DATA PROCESSING ADDENDUM(FOR EEA/UK USERS)
Pursuant to the RevComm T&Cs of Use entered into between RevComm Inc. and its subsidiaries and affiliates(“RevComm”) and Customer made available at https://www.revcomm.co.jp/terms-english/ (together with otherreferenced policies and addenda in the RevComm T&Cs of Use, the “Agreement”), the Parties hereby adopt this Data
Processing Addendum (For EEA/UK Users) (“DPA”) for so long as RevComm processes Personal Data on behalf ofCustomer located in the EEA and the UK in relation to the services or software provided by RevComm (the “Services”).
This DPA prevails over any conflicting terms of the Agreement.
BY EXECUTING AN ORDER FORM OR ACCEPTING AN ONLINE ORDER CONFIRMATION OR OTHERWISEACCESSING OR USING THE SERVICES, CUSTOMER AGREES THAT CUSTOMER HAS READ, UNDERSTOOD
AND AGREES TO BE BOUND BY THIS DPA. IF CUSTOMER DOES NOT AGREE TO THIS DPA, THEN
CUSTOMER MAY NOT USE THE SERVICES.
Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.
1.

DEFINITIONS. For the purposes of this DPA,
1.1. “EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the freemovement of such data.
1.2. “UK GDPR” means the EU GDPR as amended and incorporated into UK law under the European Union(Withdrawal) Act 2018, and applicable secondary legislation made under that Act.
1.3. “GDPR” means, as applicable: (a) the EU GDPR; or (b) the UK GDPR.
1.4. “Controller”, “Data Subject”, “Personal Data”, “Processing” (and any derivatives thereof),“Processor”, “Personal Data Breach” have the meaning given to them in the GDPR.
1.5.

“EU Standard Contractual Clauses” means the standard contractual clauses for international transfers
annexed to the European Commission’s implementing decision on standard contractual clauses for thetransfer of personal data to third countries pursuant to Regulation (EU) 2016/679 published on 4 June
2021(available
at:https://eur-lex.europa.eu/legalcontent/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN), as completed by Clause 7.1(a) of thisAgreement.

1.6. “UK Addendum” means the International Data Transfer Addendum(s) to the EU Commission Standard
Contractual Clauses issued by the Information Commissioner’s Office with effect from 22 March 2022
(available at : https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transferaddendum.pdf), as completed by Clause 7.1(b) of this Agreement.
1.7. “Standard Contractual Clauses” means the EU Standard Contractual Clauses and the UK Addendum,
as the context requires.
1.8. “Regulatory Authority” means any governmental, statutory or regulatory body and other competentauthority in any jurisdiction (or persons or entities appointed by or on the direction of such authority orbody).
1.9. “Relevant Data Transfer(s)” means the transfer(s) of Personal Data described in Appendix I to this
DPA, together with all other applicable transfers of Personal Data between the Parties.
2.

Scope, Roles, and Termination.
2.1 Applicability - This DPA applies only to RevComm’s Processing of Personal Data for the nature,
purposes, and duration set forth in Appendix I.
2.2 Roles of the Parties - For the purposes of the Agreement and this DPA, Customer is the Party responsiblefor determining the purposes and means of Processing Personal Data as the Controller and appoints
RevComm as a Processor to Process Personal Data on behalf of Customer for the limited and specificpurposes set forth in Appendix I.

2.3 Conflicts between agreements - The Parties acknowledge that as a matter of law the Standard
Contractual Clauses shall prevail over any contradictory provisions in any agreement(s) between theParties.
2.4 Severability - Notwithstanding Clause 2.3 above, where Standard Contractual Clauses conflict with theprovisions of any agreement(s) the Parties agree that the positions in the Standard Contractual Clauses
shall prevail only to the extent required by law in relation to the applicable data transfers and shall not
replace previously agreed upon positions regarding the provision of goods/services more generally.
3.

