SAUCE LABS CUSTOMER DATAPROCESSING ADDENDUM
Last updated: 11 May 2023
THIS CUSTOMER DATA PROCESSING ADDENDUM (“DPA”) is entered into as of
the Addendum Effective Date by and between: (1) the Sauce Labs entity identified
on the Order Form, or, if applicable, as the “Sauce Labs Contracting Entity” in the
Sauce Labs Terms of Service based on the location of the Customer (as defined
below) (“Sauce Labs”); and (2) the customer entity identified on the Order Form(“Customer”). Together Sauce Labs and Customer will be referred to herein as the“Parties” and each a “Party”.
HOW AND WHEN THIS DPA APPLIES● Customer must not include Personal Data in any Customer Data unlessand only to the extent it is specifically authorized to do so under the
Agreement (including the applicable Service-Specific Terms) – this DPA
shall only apply to Personal Data comprised in Customer Data if and as
authorizedandrequiredbytheAgreement(including

anyService-Specific Terms).
● Where applicable in accordance with the Agreement (including theapplicable Service-Specific Terms), this DPA is incorporated into andforms a binding and effective part of the Agreement automatically upon
the Parties’ entry into the Agreement, with effect on and from the
Addendum Effective Date.
● Except in respect of any SCCs (Module One: Controller to Controller)that may apply to any Restricted Transfer of Account Information or
Usage Data to Sauce Labs and the incorporation and population thereof,1

this DPA applies only if and to the extent Applicable Data Protection
Laws govern Sauce Labs’ Processing of Customer Personal Data inperformance of the Services as a Processor, Service Provider or similarrole defined under Applicable Data Protection Laws.
● Any other Processing by Sauce Labs of Personal Data relating to usersof the Services to which this DPA does not apply shall be carried out bySauce Labs as a Controller under then-current Privacy Notice (the“Sauce Labs Privacy Policy”), including any:o Processing by Sauce Labs of any Personal Data comprised in
Account Information and/or Usage Data collected from and/or
about users of the Services and/or Customer’s use of the Service
for use for Sauce Labs’ own purposes; ando other Processing carried out by Sauce Labs for its own business
relationship administration and marketing, analytics, informationor systems security, product improvement and development
and/or legal, regulatory or compliance purposes.
INTERPRETATION
1.1

Unless expressly stated otherwise, capitalized terms used in this DPA(including the description outlined above) have the meanings set out in thisSection 1 or, if not defined, have the meanings given in the Agreement.
(a)“Addendum Effective Date” means the effective date of theAgreement, as set out in the Agreement or the Order Form.

(b)“Agreement”

means,

asapplicable,theMasterSubscription

Agreement or Sauce Labs Terms of Service, and Service-SpecificTerms, or substitute written agreement entered into by and between
the Parties governing provision of Services to Customer.

2

(c)

“Applicable Data Protection Laws” means the privacy, dataprotection and data security laws and regulations of any jurisdiction
applicable to the Processing of Customer Personal Data under the
Agreement, including, without limitation, GDPR and the CCPA (as andwhere applicable).

(d)“CCPA” means the California Consumer Privacy Act of 2018, as
amended by the California Privacy Rights Act of 2020 (the “CPRA”),
and any binding regulations promulgated thereunder.

(e)“Controller” means the natural or legal person, public authority,
agency or other body which, alone or jointly with others, determines
the purposes and means of the Processing of Personal Data.

(f)“Customer Personal Data” means any Personal Data comprised
within Customer Data and Processed by Sauce Labs or its
Sub-Processor on behalf of Customer in order to perform the Services
under the Agreement – for the avoidance of doubt, any Personal Data
comprised in Account Information and/or Usage Data does notconstitute Customer Personal Data.

(g)“Data Subject Request” means the exercise by a Data Subject of its
rights in accordance with Applicable Data Protection Laws in respectof Customer Personal Data and the Processing thereof.

(h)“Data Subject” means the identified or identifiable natural person towhom Customer Personal Data relates.

(i)“EEA” means the European Economic Area.

(j)“FADP” means the Federal Act on Data Protection of 19 June 1992
and, as and when it enters into force on 1 January 2023, its revised
version of 25 September 2020.

3

(k)

“FDPIC” means Swiss Federal Data Protection and Information
Commissioner.

(l)“GDPR” means, as and where applicable to Processing concerned: (i)the General Data Protection Regulation (Regulation (EU) 2016/679)(“EU GDPR”); and/or (ii) the EU GDPR as it forms part of UK law byvirtue of section 3 of the European Union (Withdrawal) Act 2018 (asamended, including by the Data Protection, Privacy and Electronic
Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UKGDPR”), including, in each case (i) and (ii) any applicable national
implementing or supplementary legislation (e.g., the UK Data
Protection

Act2018),

andany

successor,

amendmentorre-enactment, to or of the foregoing. References to “Articles” and“Chapters” of, and other relevant defined terms in, the GDPR shall be
construed accordingly.
(m)“Order Form” means (a) Customer’s selections in Sauce Labs’ online
purchase process, or (b) the order form, quote, purchase order,
statement of work, or similar document entered into by and between
the Customer and Sauce Labs (or an Authorized Partner) associatedwith the Agreement.

(n)“Personal Data” means “personal data,” “personal information,”“personally identifiable information” or similar term defined in
Applicable Data Protection Laws.

(o)“Personal Data Breach” means a breach of Sauce Labs’ security
leading to the accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to, Customer Personal Data in
Sauce Labs’ possession, custody or control. For clarity, Personal Data
Breach does not include unsuccessful attempts or activities that do
not compromise the security of Customer Personal Data (such as4

unsuccessful log-in attempts, pings, port scans, denial of service
attacks, or other network attacks on firewalls or networked systems).
(p)“Personnel” means a person’s employees, agents, consultants orcontractors.

