SUPPLIER PERSONAL DATA PROCESSING ADDENDUM
This Supplier Personal Data Processing Addendum (“DPA”) is between:
The Open Text entity having entered into the Agreement (as defined below) acting on its own behalf ("OT" or"OpenText") and its Affiliates; andthe other party to the Agreement ("Supplier").
Background
This DPA amends or supplements the written or electronic agreement (“Agreement”) between the parties to this DPA
provided that the Services include Processing of Personal Data, as may be described in Appendix B. If there is aninconsistency between any of the provisions of this DPA and the provisions of the Agreement in relation to theProcessing of Personal Data, the provisions of this DPA shall prevail. For the avoidance of doubt, Agreement alsomeans each Statement of Work (“SOW”) entered into between the Supplier and OT.

1.

DEFINITIONSIn this DPA, the following terms shall have the meanings set out below:
1.1 "Affiliate" means an entity that owns or controls, is owned or controlled by or is or under common control orownership with a party, where control is defined as the possession, directly or indirectly, of the power to direct
or cause the direction of management and the policies of an entity, whether through ownership of voting
securities, by contract or otherwise.
1.2 "Data Protection Legislation" means data protection and privacy laws including, without limitation, (i) the
GDPR (and any laws of Member States of the European Economic Area (EEA) implementing or supplementing
the GDPR), (ii) UK Data Protection Law and (iii) the data protection or privacy laws of Switzerland, in eachcase, to the extent applicable to the Processing of Personal Data under this DPA and the Agreement.
1.3 "EEA Controller to Processor SCCs" means the standard contractual clauses between controllers andprocessors, as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021,
which are set forth here as they are to apply to this DPA (as amended, updated or replaced from time to time).
1.4 "EEA Processor to Processor SCCs" means the standard contractual clauses between processor andprocessor, as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021,
which are set forth here as they are to apply to this DPA (as amended, updated or replaced from time to time).
1.5 "EEA Standard Contractual Clauses" means the EEA Controller to Processor SCCs and EEA Processor toProcessor SCCs.
1.6 "GDPR" means EU (European Union) General Data Protection Regulation 2016/679.
1.7 “Other Standard Contractual Clauses” means for Personal Data subject to Data Protection Legislation otherthan (i) the GDPR (and any laws of Member States of the European Economic Area (EEA) implementing or
supplementing the GDPR), (ii) UK Data Protection Law and (iii) the data protection or privacy laws of
Switzerland, the standard contractual provisions or model clauses approved by the corresponding dataprotection authority in order to lawfully transfer Personal Data internationally under applicable Data Protection
Legislation, as may be amended, updated or superseded from time to time.

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 1

1.8 "Restricted Transfer” means a transfer of Personal Data which, subject to the paragraph below, is:(i)from an exporter subject to GDPR which is only permitted in accordance with GDPR if aTransfer Mechanism is applicable to that transfer ("EEA Restricted Transfer");(ii)

from an exporter subject to UK Data Protection Law which is only permitted in accordance with
UK Data Protection Law if a Transfer Mechanism is applicable to that transfer ("UK RestrictedTransfer");(iii)

from an exporter subject to Data Protection Legislation applicable in Switzerland which is only
permitted under that law if a Transfer Mechanism is applicable to that transfer ("Swiss
Restricted Transfer"); and/or(iv)

from an exporter subject to Data Protection Legislation (other than those cited in (i), (ii) and(iii) above) which is only permitted under applicable Data Protection Legislation if Other
Standard Contractual Clauses are applicable to that transfer ("Other Restricted Transfer").

Transfers of Personal Data will not be considered a Restricted Transfer where:(v)

the jurisdiction to which the personal data is transferred has been approved by the European
Commission pursuant to Article 25(6) of the EC Directive 95/46 or Article 45 of the GDPR or,
as applicable, an equivalent provision under UK or Swiss Data Protection Legislation, as
ensuring an adequate level of protection for the processing of personal data; or(vi)

the transfer falls within the terms of a derogation as set out in Article 49 of the GDPR,
equivalent under Swiss Data Protection Legislation or the UK GDPR (as applicable).

