CUSTOMER DATA PROCESSING AGREEMENT(Gigamon as Supplier)Signature Version
This Data Processing Agreement (“DPA”) applies to the Processing of Personal data by Gigamon on Customer’sbehalf when providing the Gigamon Offerings described in the relevant Agreement between Customer andGigamon Inc. (collectively, the “Parties“). In the event of a conflict between the terms of the Agreement and this
DPA, the terms of this DPA shall control. In the event of a conflict between the terms of this DPA and the EU
Standard Contractual Clauses, the terms of the EU Standard Contractual Clauses shall control. Gigamon reserves
the right to periodically update this DPA, which is available at www.gigamon.com/data-processingagreement.pdf.
1.
Definitions. Capitalized terms that are used but not otherwise defined in this DPA shall have themeanings given in the applicable Agreement or Data Protection Legislation.
“Agreement” means the underlying agreement(s) and any applicable order form in effect between theParties relating to the Gigamon Offerings, including attachments and exhibits, or other written or
electronic terms of service or subscription agreement, including without limitation this DPA upon its
effectiveness.
“Affiliate” shall have the meaning given in the Agreement; if no definition is set forth in the Agreement,
it shall mean any entity that Customer directly or indirectly controls (e.g. subsidiary), or is controlled by(e.g. parent) or which is under common control (e.g. sibling). “Control” means the ownership, direct orindirect, of a majority of an entity’s stock or other interest allowing the owner to direct the affairs ofsuch entity.
“Authorized Affiliate” shall mean an Affiliate of Customer that has not signed a separate agreement with
Gigamon, but is either a Controller or Processor for the Personal Data processed by Gigamon pursuant to
the Agreement, for so long as such entity remains an Affiliate of Customer.
“Approved Jurisdiction” means a jurisdiction that has either been approved as having adequate legal
protections for data by the European Commission or the United Kingdom Information
Commissioner’s Office, or where data transfers contemplated by this Agreement are not otherwise
restricted under the relevant Data Protection Legislation.
“Controller” shall have the meaning attributed to it in the EU GDPR or the UK GDPR, as applicable.
“Customer” shall mean the end customer who has purchased the relevant Gigamon Offerings, whether
directly from Gigamon or through an authorized channel partner, together with all Affiliates of
Customer that are authorized to purchase or use Gigamon Offerings for their own account pursuant to
the Agreement.
“Data Protection Legislation” means all applicable data protection laws, regulations, and regulatory
requirements in the relevant jurisdiction applicable to the respective Party in its role in the Processing of
Personal Data under the Agreement and this DPA, which may include (1) the EU GDPR, the UK GDPR,
and other relevant data protection laws of the EU and its Member States, Iceland, Liechtenstein,
Norway, and the Swiss Federal Data Protection Act (“FADP”); and (2) the California Consumer Privacy
Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), any other United States state
privacy legislation of similar scope to the aforementioned statutes that become enforceable after
execution of this DPA, all of which as may be amended from time to time.
“Data Subject” shall mean an identified or identifiable natural person to whom Personal Data relates.
“DPA Effective Date” shall be the last to occur of the effective date of the Agreement or the date ofinitial delivery of the Gigamon Offerings to which this DPA relates (but not later than the first date ofCustomer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 1 of 11