(q)“Process” and inflection thereof means any operation or set ofoperations which is performed on Personal Data or on sets of Personal
Data, whether or not by automated means, such as collection,
recording, organisation, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, disseminationor otherwise making available, alignment or combination, restriction,
erasure or destruction.

(r)“Processor” means a natural or legal person, public authority, agency
or other body which Processes Personal Data on behalf of theController.

(s)“Restricted Transfer” means the disclosure, grant of access or othertransfer of Customer Personal Data to any person located in: (i) in thecontext of the EEA, any country or territory outside the EEA which
does not benefit from an adequacy decision from the European
Commission (an “EU Restricted Transfer”); (ii) in the context of theUK, any country or territory outside the UK, which does not benefit
from an adequacy decision from the UK Government (a “UK
Restricted Transfer”); and (iii) in the context of Switzerland, a country
or territory outside of Switzerland which does not benefit from anadequacy decision from the Swiss Government (a “Swiss RestrictedTransfer”), which would be prohibited without a legal basis under
Chapter V of the GDPR and/or the FADP (as applicable to theProcessing concerned).

(t)“Sauce Labs Security Measures” means the technical andorganisational security measures described from time to time at Sauce
5

Labs Security Measures or any successor webpage, as may be variedin accordance with Section 5.2.
(u)

“SCCs” means the standard contractual clauses approved by theEuropean Commission pursuant to implementing Decision (EU)2021/914.

(v)“Services” means those services and activities to be supplied to or
carried out by or on behalf of Sauce Labs for Customer pursuant to
the Agreement.

(w)“Sub-Processor” means any third party appointed by or on behalf ofSauce Labs to Process Customer Personal Data.

(x)“Supervisory Authority”: (i) in the context of the EEA and the EU
GDPR, shall have the meaning given to that term in the EU GDPR; (ii)in the context of the UK and the UK GDPR, means the UK Information
Commissioner’s Office; and (iii) in the context of Switzerland and the
FADP, means the FDPIC.

(y)“UK Transfer Addendum” means the template Addendum B.1.0
issued by the ICO and laid before Parliament in accordance with
s119A of the Data Protection Act 2018 on 2 February 2022, as it isrevised under Section ‎18 of the UK Mandatory Clauses included inPart 2 thereof (the “UK Mandatory Clauses”).

2.

SCOPE OF THIS DATA PROCESSING ADDENDUM

2.1

The front end of this DPA applies generally to Sauce Labs’ Processing ofCustomer Personal Data under the Agreement.

2.2

Annex 1 (European Annex) to this DPA applies only if and to the extent Sauce
Labs’ Processing of Customer Personal Data under the Agreement is subject
to the GDPR.

6

2.3

Annex 2 (California Annex) to this DPA applies only if and to the extent Sauce
Labs’ Processing of Customer Personal Data under the Agreement is subject
to the CCPA.

3.

PROCESSING OF CUSTOMER PERSONAL DATA

3.1

Sauce Labs shall not Process Customer Personal Data other than on
Customer’s instructions or as required by applicable laws.

3.2

Customer instructs Sauce Labs to Process Customer Personal Data asnecessary to provide the Services to Customer under and in accordance with
the Agreement.

4.

SAUCE LABS PERSONNEL
Sauce Labs shall take commercially reasonable steps to ascertain thereliability of any Sauce Labs Personnel who Process Customer Personal
Data, and shall enter into written confidentiality agreements with all Sauce
Labs Personnel who Process Customer Personal Data that are not subject toprofessional or statutory obligations of confidentiality.

5.

SECURITY

5.1

Sauce Labs shall implement and maintain technical and organisational
measures in relation to Customer Personal Data designed to protect
Customer Personal Data against accidental or unlawful destruction, loss,
alteration, unauthorised disclosure or access as described in the Sauce Labs
Security Measures.

5.2

Sauce Labs may update the Sauce Labs Security Measures from time totime, provided the updated measures do not materially decrease the overall
protection of Customer Personal Data.

7

6.

DATA SUBJECT RIGHTS

6.1

Sauce Labs, taking into account the nature of the Processing of Customer
Personal Data, shall provide Customer with such assistance as may bereasonably necessary and technically feasible to assist Customer in fulfilling
its obligations to respond to Data Subject Requests. If Sauce Labs receives a
Data Subject Request, Customer will be responsible for responding to any
such request.

6.2

Sauce Labs shall:(a)promptly notify Customer if it receives a Data Subject Request; and(b)

not respond to any Data Subject Request, other than to advise theData Subject to submit the request to Customer, except on the written
instructions of Customer or as required by Applicable Data Protection
Laws.

6.3

Except to the extent prohibited by applicable law, Customer shall be fully
responsible for all time spent by Sauce Labs (at Sauce Labs’ then-current
professional services rates) in Sauce Labs’ cooperation and assistanceprovided to Customer under this Section 6, and shall on demand reimburse
Sauce Labs any such costs incurred by Sauce Labs.

7.

PERSONAL DATA BREACH
Breach notification and assistance

7.1

Sauce Labs shall notify Customer without undue delay upon Sauce Labs’
discovering a Personal Data Breach affecting Customer Personal Data. Sauce
Labs shall provide Customer with information (insofar as such information iswithin Sauce Labs’ possession and knowledge and does not otherwise
compromise the security of any Personal Data Processed by Sauce Labs) toallow Customer to meet its obligations under the Applicable Data Protection
Laws to report the Personal Data Breach. Sauce Labs’ notification of or8response to a Personal Data Breach shall not be construed as Sauce Labs’
acknowledgement of any fault or liability with respect to the Personal Data
Breach.
7.2

Sauce Labs shall reasonably co-operate with Customer and take suchcommercially reasonable steps as may be directed by Customer to assist in
the investigation of any such Personal Data Breach.

