IVANTI DATA PROCESSING AGREEMENT
In conjunction with your participation as an Ivanti reseller, distributor, or other strategic partner (hereinafter referred
to as “Channel Partner”), Channel Partner agrees to this Data Processing Agreement (the “DPA”) which is hereby
incorporated into the applicable Ivanti Agreement or Ivanti Distributor Agreement (the “Agreement”) you have agreed
to with Ivanti. “Ivanti” means the Ivanti entity defined in the Agreement (“Ivanti”). Ivanti and Channel Partner are
individually referred to below as a “Party” or collectively as “Parties.” Ivanti may revise these terms from time totime. Any capitalized terms not defined herein shall have the respective meanings given to them in the Agreement.
Additionally, this DPA is entered into as of the same date the parties entered into the Agreement (the “EffectiveDate”).
RECITALS
WHEREAS, the Parties have entered into certain terms of service, letter of intent, purchase agreement, statement ofwork or other agreement between the parties (“Agreement”).
WHEREAS, in the course of providing the Services pursuant to the Agreement, Personal Data may be Processed;
WHEREAS, to ensure adequate safeguards with respect to the Processing of Personal Data provided by the Parties
under the Agreement, the Parties agree to comply with the following provisions with respect to any Personal Data,each acting reasonably and in good faith.
NOW, THEREFORE, in consideration of the foregoing premises and of the mutual promises and covenants set forth
below, the Parties hereby agree as follows:
AGREEMENT1.

DEFINITIONSAll capitalized terms not defined herein shall have the meaning set forth in the Agreement.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with thesubject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than
50% of the voting interests of the subject entity.
“Applicable Data Protection Laws” means all applicable laws, regulations, regulatory guidance, or requirements inany jurisdiction relating to data protection, privacy, or confidentiality of Personal Data including but not limited to (a)the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) together with any transposing, implementing
or supplemental legislation, (b) the United Kingdom’s Data Protection Act 2018 (“UK GDPR”), (c) Switzerland’s
Federal Act on Data Protection (FADP), and (d) the California Consumer Privacy Act (“CCPA”) and its implementing
regulations.
Authorized Affiliate” means any of the Parties’ Affiliates which (a) are subject to the data protection laws andregulations of the European Economic Area and/or its member states, the United Kingdom, and Switzerland, (b) are
subject to data protection laws and regulations outside of the European Economic Area and/or its Member States,
Switzerland, and the United Kingdom (as applicable), and (c) permitted to Process Personal Data pursuant to theAgreement.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing
regulations.
“Controller” or “Data Controller” means the entity which determines the purposes and means of the Processing of
Personal Data.
“Data Breach” means a breach of security leading to the accidental, unauthorized, or unlawful destruction, loss,
alteration, disclosure of, access to, or other Processing of Personal Data transmitted, stored, or otherwise Processed.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT“Data Protection Authority” means any representative or agent of a government entity or agency who has theauthority to enforce Applicable Data Protection Laws.
“Data Subject” means a natural person to whom Personal Data relates.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and on the free movement of such data,
and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means any information that identifies, relates to, describes, is capable of being associated with, or
could reasonably be linked, directly or indirectly, with an identified or identifiable natural person or particularhousehold. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference
to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Process” shall mean any operation or set of operations which is performed upon Personal Data by the Parties or inconnection with and for the purposes of the provision of the Services, whether or not accomplished by automaticmeans, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasureor destruction; and as defined by Applicable Data Protection Laws.
“Processor” means the entity which Processes Personal Data on behalf of the other Party under the Agreement.
“Services” means the performance of the Parties’ obligations pursuant to the Agreement.
“Service Provider” means a sole proprietorship, partnership, limited liability company, corporation, association, orother legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners,that process Personal Data on behalf of a Controller and to which the Controller discloses a Data Subject’s Personal
Data for a Business Purpose pursuant to a written contract, provided that the contract prohibits the Service Provider
from retaining, using, or disclosing the Personal Data for any purpose other than for the specific purpose of performing
the services specified in the contract, or as otherwise permitted by the CCPA, including retaining, using, or disclosing
the Personal Data for a Commercial Purpose other than providing the services specified in the contract with the
Channel Partner. The terms “Business Purpose” and “Commercial Purpose” have the same meaning as those terms
are used in the CCPA. For the avoidance of doubt, when a Party Processes Personal Data on behalf of the other Party
pursuant to the Agreement, they do so as a Service Provider.
“Sub-processor” means any entity which Processes Personal Data on behalf of Processor.
“Third-Party Country” means any country, territory, or specified sector within that country, outside of the countryof Controller, and that is not in the European Union (EU) or the European Economic Area (EEA). For Personal Dataoriginating from the United Kingdom (“UK”) references in this DPA to the “EU” or “EEA” shall be replaced with the“UK”.
2. PROCESSING OF PERSONAL DATA
2.1
Roles of the Parties. The subject matter, duration, purpose of the Processing, and the types of Personal Dataand categories of Data Subjects Processed under this DPA are further specified in Schedule 1.
2.1.1
Controller Obligations. Controller’s instructions for the Processing of Personal Data shall comply with Data
Protection Laws and Regulations. Controller shall have sole responsibility for the accuracy, quality, and legality of
Personal Data and the means by which Controller acquires Personal Data and provides it to Processor.
If there are multiple Controllers or Data Controllers who may provide instructions for Processing pursuant to this
DPA, the Parties agree that the Channel Partner or the Ivanti entity identified in Schedule 1 will serve as the singular