Processing of Personal Data for such purpose).
“EEA” means the European Economic Area.
“EU” means the European Union.
“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016.
“EU Standard Contractual Clauses” or “EU SCCs” means the standard data protection clauses for thetransfer of Personal Data to processors established in third countries, as described in Article 46 of the EU
GDPR pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard
Contractual Clauses, as approved by the European Commission in the European Commission’s
Implementing Decision 2021/914/EU of 4 June 2021.
“Gigamon” means Gigamon Inc., with offices at 3300 Olcott Street, Santa Clara, CA 95054, U.S.A., and its
direct and indirect subsidiaries.
“Gigamon Offering(s)” means Gigamon-branded hardware, software and Services procured by Customer
directly from Gigamon or through an authorized channel partner.
“Personal Data” means any personal data, personal information or similar term as defined in the Data
Protection Legislation, that Gigamon Processes in connection with the Gigamon Offering.
“Processing” or “Process” shall have the meaning attributed to it in the applicable Data Protection
Legislation.
“Security Documentation” means the documentation describing the Security Measures and any otherdocuments and information made available by Gigamon.
“Security Incident” means the accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to, Personal Data in Gigamon’s possession, custody or control.
“Security Measures” has the meaning given in Section 5.2 (Gigamon Security Measures).
“Services” means any services provided by Gigamon pursuant to the Agreement, including but not limited
to support and maintenance services and professional services.
“Sub-processors” means third parties engaged by Gigamon to Process Personal Data in relation to theGigamon Offering.
“Term” means the period from the DPA Effective Date until the end of Gigamon’s provision of theapplicable Gigamon Offering pursuant to the Agreement.
“Third-Party Controller” means an entity other than Customer or Gigamon that is a Controller withrespect to Personal Data being processed hereunder.
"UK Addendum” means the template addendum B.1.0 issued by the UK Information Commissioner andlaid before the UK Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February2022, as it is revised under Section 18 thereof, found at https://ico.org.uk/media/fororganisations/documents/4019539/international-data-transfer-addendum.pdf“UK GDPR” means the Retained Regulation (EU) 2016/679 (UK GDPR) and the Data Protection Act 2018
(DPA 2018).
2.
Duration and Scope of DPA. This DPA will take effect on the DPA Effective Date and, notwithstanding
the expiration of the Term, will remain in effect until, and automatically expire upon termination or expirationof the Agreement, or until such time as Gigamon no longer Processes Personal Data. This DPA applies where
and only to the extent that Gigamon Processes Personal Data on behalf of Customer as Data Processor in thecourse of providing the Gigamon Offerings. Notwithstanding the foregoing, Gigamon will continue to comply
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 2 of 11

with the relevant provisions of this DPA until Customer’s Personal Data has been deleted in accordance with
Section 4 of this DPA.
3.

Roles and Regulatory Compliance.
3.1. Processor and Controller Responsibilities. The parties acknowledge and agree that:
3.1.1. The subject matter and details of the Processing are described in Appendix 1; and3.1.2. Gigamon is a Processor of that Personal Data under Data Protection Legislation, in eachcase regardless of whether Customer acts as a Controller or as a Processor on behalf of a third-Third-Party
Controller; and3.1.3. Customer is a Controller of that Personal Data under Data Protection Legislation; and3.1.4. Gigamon will inform Customer if it believes that Customer’s instructions with respect to
the Processing of Personal Data violate the EU GDPR, UK GDPR or Member State provisions; and3.1.5. Each party will comply with the obligations applicable to it in such role under the Data
Protection Legislation with respect to that Personal Data.
3.2. Customer Responsibilities. Customer agrees that: (a) Customer has established, or ensured that
another party has established, a legal basis for Gigamon’s Processing of Personal Data contemplated by this
DPA; (b) to the extent required by Data Protection Legislation given the context of the Processing and unless
another legal basis supports the lawfulness of Processing, all notices have been given to, and consents andrights have been obtained from, the relevant Data Subjects and any other party as may be required underapplicable law (including Data Protection Legislation) for such Processing; and (c) Personal Data does not andwill not contain Special Categories of Personal Data, as defined in Article 9.1 of the EU GDPR and the UK GDPR;(d) Customer will keep the amount of Personal Data provided to Gigamon to the minimum necessary for theprovision of the relevant Gigamon Offerings; and (e) Customer will ensure a level of security appropriate to theparticular content of the Personal Data in accordance with the requirements of the applicable Data Processing
Legislation, including without limitation pseudonymizing and backing-up Personal Data and securing theaccount authentication credentials, systems and devices Customer uses to access the Gigamon Offerings.
3.3. Scope of Processing and Authorization.
3.3.1. Customer’s Instructions. By entering into this DPA, Customer instructs Gigamon to Process
Personal Data: (a) to provide the Gigamon Offerings, including Processing initiated by Customer’s users in theiruse of Offerings; (b) as authorized by the Agreement, including this DPA; and (c) as further documented in any
other written instructions given by Customer and acknowledged in writing by Gigamon. Where applicable,
Customer shall be responsible for any communications, notifications, assistance and/or authorizations that
may be required in connection with a Third-Party Controller.
3.3.2. Gigamon’s Compliance with Instructions. Gigamon will only Process Personal Data inaccordance with Customer’s instructions described in Section 3.3.1 unless Data Protection Legislation requires
otherwise, in which case Gigamon will notify Customer in writing (unless that law prohibits Gigamon fromdoing so on important grounds of public interest).
3.3.3. CCPA. As used in this sub-Section 3.3.3, the terms “Sell,” “Share,” “Business Purpose,”and “Commercial Purpose” shall have the meanings given in the CCPA and “Personal Information” shall mean
any personal information (as defined in the CCPA) contained in Personal Data. To the extent the CCPA applies,
Gigamon will not: (a) Sell or Share any Personal Information; or (b) retain, use, or disclose any Personal
Information (i) for any purpose other than for the Business Purposes specified in the Agreement, including for
any Commercial Purpose other than the Business Purposes specified in the Agreement, or as otherwise
permitted by the CCPA, or (ii) outside of the direct business relationship between Gigamon and Customer; or(c) combine Personal Information received from, or on behalf of, Customer with Personal Data received fromor on behalf of any third party, or collected from Gigamon’s own interaction with Data Subjects, except toCustomer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 3 of 11