7.3

Customer is solely responsible for complying with notification laws applicable
to Customer and fulfilling any third-party notification obligations related to
any Personal Data Breaches.
Notification to Sauce Labs

7.4

If Customer determines that a Personal Data Breach must be notified to any
Supervisory Authority, any Data Subject(s), the public or others under
Applicable Data Protection Laws, to the extent such notice directly or
indirectly refers to or identifies Sauce Labs, where permitted by applicablelaws, Customer agrees to:(a)notify Sauce Labs in advance; and(b)in good faith, consult with Sauce Labs and consider any clarifications
or corrections Sauce Labs may reasonably recommend or request to
any such notification, which: (i) relate to Sauce Labs’ involvement in or
relevance to such Personal Data Breach; and (ii) are consistent withapplicable laws.

8.

CUSTOMER’S RESPONSIBILITIES

8.1

Customer agrees that, without limiting Sauce Labs’ obligations under Section
5 (Security), Customer is solely responsible for its use of the Services,
including (a) making appropriate use of the Services to maintain a level of
security appropriate to the risk in respect of the Customer Personal Data; (b)securing the account authentication credentials, systems and devices
9

Customer uses to access the Services; (c) securing Customer’s systems anddevices that Sauce Labs uses to provide the Services; and (d) backing up
Customer Personal Data.
8.2

Customer shall ensure:(a)that there is, and will be throughout the term of the Agreement, a valid
legal basis for the Processing by Sauce Labs of Customer Personal
Data in accordance with this DPA and the Agreement (including, any
and all instructions issued by Customer from time to time in respect ofsuch Processing) for the purposes of all Applicable Data Protection
Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR
(where applicable)); and(b)that all Data Subjects have (i) been presented with all required notices
and statements (including as required by Article 12-14 of the GDPR
(where applicable)); and (ii) provided all required consents, in eachcase (i) and (ii) relating to the Processing by Sauce Labs of Customer
Personal Data.

8.3

Customer agrees that the Service, the Sauce Labs Security Measures, andSauce Labs’ commitments under this DPA are adequate to meet Customer’s
needs, including with respect to any security obligations of Customer under
Applicable Data Protection Laws, and provide a level of security appropriate
to the risk in respect of the Customer Personal Data.

8.4

Customer shall not provide or otherwise make available to Sauce Labs any
Customer Personal Data that contains any (a) Social Security numbers orother government-issued identification numbers; (b) protected healthinformation subject to the Health Insurance Portability and Accountability Act(HIPAA) or other information regarding an individual’s medical history, mental
or physical condition, or medical treatment or diagnosis by a healthcare
professional; (c) health insurance information; (d) biometric information; (e)passwords to any online accounts; (f) credentials to any financial accounts;
10(g) tax return data; (h) any payment card information subject to the Payment
Card Industry Data Security Standard; (i) Personal Data of children under 13
years of age; or (j) any other information that falls within any special
categories of personal data (as defined in GDPR) and/or data relating tocriminal convictions and offences or related security measures (together,“Restricted Data”).
9.

LIABILITY
The total aggregate liability of either Party towards the other Party,
howsoever arising, under or in connection with this DPA and the SCCs (if andas they apply) will under no circumstances exceed any limitations or caps on,
and shall be subject to any exclusions of, liability and loss agreed by theParties in the Agreement; provided that, nothing in this Section 9 will affectany person’s liability to Data Subjects under the third-party beneficiaryprovisions of the SCCs (if and as they apply).

10.

CHANGE IN LAWS
Sauce Labs may on notice vary this DPA to the extent that (acting
reasonably) it considers necessary to address the requirements of Applicable
Data Protection Laws from time to time, including by varying or replacing the
SCCs in the manner described in Paragraph 6.5 of Annex 1 (European
Annex).

11.

INCORPORATION AND PRECEDENCE

11.1

This DPA shall be incorporated into and form part of the Agreement witheffect on and from the Addendum Effective Date.

11.2

In the event of any conflict or inconsistency between:(a)this DPA and the Agreement, this DPA shall prevail; or

11

(b)

any SCCs entered into pursuant to Paragraph 6 of Annex 1 (European
Annex) and this DPA and/or the Agreement, the SCCs shall prevail inrespect of the Restricted Transfer to which they apply.

12

Annex 1
European Annex
1.

PROCESSING OF CUSTOMER PERSONAL DATA

1.1

The Parties acknowledge and agree that the details of Sauce Labs’
Processing of Personal Data under this DPA and the Agreement (including therespective roles of the Parties relating to such Processing) are as set out in
Attachment 1 to Annex 1 (European Annex) to the DPA.

1.2

Where Sauce Labs receives an instruction from Customer that, in its
reasonable opinion, infringes the GDPR, Sauce Labs shall inform Customer.

1.3

Customer acknowledges and agrees that any instructions issued by
Customer with regards to the Processing of Customer Personal Data by or on
behalf of Sauce Labs pursuant to or in connection with the Agreement shallbe in strict compliance with the GDPR and all other applicable laws.

2.

SUB-PROCESSING

2.1

Customer generally authorises Sauce Labs to appoint Sub-Processors inaccordance with this Paragraph 2. Information about the Sub-Processors
engaged by Sauce Labs from time to time, including their functions andlocations, is available at the Sauce Labs Subprocessor Site (the“Sub-Processor Site”).