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
Controller ("Identified Controller") to issue instructions to the Party acting as Processor. For the avoidance of doubt,
the Identified Controller will act as the “Data Exporter” for the applicable data transfer mechanism.
When Channel Partner acts as a Processor and Ivanti is its Subprocessor, the Channel Partner identified in Schedule
1 shall be responsible for relaying instructions and notifications from their Controller to Ivanti as appropriate.
2.1.2
Ivanti as Controller. Ivanti and its Affiliates may Process Channel Partner’s Personal Data that relates toChannel Partner or is the Personal Data of Channel Partner personnel or contractors (collectively, “Channel Partner
Personal Data”) collected in connection with the performance of the Services. Channel Partner Personal Data may
be Processed for the purposes of management of Ivanti’s suppliers and service providers throughout the supply chain;business communications to organize tenders; implement tasks in preparation of or to perform existing contracts;billing and invoicing; third party management and assessment for compliance purposes; management of Ivanti’s IT
resources, including infrastructure management; business continuity and data governance; exercise of Channel
Partner’s personnel’s rights and data management (including, but not limited to, data matching assessments, data
analytics, data quality assessments, data ingestion, etc.). In addition, Ivanti may use machine learning solutions forwhich Channel Partner Personal Data is processed mainly for, but not limited to, product mastering, productclassification, golden record alignment and data enrichment, and data matching assessment.
2.2
Processor Obligations. All Personal Data Processed by Processor pursuant to the Agreement is Confidential
Information and Processor will Process Personal Data only in accordance with Controller’s documented instructions
set forth in Schedule 1 or as otherwise provided by Controller in writing. Processor will not sell the Personal Data
Processed under this DPA and will not retain, use, or disclose Personal Data outside of the direct business relationshipbetween Processor and Controller. Processor shall adhere to all Applicable Data Protection Laws with regard to
Processing Personal Data. Processor will not combine Personal Data provided by Controller with Personal Data thatit receives from other sources. Where the Processor believes that compliance with any instructions by Controller would
result in a violation of any Applicable Data Protection Law, the Processor shall notify Controller thereof in writing
without delay. Processor shall make available to the Controller all information necessary to demonstrate Processor’s
compliance with its obligations under this DPA.
2.3
Assistance Requirements. Processor shall assist Controller with: compliance with Applicable Data
Protection Laws; suspected and relevant Data Breaches; notifications to, or inquiries from a Data Protection Authority;
notifications to, and inquiries from, Data Subjects; and Controller’s obligation to carry out data protection impact
assessments and prior consultations with a Data Protection Authority.
3. NOTIFICATION OBLIGATIONS
3.1
Processor’s Notification Obligations. Processor shall immediately notify Controller, in writing, of thefollowing:
3.1.1
A Data Subject’s request to exercise their privacy rights such as accessing, rectifying, erasing, transporting,objecting to, or restricting their Personal Data;
3.1.2

Any request or complaint received from Controller’s customers or employees;

3.1.3

Any question, complaint, investigation, or other inquiry from a Data Protection Authority;

3.1.4
Any request for disclosure of Personal Data that is related in any way to Processor’s Processing of Personal
Data under this DPA;
3.1.5