perform any Business Purpose permitted by the CCPA. Gigamon hereby certifies that it understands theforegoing restrictions under this Section and will comply with them. The parties acknowledge that the
Personal Information disclosed by Customer to Gigamon is provided to Gigamon only for the limited andspecified purposes that constitute the Permitted Purpose. Gigamon will comply with applicable obligations
under the CCPA and provide the same level of privacy protection to Personal Information as is required by the
CCPA. Customer has the right to take reasonable and appropriate steps to help ensure that Gigamon uses the
Personal Information transferred in a manner consistent with Customer's obligations under the CCPA byexercising Customer's audit rights in Section 7 (Reviews and Audits of Compliance). Gigamon will notify
Customer if it makes a determination that Gigamon can no longer meet its obligations under the CCPA. If
Gigamon notifies Customer of unauthorized use of Personal Information, including under the foregoingsentence, Customer will have the right to take reasonable and appropriate steps to stop and remediate such
unauthorized use by limiting the Personal Information shared with Gigamon, terminating the portion of theAgreement relevant to such unauthorized use, or such other steps mutually agreed between the Parties inwriting.
3.4. Authorized Affiliates. Gigamon’s obligations set forth in this DPA shall also extend to Authorized
Affiliates, subject to the following conditions:3.4.1. Customer must exclusively communicate any additional Processing instructions requested
pursuant to 3.3.2 directly to Gigamon, including instructions from Authorized Affiliates;
3.4.2. Customer shall be responsible for Authorized Affiliates’ compliance with this DPA and allacts and/or omissions by an Authorized Affiliate with respect to Customer’s obligations in this DPA shall beconsidered the acts and/or omissions of Customer.
3.4.3. Authorized Affiliates may only bring a claim directly against Gigamon if they have accededin writing to this DPA. Otherwise, if an Authorized Affiliate seeks to assert a legal demand, action, suit, claim,
proceeding, or otherwise against Gigamon (“Authorized Affiliate Claim”), Customer must bring such Authorized
Affiliate Claim directly against Gigamon on behalf of such Authorized Affiliate, unless Data Protection
Legislation requires the Authorized Affiliate be a party to such claim.
4.

Data Deletion and Retention.
4.1. Deletion on Termination. On termination of the Agreement or expiry or termination of the Termand at the choice of the Customer, Gigamon will either delete or return (in a commonly machine-readable
format) the Personal Data to the Customer unless Data Protection Legislation requires or permits continued
retention and Processing of the Personal Data.
4.2. Retention. Personal Data will be retained as needed to fulfill the purposes for which it wascollected, such as delivery of the Gigamon Offerings, and as necessary for Gigamon to comply with its business
requirements, legal obligations, resolve disputes, protect its assets, and enforce its rights and agreements(“Business Requirements”). Gigamon will use commercially reasonable efforts to implement and maintainappropriate retention periods for Personal Data in accordance with Data Protection Legislation. Gigamon will
delete Personal Data when retention of such data is no longer necessary for the purposes of Processing under
this DPA, subject only to situations where a longer period is necessary for Gigamon’s Business Requirements
or is required under Data Protection Legislation or other governing laws.
5.