2.2

Sauce Labs shall give Customer prior notice of the appointment of any
proposed Sub-Processor by updating the Sub-Processor Site and providing
a means by which Customers may subscribe to receive notice of such
updates. If, within fourteen (14) days of any such updates totheSub-Processor Site, Customer notifies Sauce Labs in writing of any
objections (on reasonable grounds) to a proposed appointment of a
Sub-Processor:(a)

Sauce Labs shall use reasonable efforts to make available acommercially reasonable change in the provision of the Services,which avoids the use of that proposed Sub-Processor; and(b)where such a change cannot be made within fourteen (14) days from
Sauce Labs’ receipt of Customer’s notice, then either Party may by
written notice to the other Party with immediate effect terminate theAgreement, either in whole or to the extent that it relates to theServices which require the use of the proposed Sub-Processor, as its
sole and exclusive remedy.

2.3

If Customer does not object to Sauce Labs’ appointment of a Sub-Processor
during the objection period referred to in Paragraph 2.2, Customer shall bedeemed to have approved the engagement and ongoing use of that
Sub-Processor.

2.4

With respect to each Sub-Processor, Sauce Labs shall maintain a written
contract between Sauce Labs and the Sub-Processor that includes terms
which offer at least an equivalent level of protection for Customer Personal
Data as those set out in this DPA (including the Sauce Labs Security
Measures). Sauce Labs shall remain liable for any breach of this DPA caused
by a Sub-Processor.

2.5

Operational clarifications:(a)

The terms and conditions of this Paragraph 2 apply in relation to
Sauce Labs’ appointment and use of Sub-Processors under the
SCCs.

(b)

Any approval by Customer of Sauce Labs’ appointment of a
Sub-Processor that is given expressly or deemed given pursuant tothis Paragraph 2 constitutes Customer’s documented instructions toeffectdisclosuresandonwardtransfers

toany

relevant

Sub-Processors if and as required under Clause 8.8 of the SCCs.
(c)

Customer acknowledges and agrees that any approval by Customer ofSauce Labs’ appointment of a Sub-Processor that is given expresslyor deemed given pursuant to this Paragraph 2 constitutes Customer’s
documented instructions to effect disclosures and onward transfers tosuch Sub-Processor, which shall, to the extent that any such transfer

constitutes a Restricted Transfer, be effected by Sauce Labs inaccordance with applicable requirements of Chapter V GDPR.

3.

DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

3.1

Sauce Labs, taking into account the nature of the Processing and theinformation available to Sauce Labs, shall provide reasonable assistance toCustomer, at Customer’s cost, with any data protection impact assessments
and prior consultations with Supervisory Authorities which Customer
reasonably considers to be required of it by Article 35 or Article 36 of the
GDPR, in each case solely in relation to Processing of Customer Personal
Data by Sauce Labs.

3.2

Except to the extent prohibited by applicable law, Customer shall be fully
responsible for all time spent by Sauce Labs (at Sauce Labs’ then-current
professional services rates) in Sauce Labs’ provision of any cooperation andassistance provided to Customer under Paragraph 3.1, and shall on demand
reimburse Sauce Labs any such costs incurred by Sauce Labs.

4.

RETURN AND DELETION

4.1

Subject to Paragraph 4.2 and 4.3, upon the date of cessation of any Services
involving the Processing of Customer Personal Data (the “Cessation Date”),
Sauce Labs shall promptly cease all Processing of Customer Personal Data
for any purpose other than for storage or as otherwise permitted or required
under this DPA.

4.2

Subject to Paragraph 4.4, to the extent technically possible in thecircumstances (as determined in Sauce Labs’ sole discretion), on written
request to Sauce Labs (to be made no later than fifteen (15) days after the
Cessation Date (“Post-cessation Storage Period”)), Sauce Labs shall within
fifteen (15) days of such request:(a)make available for download a complete copy of all Customer
Personal Data within Sauce Labs’ possession to Customer, promptly

following which Sauce Labs shall delete or irreversibly anonymise allother copies of such Customer Personal Data; or(b)either (at its option) delete or irreversibly anonymise all Customer
Personal Data within Sauce Labs’ possession.

4.3

In the event that during the Post-cessation Storage Period, Customer does
not instruct Sauce Labs in writing to either delete or make available fordownload Customer Personal Data pursuant to Paragraph 4.2, Sauce Labs
shall promptly after the expiry of the Post-cessation Storage Period either (atits option) delete; or irreversibly render anonymous, all Customer Personal
Data then within Sauce Labs possession to the fullest extent technicallypossible in the circumstances.

4.4

Sauce Labs may retain Customer Personal Data where permitted or requiredby applicable law, for such period as may be required by such applicable law,provided that Sauce Labs shall:(a)maintain the confidentiality of all such Customer Personal Data; and(b)

Process the Customer Personal Data only as necessary for the
purpose(s) specified in the applicable law permitting or requiring suchretention.

4.5

Operational clarification: Certification of deletion of Customer Personal Data
as described in Clauses 8.5 and 16(d) of the SCCs, shall be provided only
upon Customer’s written request.

5.

AUDIT RIGHTS

5.1

Sauce Labs shall make available to Customer on request, such information
as

Sauce

Labs

(actingreasonably)

considersappropriate

in

the

circumstances to demonstrate its compliance with this DPA.
5.2

Subject to Paragraphs 5.3 to 5.8, in the event that Customer (acting
reasonably) is able to provide documentary evidence that the information
made available by Sauce Labs pursuant to Paragraph 5.1 is not sufficient in
the circumstances to demonstrate Sauce Labs’ compliance with this DPA,
Sauce Labs shall allow for and contribute to audits, including inspections, byCustomer or an auditor mandated by Customer in relation to the Processingof Customer Personal Data by Sauce Labs.
5.3

Customer shall give Sauce Labs reasonable notice of any audit or inspection
to be conducted under Paragraph 5.2 (which shall in no event be less thanfourteen (14) days’ notice) and shall use its best efforts (and ensure that eachof its mandated auditors uses its best efforts) to avoid causing any
destruction, damage, injury or disruption to Sauce Labs’ premises,
equipment, Personnel, data, and business (including any interference with theconfidentiality or security of the data of Sauce Labs’ other customers or theavailability of Sauce Labs’ services to such other customers).

