Open Text Data
Processing Addendum
AmendmentThis Data Processing Addendum Amendment (“Amendment”) is entered into by and between Customer
as identified in the signature block below (the “Customer”) and Open Text entity having entered into thePrincipal Agreement (as defined below) (“Open Text” or "OT”) as of the date of the last signature of bothparties with respect to the period on and after that date. Customer and Open Text hereinafter separately
referred to as “Party” and jointly as “Parties”.
Whereas:a) The Parties have previously entered into an agreement (the “Principal Agreement”) for theprovision of certain services by OT.
b) That Principal Agreement includes a Data Processing Addendum (the “DPA”).
c) The Parties now desire to amend and/or supplement the terms of the DPA as set out in thisAmendment.
d) For the purposes of the Standard Contractual Clauses (as defined below), the Customer will beconsidered the data exporter and Open Text will be considered the data importer.
Now therefore, in consideration of the mutual covenants of the parties contained in thisAmendment and other good and valuable consideration, the receipt and sufficiency of which areacknowledged, and notwithstanding anything to the contrary contained in the DPA and/orPrincipal Agreement, the parties agree that the DPA is amended as set forth in this Amendment.
THIS AMENDMENT, INCLUDING ALL OT ITS SCHEDULES, ANNEXES, APPENDICES AND THE
LINKS IN IT, AMENDS THE DPA WHICH SUPPLEMENTS AND FORMS PART OF THE PRINCIPAL
AGREEMENT AS FOLLOWS:

Open Text Data Processing Addendum Amendment

1 Definitions.
a) Capitalized terms used in this Amendment, but not defined in this Amendment, shall have themeaning assigned to them in the Principal Agreement and/or DPA, as applicable.
b) The following terms shall be amended and/or added, as applicable, to the Definitions section ofthe DPA:i.

"Data Protection Legislation" means, (i) the GDPR (and any laws of Member States of
the European Economic Area ("EEA") implementing or supplementing the GDPR), (ii) UK
Data Protection Law, and (iii) data protection or privacy laws of Switzerland, in eachcase, to the extent applicable to the Processing of Personal Data under this DPA and thePrincipal Agreement,ii.

"EEA Standard Contractual Clauses" means the EEA Controller to Processor SCCs
and EEA Processor to Processor SCCs;iii.

"EEA Controller to Processor SCCs" means the clauses set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-eea-controller-toprocessor-clauses-module-2-en.pdf (and also referred to as Appendix 4) which areincorporated into this DPA by reference, as may be amended, updated or replaced fromtime to time.

iv.

"EEA Processor to Processor SCCs" means the clauses set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-eea-processor-toprocessor-clauses-module-3-en.pdf (and also referred to as Appendix 5) which areincorporated into this DPA by reference, as may be amended, updated or replaced fromtime to time.

v.

"Restricted Transfer” means a transfer of Personal Data which, subject to the paragraphbelow, is:
1. From an exporter subject to GDPR which is only permitted in accordance withGDPR if a Transfer Mechanism is applicable to that transfer ("EEA RestrictedTransfer");
2. from an exporter subject to UK Data Protection Law which is only permitted inaccordance with UK Data Protection Law if a Transfer Mechanism is applicableto that transfer ("UK Restricted Transfer"); and/or
3. from an exporter subject to Data Protection Legislation applicable inSwitzerland which is only permitted under that law if a Transfer Mechanism isapplicable to that transfer (“Swiss Restricted Transfer”);

The Information Company

2

Open Text Data Processing Addendum Amendment

Transfers of Personal Data will not be considered as a Restricted Transfer where:i.

the jurisdiction to which the personal data is transferred has been approved by
the European Commission under Article 45 of the GDPR or, as applicable, anequivalent provision under UK or Swiss Data Protection Law, as ensuring anadequate level of protection for the processing of Personal Data ; orii.

the transfer falls within the terms of a derogation as set out in Article 49 of theGDPR, equivalent under Swiss Data Protection Law or the UK GDPR (asapplicable).

vi.

