Page 1 of 9
DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") forms part of the Terms available at sli.do/terms (“Terms”)
between Slido and Customer. Slido and Customer are each a “Party” and collectively, the “Parties”.
Except as modified below, the Terms shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the Parties hereby agree that:
The terms and conditions set out below shall be added as an addendum to the Terms.
Except where the context requires otherwise, references in this DPA to the Terms are to the Terms as
amended by, and including, this DPA.

DEFINITIONS AND INTERPRETATIONIn this DPA, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly:“Applicable Data Privacy Law” means EU General Data Protection Regulation 2016/679 (“GDPR”), California
Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), and any
related regulations or guidance provided by the California Attorney General, or any other applicable dataprotection or privacy law where applicable;“Customer Personal Data” means any Personal Data or Personal Information Processed by Slido on behalfof the Customer pursuant to or in connection with the Terms and this DPA;
“Standard Contractual Clauses” means the relevant model contract clauses adopted by the European
Commission which can be used as a ground for data transfers from the EU to third countries;“Appropriate Safeguards” means such legally enforceable mechanism(s) for transfers of Personal Data as
may be permitted under the Applicable Data Privacy Law, especially but not limited to Art 46 GDPR.
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Terms or the
Applicable Data Privacy Law.
The word “include” shall be construed to mean include without limitation, and cognate terms shall be
construed accordingly.

Version 1.10 online

Page 2 of 9
1. PROCESSING OF CUSTOMER PERSONAL DATA
1.1.
Role of the Parties. The Parties acknowledge and agree that with regard to the Processing ofCustomer Personal Data, Customer is the Controller (or Business), Slido is the Processor (or Service
Provider) and that Slido will engage Subprocessors pursuant to the requirements set out in Clause 4
Subprocessors below.
1.2.
Customer’s Processing of Customer Personal Data. Customer shall, in its use of the Services
and instructions to Slido:a) comply with Applicable Data Privacy Law in their Processing of Customer Personal Data; andb) have sole responsibility for the accuracy, quality and legality of Customer Personal Data and themeans by which Customer acquired Customer Personal Data.
1.3.

Slido’s Processing of Customer Personal Data. Slido shall:a) comply with Applicable Data Privacy Law in their Processing of Customer Personal Data; andb) treat Customer Personal Data as Confidential Information; andc) not Process Customer Personal Data other than on the relevant Customer’s documented
instructions unless Processing is required by Applicable Data Privacy Law, in which case Slido shallto the extent permitted by applicable laws inform Customer of that legal requirement before therelevant Processing of that Customer Personal Data; andd) act and shall continue to act, solely as Customer’s Processor (or Service Provider) with respect to all
Customer Personal Data transferred to Slido under the Terms; ande) is prohibited from selling Customer Personal Data, and retaining, using or disclosing Customer
Personal Data (i) for any purpose other than for the specific purpose of performing under the Terms,or (ii) outside of the direct business relationship between Customer and Slido.
Slido certifies that Slido understands the restrictions in this clause and will comply with them inaccordance with Applicable Data Privacy Laws.
1.4.
Processing Instructions. Customer instructs Slido and authorises Slido to Process Customer
Personal Data; and transfer Customer Personal Data according to clause 10, as reasonably
necessary:a) for the provision of the Services and consistent with the Terms and this DPA;b) to comply with other documented reasonable instructions provided by Customer where such
instructions are consistent with the Terms and this DPA.
1.5.

Details of the Processing. Exhibit 1 to this DPA sets out:a) the subject matter and duration of the Processing of Customer Personal Data;

Version 1.10 online

Page 3 of 9b) the nature and purpose of the Processing of Customer Personal Data;c) the categories of Data Subject (or Consumer) to whom the Customer Personal Data relates; andd) the types of Customer Personal Data to be Processed.