5.4

Prior to conducting any audit, Customer must submit a detailed proposed
audit plan providing for the confidential treatment of all informationexchanged in connection with the audit and any reports regarding the results
or findings thereof. The proposed audit plan must describe the proposed
scope, duration, and start date of the audit. Sauce Labs will review the
proposed audit plan and provide Customer with any concerns or questions(for example, any request for information that could compromise Sauce Labs
security, privacy, employment or other relevant policies). Sauce Labs will
work cooperatively with Customer to agree on a final audit plan.

5.5

If the controls or measures to be assessed in the requested audit are
addressed in a SOC 2 Type 2, ISO, or similar audit report performed by aqualified third-party auditor within twelve (12) months of Customer’s audit
request (“Audit Report”) and Sauce Labs has confirmed in writing that there
are no known material changes in the controls audited and covered by such
Audit Report(s), Customer agrees to accept provision of such Audit Report(s)in lieu of requesting an audit of such controls or measures.

5.6

Sauce Labs need not give access to its premises for the purposes of such an
audit or inspection:(a)where an Audit Report is accepted in lieu of such controls or measuresin accordance with Paragraph 5.5;(b)to any individual unless they produce reasonable evidence of theiridentity;(c)to any auditor whom Sauce Labs has not approved in advance (acting
reasonably);(d)to any individual who has not entered into a non-disclosure agreementwith Sauce Labs on terms acceptable to Sauce Labs;(e)outside normal business hours at those premises; or(f)on more than one occasion in any calendar year during the term of theAgreement, except for any audits or inspections which Customer isrequired to carry out under the GDPR or by a Supervisory Authority.

5.7

Nothing in this DPA shall require Sauce Labs to furnish more information
about its Sub-Processors in connection with such audits than such
Sub-Processors make generally available to their customers.

5.8

Except to the extent prohibited by applicable law, Customer shall be fully
responsible for all time spent by Sauce Labs (at Sauce Labs’ then-current
professional services rates) in Sauce Labs’ provision of any cooperation andassistance provided to Customer under this Paragraph 5 (excluding any costs
incurred in the procurement, preparation or delivery of Audit Reports to
Customer pursuant to Paragraph 5.5), and shall on demand reimburse Sauce
Labs any such costs incurred by Sauce Labs.

5.9

Operational clarification: The audits described in Clauses 8.9(c) and 8.9(d) of
the SCCs shall be subject to any relevant terms and conditions detailed inthis Paragraph 5.

6.

RESTRICTED TRANSFERS
EU Restricted Transfers

6.1

To the extent that any Processing of Customer Personal Data under this DPA
involves an EU Restricted Transfer from Customer to Sauce Labs, the Parties
shall comply with their respective obligations set out in the SCCs, which are
hereby deemed to be:(a)populated in accordance with Part 1 of Attachment 2 to Annex 1(European Annex); and(b)entered into by the Parties and incorporated by reference into thisDPA.

UK Restricted Transfers
6.2

To the extent that any Processing of Customer Personal Data under this DPA
involves a UK Restricted Transfer from Customer to Sauce Labs, the Parties
shall comply with their respective obligations set out in the SCCs, which are
hereby deemed to be:(a)varied to address the requirements of the UK GDPR in accordancewith UK Transfer Addendum and populated in accordance with Part 2of Attachment 2 to Annex 1 (European Annex); and(b)entered into by the Parties and incorporated by reference into this
DPA.

Swiss Restricted Transfers
6.3

To the extent that any Processing of Customer Personal Data under this DPA
involves a Swiss Restricted Transfer from Customer to Sauce Labs, theParties shall comply with their respective obligations set out in the SCCs,
which are hereby deemed to be:(a)varied to address the requirements of the FADP and populated inaccordance with Part 3 of Attachment 2 to Annex 1 (European Annex);
and

(b)

entered into by the Parties and incorporated by reference into this
DPA.

6.4

Nothing in any applicable SCCs (as deemed amended pursuant to Section
6.3) should be interpreted or construed in such a way as would limit or
exclude the rights of Data Subjects under Clause 18(c) of those SCCs (asdeemed amended pursuant to Section 6.3) to bring legal proceedings before
the courts in Switzerland where Switzerland is that Data Subject’s habitualplace of residence.
Adoption of new transfer mechanism

6.5

Sauce Labs may on notice vary this DPA and replace the relevant SCCs with:(a)any new form of the relevant SCCs or any replacement therefor
prepared and populated accordingly (e.g., standard data protection
clauses adopted by the European Commission for use specifically inrespect of transfers to data importers subject to Article 3(2) of the EU
GDPR); or(b)another transfer mechanism, other than the SCCs,

that enables the lawful transfer of Customer Personal Data to Sauce Labs
under this DPA in compliance with Chapter V of the GDPR.
Provision of full-form SCCs
6.6

In respect of any given Restricted Transfer, if requested of Customer by aSupervisory Authority, Data Subject or further Controller (where applicable) –on specific written request (made to the contact details set out in Attachment
1 to this Annex 1 (European Annex); accompanied by suitable supporting
evidence of the relevant request), Sauce Labs shall provide Customer with an
executed version of the relevant set(s) of SCCs responsive to the request
made of Customer (amended and populated in accordance with Attachment
2 to Annex 1 (European Annex) in respect of the relevant Restricted Transfer)for countersignature by Customer, onward provision to the relevant requestor
and/or storage to evidence Customer’s compliance with Applicable Data
Protection Laws.