“Standard Contractual Clauses” means each of the EEA Standard Contractual Clauses
and the UK Standard Contractual Clauses. References in the DPA to “EU ModelClauses” shall be amended to refer to the “Standard Contractual Clauses” as defined in
the preceding sentence;vii.

"Transfer Mechanism" means the Standard Contractual Clauses or any otherappropriate safeguards under Article 46 of the GDPR or equivalent under Swiss or UK
Data Protection Law applicable to a relevant transfer of Personal Data that has the effectof permitting that transfer;viii.

"UK Data Protection Law" means UK GDPR (as defined in the UK Data Protection Act
2018) and the UK Data Protection Act 2018;

ix.

"UK Controller to Processor SCCs" means the UK International Data Transfer
Addendum which is made up of the provisions set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-uk-international-datatransfer-addendum-en.pdf, (and also referred to as Appendix 6) which are incorporated
into this DPA by reference, as may be amended, updated or replaced from time to time,incorporating the EEA Controller to Processor SCCs;x.

"UK Processor to Processor SCCs" means the UK International Data Transfer
Addendum which is made up of the provisions set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-uk-international-datatransfer-addendum-en.pdf, (and also referred to as Appendix 6) which are incorporated
into this DPA by reference, as may be amended, updated or replaced from time to time,
incorporating the EEA Processor to Processor SCCs; andxi.

"UK Standard Contractual Clauses" means the UK Controller to Processor SCCs andUK Processor to Processor SCCs (each as amended, updated, or replaced from time totime).

The Information Company

3

Open Text Data Processing Addendum Amendment

2 International Transfers.
Section 5 is deleted in its entirety and replaced with the following:
5. International Transfers
5.1

Personal Data may be processed in the EEA, the UK and Switzerland (each a “DesignatedCountry”) and in countries outside of a Designated Country (“Other Countries”) by Open Text orits sub-processors. The transfer to Other Countries shall be in accordance with Data Protection
Legislation (to the extent it applies).

5.2

The Parties shall have in place a Transfer Mechanism in respect of any Restricted Transfer:

5.3

5.2.1

In the event of an EEA Restricted Transfer where Personal Data is transferred fromCustomer as data exporter acting as a Controller or Processor (as applicable), to Open
Text as data importer acting as a Processor, the Parties shall, as part of this DPA, comply
with the EEA Controller to Processor SCCs where the Customer acts as a Controller andthe EEA Processor to Processor SCCs where the Customer acts as a Processor.

5.2.2

In the event of a UK Restricted Transfer, where Personal Data is transferred fromCustomer as data exporter acting as a Controller or Processor (as applicable) to Open
Text as data importer acting as a Processor, the Parties shall, as part of this DPA, comply
with the UK Controller to Processor SCCs where the Customer acts as a Controller andthe UK Processor to Processor SCCs where the Customer acts as a Processor.

5.2.3

In the event of a Swiss Restricted Transfer, whereby Personal Data is transferred fromCustomer as data exporter, acting as a Controller or Processor (as applicable), toOpenText as data importer acting as a Processor, the Parties shall, as part of this DPA,
comply with the corresponding module of the EEA Standard Contractual Clauses.

5.2.4

The Standard Contractual Clauses will not apply to a Restricted Transfer to the extent
that Open Text has adopted Binding Corporate Rules for Processors or an alternative
recognized compliance standard for lawful Restricted Transfers.

Where pursuant to the Standard Contractual Clauses Open Text attempts to redirect a requestfrom a public authority, including judicial authorities (“Government Request”) to the Customer,
and/or determines that a requirement to challenge or appeal a Government Request regarding
Customer’s Personal Data exists, Customer agrees to participate in and support such challenge
as reasonably requested. Where possible, the Customer itself will seek a protective order or otherappropriate remedy in response to the Government Request.