1.9 "Services" means the services and other activities to be supplied or carried out by or on behalf of Supplier for
OT (or OT's customer) pursuant to the Agreement.
1.10 "Standard Contractual Clauses" means each of the EEA Standard Contractual Clauses, the UK Standard
Contractual Clauses and the Other Standard Contractual Clauses.
1.11 "Sub-processor" means any third party (including, without limitation, any Supplier Affiliate) appointed by oron behalf of Supplier to Process Personal Data on behalf of OT or OT Affiliate in connection with the Agreement.
1.12 "Transfer Mechanism" means the Standard Contractual Clauses or any other appropriate safeguards underarticle 46 of the GDPR or equivalent under Swiss Data Protection Legislation or UK Data Protection Law
applicable to a relevant transfer of Personal Data that has the effect of permitting that transfer or Other
Standard Contractual Clauses applicable to the relevant transfer of Personal Data that has the effect of
permitting that transfer.
1.13 "UK Data Protection Law" means UK GDPR and the Data Protection Act 2018.
1.14 "UK GDPR" has the meaning defined in The Data Protection, Privacy and Electronic Communications(Amendments etc.) (EU Exit) Regulations 2019.
1.15 "UK Controller to Processor SCCs" means the UK International Data Transfer Addendum which is set forth
here as it is to apply to this DPA , and may be amended, updated or replaced from time to time, incorporating
the EEA Standard Contractual Clauses to the extent it applies in respect of the transfer of Personal Data froma Controller to a Processor.
OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 2

1.16 "UK Processor to Processor SCCs" means the UK International Data Transfer Addendum which is set forth
here as it is to apply to this DPA, and may be amended, updated or replaced from time to time, incorporating
the EEA Standard Contractual Clauses the extent it applies in respect of the transfer of Personal Data from a
Processor to a Processor.
1.17 "UK Standard Contractual Clauses" means the UK Controller to Processor SCCs and UK Processor toProcessor SCCs.
1.18 The terms “Controller”, "Data Subject", "Personal Data", "Personal Data Breach", "Processing",“Processor” and "Supervisory Authority" shall have the same meaning as in the GDPR (or, where the relevant
processing is subject to alternative Data Protection Legislation, the defined term or concept set out in suchapplication Data Protection Legislation with the closest equivalent meaning to that given under the GDPR).

2.

DATA PROTECTION
2.1 Each party will comply with all applicable requirements of the Data Protection Legislation. This DPA is inaddition to, and does not relieve, remove, or replace either party’s obligations under the Data Protection
Legislation.
2.2 If Supplier determines the purposes and means of any Processing of OT’s Personal Data, Supplier becomes
the Controller for such Processing and is, consequently, solely responsible for the lawfulness of such
Processing by Supplier as Controller under applicable Data Protection Legislation. For the avoidance of doubt,
Supplier is only permitted to process Personal Data for the purposes set out in clause 2.4.1 below.
2.3 Appendix B sets out details of the subject matter, nature and purpose of processing, type of personal data andcategories of data subject. The duration of processing is the duration of the Agreement.
2.4 To the extent that Supplier currently has, has had or will have access or potential access to Personal Data of
OT and/or its customers or has or will generate, process, store or transmit Personal Data in providing theServices, in relation to any Personal Data processed under the Agreement and this DPA, Supplier agrees to:
2.4.1

process, use and maintain Personal Data for OT and/or its customers only in accordance with OT's
documented written instructions and the Agreement (together with this DPA) solely for the purposes of
performing its responsibilities and obligations under the Agreement unless required to do so by (i) in respectof Personal Data subject to GDPR, EU or Member State Law; (ii) in respect of Personal Data subject to UK
Data Protection Legislation, laws applicable in the United Kingdom; and (iii) in respect of Personal Data
subject to other Data Protection Legislation (excluding GDPR and UK Data Protection Law), applicablelaws, provided that the Supplier shall notify OT of that legal requirement before Processing. The Suppliershall make no other use of Personal Data other than for the provision of the Services to OT. Supplierrepresents and warrants that nothing would prevent it from fulfilling such obligations;2.4.2

where in the opinion of Supplier an instruction from OT infringes Data Protection Legislation, it shall inform
OT thereof (but such communication shall not constitute legal advice by Supplier). However, suchobligation shall not relieve Supplier from its own responsibility for compliance with Data Protection
Legislation;