Further Operational Clarifications
6.7

When complying with its transparency obligations under Clause 8.3 of theSCCs, Customer agrees that it shall not provide or otherwise make available,
and shall take all appropriate steps to protect, Sauce Labs’ and its licensors’
trade secrets, business secrets, confidential information and/or othercommercially sensitive information.

6.8

Where applicable, for the purposes of Clause 10(a) of Module Three of theSCCs, Customer acknowledges and agrees that there are no circumstancesin which it would be appropriate for Sauce Labs to notify any third-party
controller of any Data Subject Request and that any such notification shall be
the sole responsibility of Customer.

6.9

For the purposes of Clause 15.1(a) of the SCCs, except to the extent
prohibited by applicable law and/or the relevant public authority, as between
the Parties, Customer agrees that it shall be solely responsible for making
any notifications to relevant Data Subject(s) if and as required.

Attachment 1

TO ANNEX 1 (EUROPEAN ANNEX)
Data Processing Details

Note:This Attachment 1 to Annex 1 (European Annex) to the DPA includes certain
details of the Processing of Personal Data as required:● by Article 28(3) GDPR; and● to populate the Appendix to the SCCs in the manner described in
Attachment 2 to Annex 1 (European Annex) to the DPA (if and to the extent
applicable).

SAUCE LABS / ‘DATA IMPORTER’ DETAILS
Name:

Sauce Labs Inc, a Delaware corporation

Address:

As set out in the Order Form
Role: Privacy Officer

Contact Details for

Email: privacy@saucelabs.com

Data Protection:

Role: General Counsel
Email: legal@saucelabs.com

Sauce
Activities:

Labs

Sauce Labs provides a platform, including infrastructure
and applications, used for testing by developers of web
and mobile software applications.
● Controller – in respect of any Personal Data

Role:

comprised in Account Information and/or Usage
Data

● Processor – in respect of Customer Personal Data

CUSTOMER / ‘DATA EXPORTER’ DETAILSName:

The entity or other person who is a counterparty to theAgreement.
Customer’s address is:● the address shown in the Order Form; orAddress:● if no such Order Form has been agreed, theCustomer’s principal business trading address –unless otherwise notified to legal@saucelabs.com.
Customer’s contact details are:● the contact details shown in the Order Form; orContact Details for
Data Protection:

● if

no

such

Order

Form

has been agreed,

Customer’s contact details submitted by Customer
and associated with Customer’s account for theServices–

unlessotherwise

notifiedtolegal@saucelabs.com.
Customer’s activities relevant to this DPA are the use andCustomer Activities:

receipt of the Services under and in accordance with, andfor the purposes anticipated and permitted in, theAgreement as part of its ongoing business operations.
● Controller – in respect of any Processing ofCustomer Personal Data, and any Personal Data

Role:

comprised in Account Information or Usage Data,in respect of which Customer is a Controller in its
own right; and● Processor – in respect of any Processing ofCustomer Personal Data in respect of which
Customer is itself acting as a Processor on behalfof any other person (including its affiliates if andwhere applicable).

DETAILS OF PROCESSING
Relevant Data Subjects include:● Customer’s Staff (as defined below).
● Users of the Customer’s applications.
Where any of the above is a business or organisation, it
includes their staff, namely, employees andCategories of Data

non-employee workers; students, interns, apprentices

Subjects:

and volunteers; directors and officers; advisers,
consultants, independent contractors, agents andautonomous, temporary or casual workers, together withapplicants and candidates for any one or more of theforegoing roles or positions (collectively, “Staff”).
Each category includes current, past and prospective
Data Subjects.
Customer Personal Data:
Customer Personal Data includes:

Categories of
Personal Data:● Username● Full name
● IP address● Email address● Computer diagnostic information● Operating system identifiers

● Any other Personal Data contained in the websites
or native mobile applications being tested, test
commands and input data, output data, test logs,
screen shots, videos, reports and analytics
provided or otherwise made available by Customer
to Sauce Labs in the course of the provision of theServices.
Account Information or Usage Data:
Any Personal Data comprised in Account Information or
Usage Data – in each case, as more fully described in the
Sauce Labs Privacy Policy from time-to-time, including:● Account Information – Customer’s Staff members’
usernames, email addresses, and other contact
information.
● Usage Data – Personal Data (if any) comprised inor Processed to create any relevant technical andanalytical information pertaining to Customer’s and
its Staff members’ use of the Services orinformation pertaining to the performance of theServices in Customer’s environment.

Categories of sensitive data:
Sensitive
Categories of Data,and associatedadditional
restrictions/safeguards:

None – as noted in Section 8.4 of the DPA, Customer
agrees that Restricted Data, which includes ‘sensitive
data’ (as defined in Clause 8.7 of the SCCs), must not be
submitted to the Services.
Additional safeguards for sensitive data:
N/A

Frequency of

Ongoing – as initiated by Customer in and through its

transfer:use, or use on its behalf, of the Services.

Customer Personal Data:
Processing operations required in respect of Customer
Personal Data, in order to provide the Services inaccordance with the Agreement.
Account Information and Usage Data:
Nature of theProcessing as described in or contemplated by the Sauce

Processing:Labs Privacy Policy from time-to-time of any Personal
Data comprised in Account Information and/or Usage
Data – including Processing carried out by Sauce Labs
for its own business relationship administration andmarketing, analytics, information or systems security,
product improvement and development and/or legal,
regulatory or compliance purposes
Customer Personal Data:
Customer Personal Data will be Processed: (i) as
necessary to provide the Services as initiated by
Customer in its use thereof, and (ii) to comply with anyother reasonable instructions provided by Customer inaccordance with the terms of this DPA.