Data Security.
5.1. General. Taking into account the state of the art, the costs of implementation, and the nature,
scope context and purposes of the Processing as well as the risk of varying likelihood and severity to the rights
and freedoms of natural persons, the Parties shall implement and maintain appropriate technical andorganizational measures to ensure a level of security appropriate to the risk.
5.2. Gigamon Security Measures. Gigamon will implement and maintain technical and organizational

Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 4 of 11

measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of or access to Personal Data as described in the Security Measures Addendum to this
DPA, which may be found at www.gigamon.com/security-measures-addendum.pdf (the “Security Measures”),
and which is hereby incorporated into this DPA by reference.
5.3. Security Controls; Confidentiality of Processing. Gigamon may grant access to Personal Data toemployees, contractors and Sub-processors under an appropriate obligation of confidentiality (whether acontractual or statutory duty) when such access is required to perform their job duties.
5.4. Gigamon Security Assistance. Gigamon will (taking into account the nature of the Processing of
Personal Data and the information available to Gigamon) provide Customer with reasonable assistancenecessary for Customer to comply with its obligations in respect of Personal Data under Data Protection
Legislation, including Articles 32 to 36 (inclusive) of the EU GDPR and UK GDPR, by:
5.4.1. implementing and maintaining the Security Measures in accordance with Section 5.2(Gigamon Security Measures), and5.4.2. complying with the terms of Section 6 (Notice and Communication).
5.5 No Assessment of Personal Data by Gigamon. Gigamon shall have no obligation to assess thecontents or accuracy of Personal Data, including to identify information subject to any specific legal,
regulatory, or other requirement. Customer is responsible for reviewing the information made available by
Gigamon relating to data security and making an independent determination as to whether the Offerings meet
Customer’s requirements and legal obligations under Data Protection Legislation.
6.

Notice and Communication.
6.1. Notification of Security Incident. If Gigamon becomes aware of a Security Incident, Gigamon will(a) promptly take reasonable steps to investigate the Security Incident and (b) notify Customer of the Security
Incident without undue delay, in accordance with governing law.
6.2. Communication. Gigamon shall provide Customer timely information about the Security Incident
including, to the extent known to Gigamon: (a) description of the nature of the Security Incident, (b) the nameand contact details for the contact point to find more information, (c) a description of likely consequences of
the Security Incident, (d) a description of the measures taken or proposed to be taken to address the Security
Incident including, where appropriate, measures to mitigate its possible adverse effects, and (e) such otherinformation as is necessary for Customer to carry out Customer’s notification obligations related to the
Security Incident, including, but not limited to, to assist Customer in complying with Articles 33 and 34 of EU
GDPR. Notwithstanding the foregoing, Customer acknowledges that because Gigamon personnel may nothave visibility to the content of Personal Data, it may be unlikely that Gigamon can provide information as tothe particular nature of the Personal Data, or where applicable, the identities, number or categories ofaffected Data Subjects. Communications by or on behalf of Gigamon with Customer in connection with a
Security Incident shall not be construed as an acknowledgment by Gigamon of any fault or liability with respect
to the Security Incident.
6.3 Complaints or Notices Related to Personal Data. If Gigamon receives any official complaint,
notice, or communication that relates to Gigamon's Processing of Personal Data or either Party's compliancewith Data Protection Legislation in connection with Personal Data, to the extent legally permitted, Gigamon
shall promptly notify Customer and, to the extent applicable, Gigamon shall provide Customer withcommercially reasonable cooperation and assistance in relation to any such complaint, notice, orcommunication. Customer shall be responsible for any reasonable costs arising from Gigamon’s provision ofassistance in relation to any official complaint, notice, or communication that relates to Customer’s
compliance with Data Protection Legislation.
7.

Reviews and Audits of Compliance.

Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 5 of 11

7.1. Audit. Customer may audit Gigamon’s compliance with its obligations under this DPA as requiredby Data Protection Legislation, but not more than once per year unless required by Data Protection
Legislation, including where mandated by Customer’s supervisory authority. Gigamon will contribute to suchaudits by providing Customer or Customer’s supervisory authority with the information and assistancereasonably necessary to conduct the audit. Customer acknowledges and agrees that any exercise of its audit
rights under applicable Data Protection Legislation will be conducted in accordance with this DPA.
7.2. Third Party. If a third party is to conduct the audit, Gigamon may object to the auditor if theauditor is, in Gigamon’s reasonable opinion a competitor of Gigamon. Such objection by Gigamon will require
Customer to appoint another auditor or conduct the audit itself.
7.3. Process. Subject to Section 6 (Notice and Communication) in relation to a Security Incident andaside from in the event of an investigation of a supervisory authority, to request an audit, Customer must
submit a detailed proposed audit plan to Gigamon at least thirty (30) days in advance of the proposed audit
date and any third party auditor must sign a customary non-disclosure agreement mutually acceptable to theparties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all
information exchanged in connection with the audit and any reports regarding the results or findings thereof.
Customer shall be solely responsible for the actions or inaction of any such third party, including without
limitation any breaches of confidentiality. The proposed audit plan must describe the proposed scope,
duration, and start date of the audit. Gigamon will review the proposed audit plan and provide Customer withany concerns or questions (for example, any request for information that could compromise Gigamon security,
privacy, employment or other relevant policies). Gigamon will work cooperatively with Customer to agree on a
final audit plan. Nothing in this Section shall require Gigamon to disclose any information where suchdisclosure would result in a breach of any duties of confidentiality.
7.4. Documents. If the controls or measures to be assessed in the requested audit are addressed in an
SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor withintwelve (12) months of Customer’s audit request and Gigamon has confirmed there are no known materialchanges in the controls audited, Customer agrees to accept such report in lieu of requesting an audit of suchcontrols or measures.
7.5. Timing. The audit must be conducted during regular business hours, subject to the agreed final
audit plan and Gigamon’s safety, security or other relevant policies, and may not unreasonably interfere with
Gigamon business activities.
7.6. Reports. Customer will promptly notify Gigamon of any non-compliance discovered during thecourse of an audit and provide Gigamon any audit reports generated in connection with any audit under thisSection 7, unless prohibited by Data Protection Legislation or otherwise instructed by a supervisory authority.
Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit
requirements and/or confirming compliance with the requirements of this DPA. The reports, audit, and any
information arising therefrom shall be considered Gigamon's Confidential Information and may only be sharedwith a third party (including a Third-Party Controller) with Gigamon's prior written agreement.
7.7. Costs. Any audits are at Customer’s expense. Customer will be responsible for any fees charged byany auditor appointed by Customer to execute any such audit. Gigamon may charge a fee, to be mutuallyagreed by the parties in advance, for any such audit; rates shall be reasonable, taking into account theresources expended by Gigamon. Nothing in this DPA shall be construed to require Gigamon to furnish more
information about its Sub-processors in a connection with such audits than such Sub-processors makeavailable to Gigamon without restriction on further disclosure.
8.
Impact Assessments and Consultations. Gigamon will provide reasonably requested information
regarding the Gigamon Offerings to enable Customer to carry out impact assessments or prior consultations
with data protection authorities as required by applicable Data Protection Legislation, including, if applicable,
Customer’s obligations pursuant to Articles 35 and 36 of the EU GDPR and UK GDPR, by (a) making available for
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 6 of 11

review copies of the Security Documentation or other documentation or information describing relevant
aspects of Gigamon’s information security program and the security measures applied in connection
therewith; and (b) providing the other information contained in the Agreement including this DPA. Gigamon
shall additionally provide such reasonable assistance to Customer, taking into consideration the nature of theOfferings provided, to the extent needed by Customer in connection with a data protection impact assessment
as required to comply with applicable Data Protection Legislation.
9.

Data Subject Requests.
9.1. Customer’s Responsibility for Requests. Gigamon shall promptly notify Customer if Gigamon
receives a request from a Data Subject that identifies Personal Data related to Customer or that otherwise
identifies Customer, including where the Data Subject seeks to exercise any of its rights under applicable Data
Protection Legislation. During the Term or as otherwise required by applicable Data Protection Legislation, if
Gigamon receives any request from a Data Subject in relation to the Data Subject’s Personal Data Processed inconnection with the Gigamon Offering, to the extent legally permitted Gigamon will advise the Data Subject tosubmit their request to Customer and Customer will be responsible for responding to any such request, subject
to the assistance to be provided by Gigamon pursuant to Section 9.2 below.
9.2. Gigamon’s Data Subject Request Assistance. Gigamon will provide (taking into account the natureof the Processing of Personal Data) Customer with reasonable assistance as necessary for Customer toperform its obligation under Data Protection Legislation to respond to requests by Data Subjects, including if
applicable, Customer’s obligation to respond to requests for exercising the Data Subject’s rights set out in
Chapter III of the EU GDPR and in the UK GDPR.
10.