A Data Breach pursuant to the notification obligations set forth in Section 7.1; and3.1.6
Where the Personal Data becomes subject to search and seizure, an attachment order, confiscation duringbankruptcy or insolvency proceedings, or similar events or measures by third parties while being Processed.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
3.1.7
Processor will assist Controller in fulfilling Controller’s obligations to respond to requests relating toparagraphs (3.1.1)-(3.1.6) above and will not respond to such requests without Controller’s prior written consent
unless Processor is required to respond by law.
4. CONFIDENTIALITY
4.1
Confidential Information. All Information provided to Processor pursuant to the Agreement is Confidential
Information.
4.2
Processor’s Personnel. Processor shall ensure that its personnel engaged in the Processing of Personal Data
are informed of the confidential nature of the Personal Data, have received appropriate training on their
responsibilities, and have executed written confidentiality agreements. Processor shall ensure that such confidentiality
obligations survive the termination of their respective employment relationship with such individuals.
4.3
Limitation of Access. Processor shall ensure that Processor’s access to Personal Data is limited to those
personnel performing Services in accordance with the Agreement.
5. SUB-PROCESSORS
5.1
Appointment of Sub-processors. The Parties acknowledge and agree that the Processor and the Processor’s
Authorized Affiliates may engage third-party Sub-processors in connection with the provision of the Services. The
Processor or a Processor’s Authorized Affiliate shall enter into a written agreement with each Sub-processor
containing data protection obligations not less protective than those in this DPA to the extent applicable to the natureof the Services provided by such Sub-processor.
The Parties agree that the copies of Sub-processor agreements that must be sent by Processor to Controller pursuant
to the Standard Contractual Clauses (where applicable) may have all commercial information, or clauses unrelated to
the Agreement, removed by Processor beforehand; and, that such copies will be provided by Processor only upon
reasonable request by Controller.
5.1.1. Channel Partner hereby authorizes Ivanti to engage its current list of Sub-processors as listed athttps://www.ivanti.com/company/legal/ivanti-subprocessors to Process Personal Data in accordance with this DPA.
Channel Partner will not directly communicate with Ivanti’s Sub-processors about the Services, unless agreed to by
Ivanti in Ivanti’s sole discretion.
5.2
Notification of Changes to Sub-Processors. The Parties will inform each other of any intended changes
concerning the addition or replacement of Sub-processors by providing each other with written notification.
5.2.1. Ivanti will inform Channel Partner of any intended changes concerning the addition or replacement of Subprocessors by providing Channel Partner with a mechanism to subscribe to receive notifications of new Sub-processors
at https://www.ivanti.com/company/legal/ivanti-subprocessors.
5.3
Objection Right for New Sub-Processors. A Party may reasonably object to the use of a new Sub-processor
by the notifying party by sending a written objection to the notifying Party within fifteen (15) business days after
receipt of notice. In the event the notified Party timely objects to a new Sub-processor by the notifying party, thenotifying Party will use reasonable efforts to make available to the notified Party a change in the Services to avoid
Processing of Personal Data by the objected-to new Sub-processor. If the notifying Party is unable to make available
such change, the notified Party may terminate the applicable Agreement with respect to those Services which cannot
be provided by the notifying Party without the use of the objected-to new Sub-processor.
5.4
Liability for Acts of Sub-Processors. Each Party shall be liable for the acts and omissions of its Subprocessors to the same extent they would be liable if performing the services of each Sub-processor directly under theterms of this DPA.
6. SECURITY

