notwithstanding anything to the contrary in this DPA: (a)Smartsheet reserves the right to withhold information the disclosure of which would
pose a security risk to Smartsheet or its customers or is prohibited by applicable law orcontractual obligation; and (b) Smartsheet’s notifications, responses, or provision ofinformation or cooperation under this DPA are not an acknowledgement by Smartsheetof any fault or liability.

9.10.

Smartsheet as Controller. Smartsheet may collect Personal Data directly from Data
Subjects (which may be duplicative of Customer Personal Data) in accordance with
Smartsheet’s internal policies and publicly posted Privacy Notice available atwww.smartsheet.com/legal/privacy, and nothing in this DPA will prohibit Smartsheet
from Processing such Personal Data as a Controller under Data Protection Laws,
provided that Smartsheet conspicuously notifies such Data Subjects that suchinformation will be handled in accordance with Smartsheet’s Privacy Notice.

Smartsheet DPA07062020

7

ANNEX 1: DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATAThis Annex 1 includes certain details of the Processing of Personal Data as required by Article 28(3) ofthe GDPR.
Subject matter and duration of the Processing of Personal Data:
The subject matter and duration of the Processing of Personal Data are set out in the Agreement
and this DPA.
The nature and purpose of the Processing of Personal DataProcessing of Personal Data by Smartsheet is reasonably required to facilitate or support theprovision of the Services as described under the Agreement and this DPA.
Type of Personal Data and Categories of Data Subjects:
The types of Personal Data and categories of Data Subject about whom the Personal Data
relates are determined and controlled by Customer in its sole discretion.
Obligations and Rights of the Controller:
The obligations and rights of Customer are set out in the Agreement and this DPA.

Smartsheet DPA07062020

8