2. DATA SUBJECT (OR CONSUMER) RIGHTS
2.1.
Data Subject (or Consumer) Request. Slido shall, to the extent legally permitted, notify
Customer at the email address associated with the licence owner without undue delay if Slido
receives a request from a Data Subject (or Consumer) to exercise the Data Subject’s (orConsumer’s) right of access (or disclosure), right to rectification, restriction of Processing, erasure(or deletion or the “right to be forgotten”), data portability, object to the Processing, or its right not tobe subject to an automated individual decision making (“Data Subject (or Consumer) Request”). The
Parties must not discriminate against a Consumer because they exercised their rights.
2.2.
Slido Assistance. Taking into account the nature of the Processing, Slido shall assist Customer
by implementing appropriate technical and organisational measures, insofar as this is possible, forthe fulfilment of the Customer’s obligations to respond to requests to exercise Data Subject (orConsumer) rights under the Applicable Data Privacy Law. Slido shall not be liable for Customer’s
failure to address Data Subject (or Consumer) Requests.

3. SLIDO PERSONNEL
3.1.
Confidentiality. Slido shall ensure that its personnel engaged in the Processing of Customer
Personal Data are informed of the confidential nature of Customer Personal Data, have received
appropriate training on their responsibilities and have executed written confidentiality agreements or
are under an appropriate statutory obligation of confidentiality. Slido shall ensure that confidentiality
obligations regarding Customer Personal Data survive the termination of the personnel
engagement.
3.2.
Limitation of access. Slido shall ensure in each case that access is strictly limited to thoseindividuals who need to know / access the relevant Customer Personal Data, as strictly necessary
for the purposes of the Terms and this DPA, and to comply with Applicable Data Privacy Laws in thecontext of that individual's duties to Slido.

4. SUBPROCESSING
4.1.
Appointment. Customer authorises Slido to appoint Subprocessors in connection with theServices and in accordance with this Clause 4.

Version 1.10 online

Page 4 of 9

4.2.

Current Subprocessors.

SUBPROCESSORPURPOSEPERSONAL
DATA

Amazon Web
Services, Inc.

Infrastructure
as a service

Contact data,
Content data

LOCATIONWHEREPERSONAL
DATA ISHOSTEDDATA
TRANSFERSAFEGUARD

Ireland,Germany

Standard
Contractual
Clauses

Our parent company Cisco Systems Inc. and its subsidiaries may also act as Subprocessors insome circumstances under Standard Contractual Clauses entered into.
New Subprocessors. Slido will notify customers of new Sub-processors by updating the list of
Sub-processors on the Website. Customer may also sign up to receive notifications of new
Sub-processors via e-mail by e-mailing legal@slido.com with the subject “Subscribe to New
Subprocessor Notifications” and specifying the email address such notifications should be sent to.
If, within a reasonable time specified in the notice, Customer notifies Slido in writing of any
objections to the proposed appointment based on reasonable grounds relating to data protection:
Slido shall work with Customer in good faith to make available a commercially reasonable change inthe provision of the Services which avoids the use of that proposed Subprocessor. Where such achange cannot be made, notwithstanding anything in the Terms, Customer may by written notice to
Slido with immediate effect terminate the relationship to the extent that it relates to the Services
which require the use of the proposed Subprocessor. Such termination is without prejudice to any
fees incurred by Customer prior to the termination.
4.3.

With respect to each Subprocessor, Slido shall:a) carry out adequate due diligence before the Subprocessor first Processes Customer Personal
Data to ensure that the Subprocessor is capable of providing the level of protection for
Customer Personal Data required by the Applicable Data Privacy Law;b) ensure that the arrangement between on the one hand Slido and on the other hand theSubprocessor, is governed by a written contract including terms which offer at least the samelevel of protection for Customer Personal Data as those set out in the Applicable Data Privacy
Law.