Compliance.
3.1 Compliance with Obligations - RevComm, its officers, directors, employees, agents, subcontractors, andsub-processors (a) shall comply with the obligations of the GDPR, (b) shall provide the level of privacy
protection required by the GDPR, and (c) shall provide Customer with all reasonably-requested
assistance to enable Customer to fulfil its own obligations under the GDPR. Upon the reasonable requestof Customer, RevComm shall make available to Customer reasonably necessary information in
RevComm’s possession necessary to demonstrate RevComm’s compliance with this subsection.
3.2 Compliance Assurance- Customer has the right to take reasonable and appropriate steps to ensure that
RevComm uses Personal Data consistent with Customer’s obligations under the GDPR.
3.3 Compliance Monitoring - Customer has the right to monitor RevComm’s compliance with this DPA
through measures, including, but not limited to, ongoing manual reviews, automated scans, regularassessments, audits, or other annual technical and operational testing at least once every twelve (12)months.
3.4 Compliance Remediation – RevComm shall notify Customer no later than five business days based on
business days in Japan after determining that it can no longer meet its obligations under the GDPR.
Upon receiving notice from RevComm in accordance with this subsection, Customer may direct
RevComm to take reasonable and appropriate steps to stop and remediate unauthorized use of
Customer Personal Data.
3.5 Security - RevComm shall implement and maintain no less than commercially reasonable security
procedures and practices described in Appendix I of this DPA, appropriate to the nature of theinformation, to protect Personal Data from unauthorized access, destruction, use, modification, ordisclosure.

4.

Restrictions on Processing.
4.1 Limitations on Processing - RevComm will Process Personal Data solely as documented instructions
unless required to do so by the applicable laws. In this case, RevComm shall inform Customer of thatlegal requirement before processing, unless the law prohibits this on important grounds of public interest.
The Agreement and this DPA shall constitute a part of Customer’s instructions for the RevComm toprocess Personal Data.
4.2 Confidentiality - RevComm shall ensure that its officers, directors, employees, agents, subcontractors,
and sub-processors are subject to a duty of confidentiality with respect to Personal Data.
4.3 Sub-processors – RevComm may subcontract or sub-process; provided that RevComm shall ensure thatits subcontractors or sub-processors who Process Personal Data on RevComm’s behalf agree in writing
to the same or equivalent restrictions and requirements that apply to RevComm in this DPA and theAgreement with respect to Personal Data, as well as to comply with the GDPR.

5.

Sub-processors.

5.1 Customer hereby authorizes the Processor to appoint the entities listed in the Appendix II of this DPA as sub-processors.
5.2 RevComm shall make available in writing to the controller any intended changes of the above subprocessors through the addition or replacement at least two (2) weeks in advance. RevComm shallprovide Customer with the information necessary to enable Customer to exercise the right to object.
5.3 RevComm engages a sub-processor for carrying out the processing of Personal Data on behalf ofCustomer, it shall do so by way of a contract which imposes on the sub-processor, in substance, thesame data protection obligations as the ones imposed on RevComm in accordance with this DPA.

RevComm shall ensure that the Sub-processor complies with the obligations to which the RevComm is
subject pursuant to this DPA and to the GDPR.
5.4 RevComm shall remain fully responsible to Customer for the performance of Sub-processor’s obligationsin accordance with its contract with RevComm. RevComm shall notify Customer of any failure by the
Sub-processor to fulfil its contractual obligations.
6.

Data Subject Rights.
6.1 RevComm shall provide commercially reasonable assistance to Customer for the fulfilment of
Customer’s obligations to respond to Data Subject's rights requests under the GDPR regarding PersonalData.
6.2 Customer shall inform RevComm of any Consumer request made pursuant to the GDPR that RevComm
must comply with. Customer shall provide RevComm with the information necessary for RevComm tocomply with such request.

7.