Transfers of Personal Data.
10.1. Data Storage and Processing Facilities. Gigamon may, subject to this Section 10, store and Process
Personal Data in the United States or anywhere Gigamon or its Sub-processors maintains facilities.
10.2. Transfer Mechanisms. For any transfers of Personal Data from the EEA and its member states,
United Kingdom and/or Switzerland or other jurisdictions to a country which is not an Approved Jurisdiction,such transfers and Processing shall be governed by a valid mechanism for the lawful transfer of Personal
Data recognized under applicable Data Protection Legislation, such as those below:
10.2.1. EU Standard Contractual Clauses. With respect to transfers of Personal Data protected by
the EU GDPR outside an Approved Jurisdiction, such transfers shall be subject to the EU Standard Contractual
Clauses, which shall be deemed incorporated into and form part of this DPA, including the election of specificterms and/or optional clauses of the EU SCCs as described in more detail in (a)-(j) below, and any optionalclauses not expressly selected are not included:a) The Module 2 terms shall apply (Controller to Processor);b) The optional Clause 7 in Section I of the EU SCCs is incorporated, and Authorized
Affiliates may accede in a signed writing to this DPA and the SCCs under the same terms and conditions
as Customer, subject to Section 3.4 (Authorized Affiliates) of this DPA via mutual agreement of theParties;c) For purposes of Clause 9 of the EU SCCs, Option 2 (“General written authorization”) is
selected and the process and time period for the addition or replacement of Sub-processors shall be as
described in Section 11 (Sub-processing) of this DPA;d) The optional paragraph in Clause 11 of the EU SCCs is not incorporated;e) For purposes of Clause 13 and Annex 1.C of the SCCs, Option 1 will apply if Customer
has an establishment in the European Union, Option 2 will apply if Customer is not established in theEuropean Union and has an appointed representative, and Option 3 will apply if Customer has neither
an establishment nor a representative in the European Union. Customer shall maintain accurate
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 7 of 11

records of the applicable Member State(s) and competent supervisory authority, which shall be madeavailable to Customer on request;f) For purposes of Clause 17 and Clause 18 of the SCCs, Option 1 of Clause 17 is selected
and the Member State for purposes of governing law and jurisdiction shall be the Federal Republic of
Germany;g) For purposes of Annex 1.A, the “data importer” shall be Gigamon and the “dataexporter” shall be Customer and any Authorized Affiliates that have acceded to the SCCs pursuant to thisDPA;h) For purposes of Annex 1.B, the description of the transfer is as described in Appendix
1 of this DPA;i) For purposes of Annex 1.C, The competent supervisory authority in accordance with
Clause 13 is the supervisory authority associated with Customer’s establishment or representative inaccordance with Clause 13 of the SCCs; andj) For purposes of Annex II, the technical and organization measures are those measuresdescribed in Section 5.2 (Gigamon Security Measures) of this DPA.
10.2.2. UK Addendum. With respect to transfers of Personal Data protected by the UK GDPR
outside an Approved Jurisdiction, the EU SCCs will also apply in accordance with the paragraphs in Section
10.2.1 (a)-(j) above, subject to the following modifications:a) Part 1: Tables (found at https://ico.org.uk/media/fororganisations/documents/4019539/international-data-transfer-addendum.pdf)
i.
Table 1 will be filled out with the Parties as set forth in Section
10.2.1(g);ii.
Table 2 will be filled out with the selected SCCs, Modules and Selected
Clauses as set forth in Sections 10.2.1(a)-(d);iii.
Table 3 will be filled out with the information as set forth in Sections
10.2.1(g), (h), (j) and the Subprocessor Addendum (as described
below); andiv.
Table 4 will be filled out by selecting “neither Party” may end the UK
Addendum as set out in Section 19 of the UK Addendum.
b) The following Alternative Part 2 of the Mandatory Clauses shall apply: Mandatory
Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by
the Information Commissioner’s Office (the “ICO”) of the UK and laid before the UK
Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January2022, as it is revised under Section 18 of those Mandatory Clauses.10.2.3.
10.2.3.
Swiss Standard Contractual Clauses. With respect to transfers of Personal Data
protected by the FADP, the EU SCCs will also apply in accordance with the paragraphs in Section 10.2.1 (a)-(j)above, subject to the following modifications: (a) the term “member state” as used in the SCCs shall not beinterpreted in such a way as to exclude Data Subjects in Switzerland from suing for their rights in their place ofhabitual residence in accordance with Clause 18(c) of the SCCs; (b) the SCCs shall also protect the data of legal
entities until the entry into force of the revised FADP; (c) references to the GDPR or other governing law
contained in the SCCs shall also be interpreted to include the FADP; and (d) the parties agree that thesupervisory authority as indicated in Annex I.C of the SCCs shall be the Swiss Federal Data Protection andInformation Commissioner.
11.