Purpose of theProcessing:

Account Information and Usage Data:
Those purposes described in or contemplated by the
Sauce Labs Privacy Policy from time-to-time – including
Sauce Labs’ business relationship administration andmarketing, analytics, information or systems security,
product improvement and development and/or legal,
regulatory or compliance purposes.

Duration of

For the period determined in accordance with theProcessing /Agreement and DPA, including Paragraph 4 of Annex 1

Retention Period:(European Annex) to the DPA.

Transfers to Sub-Processors are as, and for the purposes,
Transfers to

described from time to time in the Sub-Processor Page

(sub-)processors:(as may be updated from time to time in accordance with
Paragraph 2 of Annex 1 (European Annex) to the DPA).

Attachment 2

TO ANNEX 1 (EUROPEAN ANNEX)
POPULATION OF SCCs

Notes:● In the context of any EU Restricted Transfer, the SCCs populated inaccordance with Part 1 of this Attachment 2 are incorporated by reference
into and form an effective part of the DPA (if and where applicable inaccordance with Paragraph 6.1 of Annex 1 (European Annex) to the DPA).
● In the context of any UK Restricted Transfer, the SCCs as varied by the UK
Transfer Addendum and populated in accordance with Part 2 of thisAttachment 2 are incorporated by reference into and form an effective partof the DPA (if and where applicable in accordance with Paragraph 6.2 ofAnnex 1 (European Annex) to the DPA).

PART 1: POPULATION OF THE SCCs
1.

SIGNATURE OF THE SCCs:
Where the SCCs apply in accordance with Paragraph 6.1 of Annex 1(European Annex) to the DPA each of the Parties is hereby deemed to havesigned the SCCs at the relevant signature block in Annex I to the Appendix to
the SCCs.

2.

MODULESThe following modules of the SCCs apply in the manner set out below(having regard to the role(s) of Customer set out in Attachment 1 to Annex 1(European Annex) to the DPA):(a)

Module One of the SCCs applies to any EU Restricted Transfer
involving Processing of any Personal Data comprised in AccountInformation and/or Usage Data in respect of which both Parties areControllers in their own right;(b)Module Two of the SCCs applies to any EU Restricted Transfer
involving Processing of Customer Personal Data in respect of which
Customer is a Controller in its own right; and/or(c)

Module Three of the SCCs applies to any EU Restricted Transfer
involving Processing of Customer Personal Data in respect of which
Customer is itself acting as a Processor on behalf of any other person.

3.

POPULATION OF THE BODY OF THE SCCs

3.1

For each Module of the SCCs, the following applies as and where applicableto that Module and the Clauses thereof:(a)

The optional ‘Docking Clause’ in Clause 7 is not used and the body ofthat Clause 7 is left intentionally blank.

(b)

In Clause 9:(i)

OPTION 2: GENERAL WRITTEN AUTHORISATION applies, andthe minimum time period for advance notice of the addition or
replacement of Sub-Processors shall be the advance notice
period set out in Paragraph 2.2 of Annex 1 (European Annex) tothe DPA; and(ii)

OPTION 1: SPECIFIC PRIOR AUTHORISATION is not used andthat optional language is deleted; as is, therefore, Annex III to
the Appendix to the SCCs.

(c)

In Clause 11, the optional language is not used and is deleted.

(d)

In Clause 13, all square brackets are removed and all text therein isretained.

(e)

In Clause 17: OPTION 1 applies, and the Parties agree that the SCCs
shall be governed by the law of Germany

in relation to any EU

Restricted Transfer; and OPTION 2 is not used and that optional
language is deleted.

(f)For the purposes of Clause 18, the Parties agree that any disputearising from the SCCs in relation to any EU Restricted Transfer shall be
resolved by the courts of Germany, and Clause 18(b) is populated
accordingly.

3.2

In this Paragraph 3, references to “Clauses” are references to the Clauses of
the SCCs.

4.

POPULATION OF ANNEXES TO THE APPENDIX TO THE SCCs

4.1

Annex I to the Appendix to the SCCs is populated with the corresponding
information detailed in Attachment 1 to Annex 1 (European Annex) to the
DPA, with: Customer being ‘data exporter’; and Sauce Labs being ‘data
importer’.

4.2

Part C of Annex I to the Appendix to the SCCs is populated as below:
The competent supervisory authority shall be determined as follows:● Where Customer is established in an EU Member State: thecompetent supervisory authority shall be the supervisory authorityof that EU Member State in which Customer is established.
● Where Customer is not established in an EU Member State, Article
3(2) of the GDPR applies and Customer has appointed an EU
representative under Article 27 of the GDPR: the competentsupervisory authority shall be the supervisory authority of the EU
Member State in which Customer’s EU representative relevant to
the processing hereunder is based (from time-to-time).
● Where Customer is not established in an EU Member State, Article
3(2) of the GDPR applies, but Customer has not appointed an EU
representative under Article 27 of the GDPR: the competentsupervisory authority shall be the supervisory authority of the EU
Member State notified in writing to Sauce Labs’ contact point fordata protection identified in Attachment 1 to Annex 1 (European
Annex) to the DPA, which must be an EU Member State in which
the data subjects whose personal data is transferred under theseClauses in relation to the offering of goods or services to them, or
whose behaviour is monitored, are located.
4.3

Annex II to the Appendix to the SCCs is populated as below:
General:o Please refer to Section 5 of the DPA and the Sauce Labs Security
Measures.
o In the event that Customer receives a Data Subject Request under
the EU GDPR and requires assistance from Sauce Labs, Customer
should email Sauce Labs’ contact point for data protection
identified in Attachment 1 to Annex 1 (European Annex) to the DPA.
Sub-Processors: When Sauce Labs engages a Sub-Processor underthese Clauses, Sauce Labs shall enter into a binding contractual
arrangement with such Sub-Processor that imposes upon them dataprotection obligations which, in substance, meet or exceed the relevant
standards required under these Clauses and the DPA – including inrespect of:o applicable information security measures;o notification of Personal Data Breaches to Sauce Labs;o return or deletion of Customer Personal Data as and whererequired; ando engagement of further Sub-Processors.