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
6.1
Protection of Personal Data. The Parties shall maintain appropriate technical and organizational measuresfor protection of the security (including protection against unauthorized or unlawful Processing and against accidental
or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data),
confidentiality and integrity of Personal Data.
6.2
Audit Rights. The Parties agree that the right to audit the other Party may be satisfied by presenting up-todate attestations, reports or extracts from independent bodies, including without limitation external or internal auditors,
data protection officer, the IT security department, data protection or quality auditors or other mutually agreed to third
parties or certification by way of an IT security or data protection audit. To the extent it is not possible to satisfy anaudit obligation mandated by applicable Data Protection Laws and Regulations through such attestations, reports or
extracts, a Party’s designee, has the right to audit and inspect—at auditing Party’s expense—the audited Party’s
premises, policies, procedures, and computerized systems to make sure Processor complies with the requirements inthis DPA. The auditing Party’s designee will provide at least thirty (30) days notification before conducting an audit
unless such audit is required due to a Data Breach involving the audited Party. Audits by will not violate a Party’s
confidentiality obligations with their other clients. All audits will be conducted during normal business hours, at a
principal place of business or other location(s) where Personal Data is accessed, processed or administered, and will
not unreasonably interfere with day-to-day operations. Before the commencement of any such audit, the Parties shallmutually agree upon the timing, scope, and duration of the audit. An auditing Party may request a summary audit
report(s) or audit no more than once annually.
7. DATA BREACHES
7.1
Data Breach Notification. The Parties shall notify each other in writing without undue delay after becoming
aware of a suspected Data Breach impacting Personal Data Processed under this DPA. In no event shall such
notification be made more than 72 hours after a Party’s discovery of the Data Breach.
7.2
Data Breach Management. The Party reporting the Data Breach shall make reasonable efforts to identify
the cause of such Data Breach and take those steps as the reporting Party deems necessary and reasonable to remediate
the cause of such a Data Breach to the extent the remediation is within the reporting Party’s reasonable control.
8. TERMINATION
8.1
Termination. This DPA shall terminate automatically upon the later of (a) the termination or expiry of theAgreement or (b) a Party’s deletion or return of Personal Data. A Party shall further be entitled to terminate this DPA
for cause if the other Party is in a material or persistent breach of this DPA which, in the case of a breach capable ofremedy, shall not have been remedied within ten (10) days from the date of receipt by the other Party of a notice fromsuch Party identifying the breach and requesting its remedy.
8.2
Return or Deletion of Data. Upon termination of this DPA, the Parties will delete or return all existing
copies of Personal Data unless applicable law requires continued retention of the Personal Data. Upon the request ofa Party, the other Party shall confirm compliance with such obligations in writing and delete all existing copies. In
instances where local law requires a Party to retain Personal Data, such Party will protect the confidentiality, integrity,
and accessibility of the Personal Data; will not actively Process the Personal Data; and will continue to comply withthe terms of this DPA.
9. MECHANISMS FOR INTERNATIONAL TRANSFERS
9.1
Transfers Outside of the EU/UK/Switzerland to a Country with an Adequacy Decision. Processor shall
rely on an adequacy decision to transfer Personal Data when such adequacy decision has been granted under applicabledata protection laws. For the avoidance of doubt, if Processor is certified under the Data Privacy Framework Program,
granted by the Commission Implementing Decision of 10.7.2023 on the Adequate Level of Protection of Personal
Data Under the EU-US Data Privacy Framework (“DPF”), the DPF shall apply and supersede the applicable transfer
mechanism(s) set forth in Section 9.2 of this DPA as a valid transfer mechanism to Personal Data transferred to theUnited States.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
9.2
Transfers Outside of the EU. During the provision of Services under the DPA, it may be necessary totransfer Personal Data from the European Union, the European Economic Area and/or their member states, the United
Kingdom, or Switzerland to Processor in a country that does not have an adequacy decision from the European
Commission or is not located in the European Economic Area. In the event of such a transfer, the Standard Contractual
Clauses apply as follows:
9.2.1

In relation to Personal Data that is subject to the GDPR:

9.2.1.1. Where transfers of Personal Data from a Party acting as a Controller in the EU or the EEA to a Party acting
as a Controller in a Third-Party Country, Module 1 shall apply.
9.2.1.2 Where transfers of Personal Data from a Party acting as a Controller in the EU or the EEA to a Party acting
as a Processor in a Third-Party Country, (i) the Controller is the "data exporter" and the Processor will be deemed the"data importer" and ; (ii) the Module Two terms shall apply; (iii) in Clause 7, the optional docking clause shall bedeleted; (iv) in Clause 9 , Option 2 shall apply and the list of Sub-Processors and time period for notice of changes
shall be as agreed under Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause
17, Option 1 shall apply and the Standard Contractual Clauses shall be governed by the member state where Channel
Partner is domiciled; (vii) in Clause 18(b), disputes shall be resolved before the courts of the member state where
Channel Partner is domiciled; (viii) Annex I and Annex II shall be deemed completed with the information set out in
Schedule 1 of this DPA respectively; and (ix) if and to the extent the Standard Contractual Clauses conflict with any
provision of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of suchconflict. For this section, the Standard Contractual Clauses from the Commission Implementing Decision (EU)2021/914 are incorporated by reference and available here: https://ec.europa.eu/info/law/law-topic/dataprotection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clausesinternational-transfers_en.
9.2.2
Where transfers of Personal Data from a Party acting as a Processor in the EU or the EEA to a Party acting
as a Sub-processor to the Processor in a Third-Party Country, (i) the Processor is the "data exporter" and the Subprocessor will be deemed the "data importer" and; (ii) the Module Three terms shall apply; (iii) in Clause 7, theoptional docking clause shall be deleted; (iv) in Clause 9, Option 2 shall apply and the list of Sub-processors and time
period for notice of changes shall be as agreed under Section 5 of this DPA; (v) in Clause 11, the optional language
shall be deleted; (vi) in Clause 17, Option 1 shall apply and the Standard Contractual Clauses shall be governed by
the member state where Channel Partner is domiciled; (vii) in Clause 18(b), disputes shall be resolved before thecourts of the member state where Channel Partner is domiciled; (viii) Annex I and Annex II shall be deemed completedwith the information set out in Schedule 1 of this DPA respectively; and (ix) if and to the extent the Standard
Contractual Clauses conflict with any provision of the Agreement (including this DPA) the Standard Contractual
Clauses shall prevail to the extent of such conflict. For this section, the Standard Contractual Clauses from theCommission Implementing Decision (EU) 2021/914 are incorporated by reference and available here:
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standardcontractual-clauses-scc/standard-contractual-clauses-international-transfers_en.
9.2.3
In relation to Personal Data that is subject to UK Data Protection Laws, the International Data Transfer
Agreement (“IDTA”) shall apply with the following modifications: (i) the contact information about the parties to theAgreement is the contact information for the IDTA; (ii) Channel Partner is the data exporter and Processor is the data
importer; (iii) the laws that govern the IDTA and the location where legal claims can be made is England and Wales;(iv) the UK GDPR does not apply to the data importer’s processing of transferred data; (v) the Parties do not use theadditional security or commercial clauses from the IDTA; and (vi) the information in this DPA and Schedule 1 canbe used for Tables 1-4. For this section, the Standard Contractual Clauses from the Information Commissioner’s
Office are incorporated by reference and available here: https://ico.org.uk/for-organisations/guide-to-dataprotection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-andguidance/.
9.2.4
In relation to Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses referenced in
Section 9.1.1 shall apply with the following modifications (i) references to "Regulation (EU) 2016/679" shall beinterpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" shall beinterpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
courts" shall be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the"relevant courts in Switzerland".
9.3
Alternative Data Transfer Mechanisms. The Parties acknowledge that the laws, rules and regulations
relating to international data transfers are rapidly evolving. In the event either Party adopts another mechanism
authorized by applicable laws, rules or regulations to transfer Personal Data (each an “Alternative Data Transfer
Mechanism”), the Parties agree to work together in good faith to implement any amendments to this DPA necessary
to implement the Alternative Data Transfer Mechanism.
If a law or regulation replaces or supersedes any of the standard contractual clauses referenced in this Section, theParties may adopt the text of the new standard contractual clauses without having to amend this DPA.
10. MISCELLANEOUS PROVISIONS
10.1
Amendments. This DPA may not be amended or supplemented, nor shall any of its provisions be deemed
to be waived or otherwise modified, except through a writing duly executed by authorized representatives of bothparties.
10.2

Governing Law. This DPA shall be governed by the governing law set forth in the Agreement.

List of Schedules:
Schedule 1: Description of the Processing

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENTSCHEDULE 1
Description of the Processing
Contact Information
Party Name: IvantiAddress: As stated in the Agreement between the Parties.
Representative/DPO/Privacy Office Email: privacy@ivanti.com
Party Name: Channel Partner
Address: As stated in the Agreement between the Parties.
Representative/DPO/Privacy Office Email:Subject-Matter
The subject-matter of the Processing:As set forth in the Agreement between the Parties.
Duration
Duration of the Processing:As set forth in the Agreement between the Parties.
Extent, Type and Purpose of the Processing
The extent, type and purpose of the Processing is as follows:
As set forth in the Agreement between the Parties.
Frequency of Transfer
Continuous.
Data Subjects
Personal Data Processing may relate to the following categories of Data Subjects:
Customers, prospects; employees; suppliers; commercial representatives; contacts; contractors (including contingent
workers); volunteer; temporary and casual workers; freelancers, agents, consultants and other professional
respondents, and their respective dependents, beneficiaries and emergency contacts; perspective employees andtemporary staff of customers; complainants, correspondents and enquirers; advisers, consultants and other professional
experts; employees or contact persons of data exporter’s prospects, customers, business partners and vendors; business
partners and vendors of data exporter (who are natural persons); and data exporter’s users authorized by data exporter
to use the software and related services.
Categories of Data
The Personal Data Processed may concern the following categories of data as approved by the Controller:
•
•
•
•
•