4.4.
Liability. Slido shall be liable for the acts and omissions of its Subprocessors to the same
extent Slido would be liable if performing the services of each Subprocessor directly under theterms of this DPA.
Version 1.10 online

Page 5 of 9

5. SECURITY
5.1.
Slido obligations. Taking into account the state of the art, the costs of implementation and thenature, scope, context and purposes of Processing as well as the risk of varying likelihood andseverity for the rights and freedoms of natural persons, Slido shall, at its cost and expense, in
relation to Customer Personal Data implement appropriate technical and organizational measures inaccordancewiththeSecurity
Appendixavailableathttps://trustportal.cisco.com/c/r/ctp/trust-portal.html#/1604543381171981 to ensure a level of
security appropriate to that risk, including, as appropriate, the measures referred to in the Applicable
Data Privacy Law, especially Article 32 of the GDPR. In assessing the appropriate level of security,
Slido shall take account in particular of the risks that are presented by Processing, in particular froma Personal Data Breach.
5.2.
These measures should entail physical, logical and data access control as well as data transfer,
instruction, entry, availability and separation control.
5.3.
Customer obligations. Notwithstanding the above, Customer agrees that except as provided bythis DPA, Customer is responsible for its secure use of the Services, including securing its accountauthentication credentials, protecting the security of Customer Personal Data when in transit to andfrom the Services.

6. PERSONAL DATA BREACH
6.1.
Slido shall notify Customer at the email address associated with the licence owner without
undue delay upon Slido becoming aware of a Personal Data Breach affecting Customer Personal
Data, providing Customer with sufficient information to allow Customer to meet its obligations toreport or inform Data Subject (or Consumers) of the Personal Data Breach under the Applicable
Data Privacy Law.
6.2.
Slido shall co-operate with Customer and take such reasonable commercial steps as are
directed by Customer to assist in the investigation, mitigation and remediation of each such
Personal Data Breach.
6.3.
Slido shall promptly resolve as far as possible, at its own cost and expense, all data protection
and security issues discovered by Customer and reported to Slido that reveal a breach or potential
breach by Slido of its obligations under the Applicable Data Privacy Law.
6.4.
If Slido is in breach of its obligations under this DPA, Customer may suspend the transfer ofCustomer Personal Data to Slido until the breach is remedied.

Version 1.10 online

Page 6 of 9
7. ASSISTANCE, INFORMATION, RECORDS AND AUDIT
7.1.
Slido shall assist the Customer in ensuring compliance with the obligations pursuant to Articles
32 to 36 of the GDPR taking into account the nature of processing and the information available.
7.2.
Slido contracts with respected external security firms who perform regular audits of the Slido
Services to verify that our security practices are sound and to monitor Slido Services for any new
vulnerabilities discovered by security research community. The most recent report from the audit isavailable upon Customer request once the Customer enters into a non-disclosure agreement with
Slido.
7.3.
Slido shall make available to the Customer all information necessary to demonstratecompliance with the obligations laid down in the Applicable Data Privacy Law and upon reasonable
notice by Customer and at Customer’s expense allow for and contribute to audits, including
inspections, conducted by Customer or another auditor mandated by Customer. Before thecommencement of any such on-site audit, Customer and Slido shall mutually agree upon the scope,timing, and duration of the audit, in addition to a reasonable reimbursement rate. Customer shallpromptly notify Slido with information regarding any noncompliance discovered during the course of
an audit in order to allow Slido to deal with it promptly.

8. DELETION OR RETURN OF CUSTOMER PERSONAL DATA
8.1.
Slido shall, at the choice of the Customer, delete or return all the Customer Personal Data to theCustomer after the end of the provision of Services, and deletes existing copies unless applicablelaw requires storage of the Customer Personal Data.

9. LIMITATION OF LIABILITY
9.1.
Unless expressly provided otherwise, each Party’s liability, taken together in the aggregate,
arising out of or related to this DPA, whether in contract, tort or under any other theory of liability is
subject to the limitation of liability clauses of the Terms.

10. TRANSFER MECHANISMS
10.1. In the absence of an adequacy decision, Customer Personal Data may only be transferred to athird country outside the EEA or to an international organisation where there are Appropriate
Safeguards.

11. NOTIFICATION

Version 1.10 online

Page 7 of 9
11.1. Should Slido receive a request from a court or a government agency relating to Customer
Personal Data, Slido will notify the Customer that its personal data has been requested, unlessapplicable law prohibits disclosure.