The Information Company

4Open Text Data Processing Addendum Amendment

3 Technical and OrganizationalMeasures.
In clause 10.2 the words “Annex 1” are deleted and replaced with the words “Appendix 3” and the Annex
named “Technical and Organizational Measures” (Annex 1) in the DPA is deleted in its entirety andreplaced with the following:“Appendix 3: the applicable technical and organizational measures available at the following link:
https://www.opentext.com/assets/documents/en-US/pdf/opentext-technical-and-organizational-measuresen.pdf, which are incorporated into this DPA by reference, as may be amended, updated or replaced fromtime to time.”

4 Other Appendices.
In clause 2.3 the words “Annex 2” are deleted and replaced with the words “Appendix 1”. The Annex
named “Details of Processing of Customer Personal Data” (Annex 2) in the DPA is deleted in its entirety
and replaced with a new Appendix 1 (Details of Processing of Customer Personal Data) and a newAppendix 2 (Description of Transfer), as set out in Annex 1 to this Amendment.

5 Effect of Amendment.
In the event of a conflict between the provisions of the DPA, the Principal Agreement and thisAmendment, the provisions in this Amendment shall prevail to the extent of such conflict or inconsistency.
Except as expressly set forth in this Amendment, the provisions of the DPA are not otherwise amended,and they shall be construed together with the provisions of this Amendment.

The Information Company5

Open Text Data Processing Addendum Amendment(Open Text)(Customer)

Name:

Name:

Title:

Title:

Date:

Date:

Address:

Address:The Information Company

6

Open Text Data Processing Addendum Amendment

ANNEX 1 TO THE AMENDMENT
The following is added as a replacement Appendix 1 and new Appendix 2 to the DPA:APPENDIX 1
DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATASee Appendix 2 of this DPA for each of following: Subject matter and duration of the Processing of
Personal Data, the nature and purpose of the Processing of Personal Data, the types of Personal Data to
be processed, special categories of data (if appropriate) and the categories of Data Subject to whom theCustomer Personal Data relates

APPENDIX 2DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Unless provided otherwise by the Customer, Data Subjects may include Customer employees,
contractors, business partners or other individuals having Personal Data stored, transmitted to, madeavailable to, accessed or otherwise processed by Open Text.
Categories of personal data transferred
Customer determines the categories of Personal Data which are processed by Open Text in connection
with the Services in accordance with the terms of the Principal Agreement (and documentation governedby it). Customer submits Personal Data for processing after careful evaluation of compliance withapplicable laws. The Personal Data may include the following categories of data: name, phone numbers,
e-mail address, time zone, address data, company name, plus any application-specific data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose
limitation, access restrictions (including access only for staff having followed specialised
training), keeping a record of access to the data, restrictions for onward transfers or additional
security measures.
None.
The choice and type of Personal Data that will be processed using the Open Text Services remains solely
within the discretion and choice of the Customer. In selecting the Personal Data of any categories, theCustomer shall ensure that such Personal Data is suitable for processing with and through the Services incompliance with applicable data protection laws. Open Text disclaims all liabilities in relation to theselection of data performed by Customer for use with the Services.

The Information Company7

Open Text Data Processing Addendum Amendment

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuousbasis).
Transfers shall be made on a continuous basis.
Nature of the processing
Open Text offers Services to the Customer. Open Text requires to process Personal Data to deliver theServices to the Customer.
The Personal Data is subject to the basic processing activities as set out in the Principal Agreement
which may include:a) use of Personal Data to provide the Services;b) storage of Personal Data;c) computer processing of Personal Data for data transmission; andd) execution of instructions of Customer in accordance with the Principal Agreement and DPA.
Purpose(s) of the data transfer and further processing
See "nature of processing" above.
The period for which the personal data will be retained, or, if that is not possible, the criteria usedto determine that period
The duration of the Processing of the Personal Data is set out in the Principal Agreement (anddocumentation governed by it) and this DPA.
Subject matter, nature and duration of the processing for transfer to (sub-) processors
As above.

Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.