Data Transfer.
7.1 The Standard Contractual Clauses shall apply as follows:(a) Where a Relevant Data Transfer involves data transfer out of the European Union, the EU Standard
Contractual Clauses shall be incorporated into this Agreement and apply to such transfer(s) as set
out below:(i)Module Two applies where Customer is a Controller and the RevComm is a Processor;(ii) in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause applies;(iii) in Clause 9(a) of the EU Standard Contractual Clauses, Option 2 applies, and the time period forprior notice of sub-processor changes is two (2) weeks;(iv) in Clause 11(a) of the EU Standard Contractual Clauses, the optional language does not apply;(v) in Clause 17 of the EU Standard Contractual Clauses, Option 2 applies with the governing law
being that of Ireland;(vi) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before thecourts in Ireland; and(vii) Annexes I and II of the EU Standard Contractual Clauses are completed with the information in
the Appendix I of this DPA (as applicable).
(b) Where a Relevant Data Transfer involves a data transfer out of the United Kingdom, the UK
Addendum shall be incorporated into this Agreement and apply to such transfer(s) as set out below:(i)Tables 1 to 3 (Module Two) of the UK Addendum are completed with the Information in Clause
7.1(a) and the Appendix I of this DPA (as applicable); and(ii) Table 4 of the UK Addendum is completed by selecting “neither party.”
7.2 If more than one Relevant Data Transfer is covered by this Agreement then the word “Appendix I”, where
it appears in the Standard Contractual Clauses, shall be deemed to refer to the Appendix I or part of the
Appendix I relating to the Relevant Data Transfer in question.
7.3 Where data transfers are coming out the Channel Islands / Isle of Man, the EU Standard Contractual
Clauses shall be deemed to include any additional or amended terms mandated by the local Government
authority or Regulatory Authority.
8.

Personal Data Breach.
8.1 RevComm shall notify Customer without undue delay upon the RevComm becoming aware of a
Personal Data Breach affecting the Personal Data, providing Customer with sufficient information toallow Customer to meet any obligations to report or inform Data Subjects or a Regulatory Authority of
the Data Breach under the GDPR.

8.2 RevComm shall fully cooperate with the Customer and take reasonable commercial steps as are
directed by the Customer to assist in the investigation, mitigation and remediation of each such
Personal Data Breach.
9.

Data Protection Impact Assessment.
9.1 RevComm shall provide reasonable assistance to Customer with any data protection impact
assessments and prior consultations with supervising authorities or other competent data privacy
authorities, which Vender reasonably considers to be required by the GDPR, in each case solely in
relation to processing of Customer Personal Data by and taking into account the nature of theprocessing and information available to RevComm.

10. Deletion or return of Personal Data.
10.1 RevComm shall delete and procure the deletion of all copies of the Personal Data in accordance with
Customer’s instruction after the date of termination or cessation of any agreement involving theprocessing of Personal Data.
10.2 RevComm shall provide written certification to Customer that it has fully complied with this, Clause 10,
when Customer requires it.
11. Changes to GDPR.
11.1 The Parties agree to cooperate in good faith to enter into additional terms to address any modifications,amendments, or updates to applicable statutes, regulations or other laws pertaining to privacy andinformation security, including, where applicable, the GDPR.

Appendix I – Transfer and Processing Details
ANNEX I
A. LIST OF PARTIES

Data exporter(s): Customer
Role (controller/processor): Controller
Activities relevant to the data transferred under these Clauses: The use of
the Services provided by RevComm
Data exporter(s): RevComm
Role (controller/processor): Processor
Role (controller/processor): Controller
Activities relevant to the data transferred under these Clauses: Theprovision of the Services provided by RevComm

B. DESCRIPTION OF TRANSFER/ PROCESSING

Categories of data subjects whosetransferred/processed is as follows:

personal

data

are

The attendees of the Customer's conferences, as described in the Privacy
PolicyCategories of personal data transferred/processed are as follows:
The contents of digital conferences, as described in the Privacy Policy,
including the conferences’:••

Audio, video, images, and text-based communications; andInformation that directly identifies conference or communication
participants, such as names, titles, and contact information.