Sub-Processing.
11.1. Authorized Sub-Processors. For purposes of Clause 9 of the Standard Contractual Clauses,

Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 8 of 11

Customer provides Gigamon with a general consent to engage Sub-processors, subject to Section 11.3
(Changes to Sub-processors), as well as Gigamon’s current Sub-processors already engaged as of the DPA
Effective Date and as listed in the Sub-processor Addendum to this DPA located at www.gigamon.com/subprocessor-addendum.pdf, which is hereby incorporated into this DPA by reference, subject to Gigamon
ensuring those Sub-processors meet obligations in this DPA.
11.2. Sub-Processor Obligations. Gigamon shall: (i) enter into a written agreement with each Subprocessor imposing data protection obligations no less protective of Personal Data as Gigamon’s obligations
under this DPA to the extent applicable to the nature of the services provided by such Sub-processor; and (ii)remain liable for each Sub-processor’s compliance with the obligations under this DPA. Upon written request,
and subject to any confidentiality restrictions, Gigamon shall provide Customer all relevant information it
reasonably can in connection with its applicable Sub-processor agreements where required to satisfy
Customer’s obligations under Data Protection Legislation.
11.3. Changes to Sub-Processors. Gigamon shall notify Customer (for example, by updating the SubProcessor Addendum, which may be found at www.gigamon.com/sub-processor-addendum.pdf, or by
publishing this information at Gigamon’s customer portal or www.gigamon.com/legal.html, or by e-mail or
in-application messaging) of any new Sub-processor at least fourteen (14) business days in advance ofallowing the new Sub-processor to Process Personal Data (the “Objection Period”). During the Objection
Period, objections (if any) to Gigamon’s appointment of the new Sub-processor must be provided to
Gigamon in writing and based on reasonable grounds relating to data protection. In such event, the Parties
will discuss those objections in good faith with a view to achieving resolution. If it can be reasonably
demonstrated to Gigamon that the new Sub-processor is unable to Process Personal Data in compliance withthe terms of this DPA and Gigamon cannot provide an alternative Sub- processor, or the Parties are nototherwise able to achieve resolution as provided in the preceding sentence, Customer may provide written
notice to Gigamon terminating the purchases with respect only to those aspects of the Offerings whichcannot be provided by Gigamon without the use of the new Sub-processor.
12. Government, Law Enforcement, and/or Third-Party Inquiries. If Gigamon receives a demand to retain,
disclose, or otherwise Process Personal Data for any third party, including, but not limited to law enforcement
or a government authority (“Third-Party Demand”), then Gigamon shall attempt to redirect the Third-Party
Demand to Customer. Customer agrees that Gigamon can provide information to such third-party as
reasonably necessary to redirect the Third-Party Demand. If Gigamon cannot redirect the Third-Party Demand
to Customer, then Gigamon shall, to the extent legally permitted to do so, provide Customer reasonable
notice of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek aprotective order or other appropriate remedy. This section does not diminish Gigamon’s obligations under the
EU SCCs or UK Addendum with respect to access by public authorities.
13.