GENERAL TERMS
12. Term
12.1. The term of this DPA shall correspond to the term of the Terms.
13. Authority and Third Parties
13.1. Parties warrant and represent that they have full power and authority to enter into and performtheir respective obligations under the DPA.
13.2. Except as otherwise provided hereunder or under applicable law, no one other than a Party to this
DPA, its successors and permitted assigns shall have any right to enforce any of its terms.
14. Governing Law and Jurisdiction
14.1. The Parties to this DPA hereby submit to the jurisdiction of Slovak courts with respect to any
disputes or claims howsoever arising under this DPA, and this DPA and all non-contractual or otherobligations arising out of or in connection with it are governed by the laws of the Slovak Republic
notwithstanding the conflict of law provisions and other mandatory legal provisions.
15. Order Of Precedence
15.1. The Parties agree that DPA shall replace any existing DPA the Parties may have previously enteredinto in connection with the Services.
15.2. Nothing in this DPA reduces Slido's obligations under the Terms in relation to the protection ofCustomer Personal Data or permits Slido to Process (or permit the Processing of) Customer
Personal Data in a manner which is prohibited by the Terms.
15.3. With regard to the subject matter of this DPA, in the event of inconsistencies between theprovisions of this DPA and any other agreements between the parties, including the Terms andincluding (except where explicitly agreed otherwise in writing, signed on behalf of the Parties)
agreements entered into or purported to be entered into after the date of this DPA, the provisionsof this DPA shall prevail.

Version 1.10 online

Page 8 of 9
16. Severance
16.1. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shallremain valid and in force. The invalid or unenforceable provision shall be either (i) amended asnecessary to ensure its validity and enforceability, while preserving the Parties’ intentions as
closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or
unenforceable part had never been contained therein.
IN WITNESS WHEREOF, this DPA is entered into and becomes a binding part of the Terms.
EXHIBIT 1: DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATAThis Exhibit 1 includes certain details of the Processing of Customer Personal Data as required by
Applicable Data Privacy Law.
Subject matter and duration of the Processing of Customer Personal Data
Subject matter: The subject matter of the Processing under this DPA is the types of Customer Personal
Data as listed in this Exhibit 1.
Duration: Personal Data may be Processed and stored for the period necessary to fulfil the agreed purposesof processing pursuant to and for the duration of this DPA and to comply with Applicable Data Privacy Law.
This will generally be for the Term plus the period from the expiry of the Term until deletion of all Customer
Data by Slido in accordance with its back up policies.
The Service offers certain controls for the Users to delete their data.
The nature and purpose of the Processing of Customer Personal Data
Nature: Slido provides a software as a service solution through a cloud based platform that enables
real-time active engagement of participants at Events organised by organisers as described in the Terms.
Purpose: The purpose of the Customer Personal Data Processing under this DPA is:a) to allow Slido to provide the Services to the Customer as described in the Terms and consistently
with this DPA;b) to comply with other documented reasonable instructions provided by Customer where such
instructions are consistent with the Terms and this DPA or to process requests initiated by
Customer or Customer’s Users in their use of the Services;c) to comply with any legal obligation.
The categories of Data Subject (or Consumer) to whom the Customer Personal Data relates
Version 1.10 online

Page 9 of 9
Participants of Customer’s Events.
The types of Customer Personal Data to be Processed under this DPA
Any Customer Personal Data submitted by participants via the Service in their sole discretion contained in:a) Participant profile data (name, email address, company)b) Event content data in Enterprise plans (questions, poll answers, ideas, chats - simply content sharedby participants and related to an identified/ identifiable individual)
Special categories of data
It is against the Terms to submit special categories of data via the Service. Notwithstanding the foregoingand subject to the execution of a written Business Associate Agreement (“BAA”) under the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”) between Customer as a covered entity under
HIPAA and Slido, Customer with an Enterprise plan may collect protected health information as definedwithin the HIPAA in the content fields via the Service in their sole discretion and in accordance with theterms set forth in the BAA and this DPA.

Version 1.10 online