Sensitive data transferred (if applicable) and applied restrictions or
safeguards that fully take into consideration the nature of the data
and the risks involved, such as for instance strict purpose limitation,access restrictions (including access only for staff having followed
specialized training), keeping a record of access to the data,
restrictions for onward transfers or additional security measures. The
following special categories of personal data will betransferred/processed:
N/A
The frequency of the transfer is as follows:
Continuous for duration of the Agreement between the Parties for theprovision of Services.
Nature of the processing
The Personal Data will be processed, as described in the Agreement and
the Privacy Policy.
Purpose(s) of the data transfer and further processing
The Personal Data will be processed for the provision of the Services as
described in the Agreement and the Privacy Policy, in particular to:••••

Analyze telephone sales and customer service calls;
Analyze and transfer contents of digital conferences;
Facilitate digital conferences between users and third party
participants; andStore Personal Data from digital conferences, calls, emails, webinars
and other audio, video, image or text-based communications.

The period for which the personal data will be retained or, if that is
not possible, the criteria used to determine that period
For as long as necessary considering the purpose of the Processing andin compliance with applicable laws, including the GDPR.
For transfers to (sub-) processors, also must specify subject matter,nature and duration of the processing
Same as above
C. COMPETENT SUPERVISORYAUTHORITY

Identify the competent supervisory authority/(ies) in accordance with
Clause 13
The competent supervisory authority of the Data Exporter, details of which
are available on request

ANNEX IITECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATA
(1) Formulation of the Basic Policy and Policies for the Processing of Personal Data
To ensure the proper processing of Personal Data, RevComm has created the Privacy Policy (For EEA and
UK Users) and this DPA in order to comply with laws and regulations pertaining to the protection of Personal Data,
contact point for inquires and complaint processing and the like.
In addition, RevComm has created internal rules for the processing of Personal Data, including processing
methods and responsible persons/persons in charge and their duties, etc., at each stage of acquisition, utilization,
retention, provision, and deletion/disposal, etc.
(2) Organizational Security Controls
RevComm has appointed a manager to process Personal Data and identified RevComm’s employees
engaged in the processing of Personal Data and the scope of Personal Data processed by such employees.
RevComm has also developed a reporting system in the event that a violation of the GDPR or a breach of
RevComm’s internal rules is discovered.
RevComm regularly conducts audits of its processing of Personal Data and periodically requests audits byother departments and outside auditors.
(3) Human Security Controls
RevComm provides employees with regular training with respect to the processing of Personal Data. It also
sets forth the confidentiality of Personal Data in the Rules of Employment, etc.
(4) Physical Security Controls
RevComm monitors the entry and exit of employees, restricts equipment, etc. brought into areas where
Personal Data is processed, and prevents unauthorized persons from browsing Personal Data. RevComm takes
actions to prevent the theft or loss, etc. of equipment holding Personal Data, electronic media and documents,
etc. and implements measures to avoid Personal Data from being easily found when carrying such equipment orelectronic media, etc., including moving within an office.
(5) Technical Security Controls
RevComm limits access to Personal Data to specific employees and has introduced a mechanism to protect
its information system from external unauthorized access or illicit software.

Appendix II – LIST OF SUB-PROCESSORS
Customer has authorised the use of the following subprocessors:
1.

Name: Amazon Web Services Japan g.k.
Address: MEGURO CENTRAL SQUARE, 3-1-1 Osaki, Shinagawa, Tokyo, Japan, 141-0021
Description of processing: All or part of processing described in ANNEX I B of Appendix I

2.

Name: Cloud CIRCUS, Inc.
Address: SHINJUKU MONOLITH BUILDING 21F, Nishi-shinjuku, Shinjuku, Tokyo, Japan, 163-0919
Description of processing: All or part of processing described in ANNEX I B of Appendix I

3.

Name: Microsoft Corporation
Address: One Microsoft Way REDMOND, WA 98052-6399 USA
Description of processing: All or part of processing described in ANNEX I B of Appendix I

4.

Name: Hyperdoc Inc.
Address: 2261 Market Street #4339, San Francisco, CA 94114 USA
Description of processing: All or part of processing described in ANNEX I B of Appendix I

5.

Name: AnnounceKit LLC
Address: 1007 N Orange St. 4th Floor Ste 1382 Wilmington, DE 19801 USA
Description of processing: All or part of processing described in ANNEX I B of Appendix I
Enacted: February 1, 2024
Revised: April 1, 2024