Identification data and employee master data (which may include title, name, address, telephone number, fax
number, company address, email address);
Authentication data;
Contact information;
Internet protocol (IP) address and other computer identifiers;
User-provided content;

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT••••

Pseudonymous identifiers;
Photos, videos, and audio;
Device identifiers; andOther data, as described in the Agreement.

Technical Measures to Secure Data
The following describes the minimum required technical and organizational security measures implemented by theParties:
Security Awareness Training
Processor has security awareness training which includes mandatory security training about the handling and securingof confidential information and sensitive information such as personally identifiable information, financial accountinformation, and health information consistent with applicable law, and periodic security awareness communications
and security courses that focus on end-user awareness.
Security Policies and Procedures
Processor has information security, use and management policies which dictate the actions of employees andcontractors regarding appropriate use, access to and storage of confidential and sensitive information; restrict accessto confidential and sensitive information to members of Processor's workforce who have a "need to know" suchinformation; prevent terminated employees from accessing Processor's information post-termination; and impose
disciplinary measures for failure to abide by such policies. System access to Processor resources denied unlessspecifically assessed and access granted. Processor performs background checks of its employees at time of hire, as
permitted by law.
Physical and Environmental Access Controls
Processor limits physical access to its information systems and facilities using physical controls (e.g., coded passaccess) that provide reasonable assurance that access to its data centers is limited to authorized individuals andemploys camera or video surveillance systems at critical internal and external entry points. Processor applies air
temperature and humidity controls for its data centers and protects against loss due to power failure.
Logical Access Controls
Processor employs logging and monitoring technology to help detect and prevent unauthorized access attempts to its
networks and production systems. Processor's monitoring includes a review of changes affecting systems' handlingauthentication, authorization, and auditing; privileged access to Processor's production systems.
Encryption Controls
Processor applies business-appropriate encryption controls across our products. Processor evaluates and applies intransit and at-rest encryption utilizing industry best practices for ciphers. Best practices are utilized for the lifecycle
management of encryption keys, including generation, storage, access control, and rotation.
Vulnerability Management
Processor regularly performs vulnerability scans and addresses detected vulnerabilities in accordance with their risk.
Processor products are also subject to periodic vulnerability assessment and penetration testing.
Disaster Recovery and Back-up Controls
Processor performs periodic backups of production file systems and databases according to a defined schedule andmaintains a formal disaster recovery plan for the production cloud data center, including regular testing.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT
Cyber Incident Response Plan
Processor employs an incident response plan to manage and minimize the effects of unplanned cyber events that
includes procedures to be followed in the event of an actual or potential security breach, including: an internal incident
response team with a response leader; an investigation team performing a root causes analysis and identifying affectedparties; internal reporting and notification processes; documenting responsive actions and remediation plans; and a
post-incident review of events.
Storage and Transmission Security
Processor employs technical security measures to guard against unauthorized access to Processor data that is beingtransmitted over a public electronic communications network or stored electronically.
Secure Disposal
Processor employs policies and procedures regarding the disposal of tangible and intangible property containing
Processor data so that Processor data cannot be practicably read or reconstructed.
Risk Identification & Assessment
Processor employs a risk assessment program to help reasonably identify foreseeable internal and external risks toProcessor's information resources and determine if existing controls, policies, and procedures are adequate to address
the identified risks.
Vendor & Services Providers
Third-party service providers or vendors (collectively, "Suppliers") with access to Processor's confidential information
are subject to risk assessments to gauge the sensitivity of Processor's information being shared. Suppliers will be
expected to comply with any pertinent contract terms relating to the security of Processor data, as well as any
applicable Processor policies or procedures. Periodically, Processor may ask a Supplier to re-evaluate its security
posture to help ensure compliance.

Version 02.24

PRIVILEGED AND CONFIDENTIAL