Miscellaneous.
13.1. Notices. Notwithstanding anything to the contrary in the Agreement, any notices required or
permitted to be given by Gigamon to Customer under this DPA may be given (a) in accordance with the noticeclause of the Agreement; and/or (b) as described in Section 6.1 (Notification of Security Incident) of this DPA if
applicable; and/or (c) to Gigamon’s primary points of contact with Customer.
13.2. General. The Parties agree that this DPA shall replace and supersede any existing data processing
addendum, attachment, exhibit or standard contractual clauses that Gigamon and Customer may havepreviously entered into in connection with the Gigamon Offerings. Except as expressly modified by the DPA,
the terms of the Agreement remain in full force and effect. To the extent of any conflict or inconsistency
between this DPA and the remaining terms of the Agreement regarding the subject matter herein, this DPA
shall govern. To the extent of any conflict or inconsistency between the body of this DPA and its Addenda (notincluding the Standard Contractual Clauses) and the relevant Standard Contractual Clauses in a way that
Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 9 of 11

materially affects the adequacy of the transfer, the Standard Contractual Clauses shall prevail. In the event of
any conflict between this DPA and the relevant Data Protection Legislation, the provisions under the Data
Protection Legislation shall prevail. Notwithstanding anything to the contrary in the Agreement or this DPA,
each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this
DPA, the SCCs, and any other data protection agreements in connection with the Agreement (if any), shall be
subject to any aggregate limitations on liability set out in the Agreement. Nothing in this DPA is intended tolimit the Parties’ direct liability towards Data Subjects or applicable supervisory data protection authorities
that may not be limited under mandatory applicable law.
13.3. No Third Party Rights. In no event shall this DPA benefit or create any right or cause of action on
behalf of a third party (including a Third-Party Controller), but without prejudice to the rights or remedies
available to Data Subjects under Data Protection Legislation or this DPA (including the SCCs).
13.4. Governing Law. Except as otherwise set forth in this DPA, this DPA will be governed by andconstrued in accordance with governing law and jurisdiction provisions in the Agreement or in the event that
the Agreement is silent, in accordance with the law of the State of California and the United States without
regard to conflicts of laws provisions.

Customer DPA and SCCs (Gigamon as Supplier) v.clickthrough 2023.07.07

Page 10 of 11

Appendix 1 to the DPA – GIGAMON OFFERINGS
Subject Matter and Details of the Data Processing
Subject Matter

Gigamon’s delivery of Gigamon Offerings.

Duration of Processing

Duration of the applicable purchase order.

Nature of the Processing

Collection, storage, organization, retrieval, erasure, modification, and any other
Processing operation anticipated by Customer using the Gigamon Offerings.

Purpose of the Processing

Gigamon’s delivery of Gigamon Offerings.

Categories of Personal Data

Contact Information: Gigamon receives and uses contact information (name, email, title,
phone, address) for Customer’s employees for billing purposes. Gigamon may also
receive contact information of our customer’s employees, when these employees
contact Gigamon’s Customer Success organization requesting assistance with productissues.
Metadata: In select circumstances and only upon Customer’s initiation and direction,
Customer may provide network access to Gigamon’s Support Engineers or Professional
Services Team, or transmit select packet capture data (including metadata) to Gigamon’s
Support Team and as a result Gigamon will have access to metadata associated withpackets traveling through Customer’s network for the sole purpose of providing Support
or delivering Gigamon Professional Services. This metadata may contain domain, file oruser names, and depending on the naming conventions used by the originator of thepacket to which the metadata pertains, may include Personal Data.

Sensitive data transferred

N/A

Frequency of the transfer

Continuous

Categories of Statutorily
Defined Data Subjects for
Whom the Customer’s
Personal Data Relates

Data Subjects such as Customer’s system user’s data and other individuals whose
Personal Data Customer is responsible for, and which Personal Data is Processed inconnection with support and or delivery of Gigamon Offerings.

For transfers to subprocessors, also specify
subject matter, nature andduration of the processing

The subject matter, nature, and duration of Processing undertaken by Subprocessors will be the same as set forth in this DPA with respect to Gigamon.

Appendix 1 to Customer DPA and SCCs (Gigamon as Supplier) 2023.07.07

Page 11 of 11