PART 2: UK RESTRICTED TRANSFERS
1.

UK TRANSFER ADDENDUM

1.1

Where relevant in accordance with Paragraph 6.2 of Annex 1 (European
Annex) to the DPA, the SCCs also apply in the context of UK RestrictedTransfers as varied by the UK Transfer Addendum in the manner described
below –(a)Part 1 to the UK Transfer Addendum. The Parties agree:(i)

Tables 1, 2 and 3 to the UK Transfer Addendum are deemed
populated with the corresponding details set out in Attachment
1 to Annex 1 (European Annex) to the DPA and the foregoingprovisions of this Attachment 2 (subject to the variations
effected by the UK Mandatory Clauses described in (b) below);
and

(ii)

Table 4 to the UK Transfer Addendum is completed by the box
labelled ‘Data Importer’ being deemed to have been ticked.

(b)Part 2 to the UK Transfer Addendum. The Parties agree to be bound by
the UK Mandatory Clauses of the UK Transfer Addendum.

1.2

As permitted by Section 17 of the UK Mandatory Clauses, the Parties agree
to the presentation of the information required by ‘Part 1: Tables’ of the UK
Transfer Addendum in the manner set out in Paragraph 1.1 of this Part 2;
provided that the Parties further agree that nothing in the manner of that
presentation shall operate or be construed so as to reduce the Appropriate
Safeguards (as defined in Section 3 of the UK Mandatory Clauses).

1.3

In relation to any UK Restricted Transfer to which they apply, where thecontext permits and requires, any reference in the DPA to the SCCs, shall beread as a reference to those SCCs as varied in the manner set out inParagraph 1.1 of this Part 2.
PART 3: SWISS RESTRICTED TRANSFERS

1.

VARIATIONS FOR SWISS RESTRICTED TRANSFERS

1.1

Where applicable in accordance with Section 6.3 of Annex 1 (European
Annex) to the DPA, the SCCs also apply in the context of Swiss RestrictedTransfers with the following terms deemed to have the following substituted
meanings:(a)“GDPR” means the FADP;(b)“European Union”, “Union” and “Member State(s)” each mean
Switzerland; and

(c)
1.2

“supervisory authority” means the FDPIC.

In relation to any Swiss Restricted Transfer to which they apply, where thecontext permits and requires, any reference in the DPA to the SCCs, shall beread as a reference to those SCCs as varied in the manner set out in Section
1.1 of this Part 3.

Annex 2
California Annex
1.

For purposes of this Annex, the terms “Consumer,” “Commercial Purpose,”“Sell,” “Share,” “Business Purpose,” and “Service Provider” shall have therespective meanings given thereto in the CCPA, and “Personal Information”
shall mean Customer Personal Data that constitutes personal information
governed by the CCPA.

2.

It is the Parties’ intent that with respect to any Personal Information, Sauce
Labs is a Service Provider with respect to its Processing of such Personal
Information. Sauce Labs (a) acknowledges that Personal Information isdisclosed by Customer only for limited and specified purposes described in
the Agreement; (b) shall comply with applicable obligations under the CCPA
and shall provide the same level of privacy protection to Personal Information
as is required by the CCPA; (c) shall notify Customer in writing, no later than
five (5) business days, of any determination made by Sauce Labs that it canno longer meet its obligations under the CCPA; and (d) agrees that Customer
has the right, upon notice, including pursuant to the preceding clause, to takereasonable and appropriate steps to stop and remediate unauthorized use of
Personal Information.

3.

Sauce Labs agrees that Customer may conduct audits, in accordance with
Paragraph 5 of Annex 1 of the DPA, to help ensure that Sauce Labs’ use of
Personal Information is consistent with Sauce Labs’ obligations under the
CCPA.

4.

Sauce Labs shall not (a) Sell or Share any Personal Information; (b) retain, use
or disclose any Personal Information for any Commercial Purpose other thanfor the Business Purpose of providing the Services specified in theAgreement, or as otherwise permitted by the CCPA, (c) retain, use or disclose
the Personal Information outside of the direct business relationship between
Sauce Labs and Customer, or (d) combine Personal Information received
pursuant to the Agreement with Personal Information (i) received from or on
behalf of another person, or (ii) collected from Sauce Labs' own interaction
with any Consumer to whom such Personal Information pertains. Sauce Labs

hereby certifies that it understands its obligations under this Section 4 andwill comply with them.
5.

Sauce Labs’ notice to Customer of Sub-Processor engagements inaccordance with Paragraph 2 of Annex 1 shall satisfy Sauce Labs’ obligation
under the CCPA to give notice of such engagements.

6.

The Parties acknowledge that Sauce Labs’ retention, use and disclosure of
Personal Information authorized by Customer’s instructions documented in
the Agreement are integral to Sauce Labs’ provision of the Services and thebusiness relationship between the Parties.

7.

If Sauce Labs receives a request directly from an individual, Sauce Labs will
notify Customer and advise the individual to submit its request to Customer.
Customer will be solely responsible for responding to the request, unlessotherwise required by the CCPA. Sauce Labs will provide Customer with any
assistance reasonably necessary for Customer to perform its obligations
under the CCPA to fulfill or respond to requests from individuals to exercise
their rights under the CCPA.

8.

Sauce Labs agrees to cooperate in good faith with Customer concerning any
amendments as may be necessary to address compliance with the CCPA.