2.4.3

neither (a) sell or disclose the Personal Data to any third party for the commercial benefit of Supplier or
any third party; nor (b) retain, use, disclose or otherwise Process the Personal Data outside of the directbusiness relationship between the Parties. Supplier certifies that it understands and will comply with all
restrictions placed on its Processing of the Personal Data;

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 3

2.4.4take appropriate technical and organizational measures to protect Personal Data against accidental or
unlawful destruction or accidental loss, alteration, unauthorized disclosure or access or use, and against
all other unlawful forms of Processing. The Supplier shall notify OT without undue delay in case of any
changes to the technical and organizational matters which affect the Personal Data or that would otherwise
reduce the level of protection of Personal Data;

2.4.5

ensure that only personnel who need to have access to Personal Data for provision of the Services are
granted access to such Personal Data and only for the purposes of the performance of the Services andinform all personnel of the confidential nature of the Personal Data and ensure personnel are subject toappropriate obligations of confidentiality and have received appropriate training on their responsibilities;

2.4.6

provide reasonable co-operation and assistance to OT (and the relevant Supervisory Authority, if
applicable) in relation to compliance with OT's (and its customers) obligations under Data Protection
Legislation including, but not limited to, in relation to: (i) any complaint or request made in respect of any
Personal Data by any Data Subject including, but not limited to, assistance in responding to requests forexercising the Data Subject's rights of: access, rectification, erasure and objection, restriction ofprocessing, data portability, and not to be subject to a decision based solely on automated processing; (ii)in the event of litigation or a regulatory inquiry concerning the Personal Data; and (iii) the carrying out ofdata protection impact assessments and/or consultations with a Supervisory Authority, all suchcooperation and assistance to be provided at no additional charge and the Supplier will abide by theadvice of OT and the relevant Supervisory Authority with regard to the Processing of Personal Data;

2.4.7

where a Data Subject submits a request to the Supplier to exercise their rights, the Supplier shall forward
these requests by email to OT at dpo@opentext.com or such other contact details notified by OT’s Privacy
Team to Supplier in writing from time to time. The Supplier shall not respond to a Data Subject request
unless and to the extent instructed by OT to do so;

2.4.8

without undue delay (but in any case within 24 hours) notify OT in writing if it becomes aware of (i) any
accidental or unauthorized access to Personal Data, (ii) any actual or potential Personal Data Breach or
breach of this DPA and / or Data Protection Legislation, (iii) any disclosure or request for disclosure of
Personal Data to a third party (except for disclosure to an approved Sub-processor in accordance with
Clause 2.4.10) and (iv) any request for disclosure or inquiry from a third party (including, without limitation,a public authority) concerning the Personal Data; and, (v) any change in applicable law that would render
Supplier unable to comply with this DPA. All such notices shall be directed to dpo@opentext.com in
addition to that specified in any notice procedures set forth in the Agreement;

2.4.9

If available and taking into account the nature of the Processing, the notification in accordance with clause
2.4.8 (i) and/or (ii) above shall at least:
2.4.9.1
describe the nature of the Personal Data Breach including without limitation and where
possible, the categories and approximate number of Data Subjects concerned, and the categories andapproximate number of Personal Data records concerned;
2.4.9.2
communicate the name and contact details of the data protection officer or other contact point
where more information can be obtained;
2.4.9.3

describe the likely consequences of the Personal Data Breach; and2.4.9.4
describe the measures taken or proposed to be taken by the Supplier to address the Personal
Data Breach, including without limitation, where appropriate, measures to mitigate its possible adverse
effects.
OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 4

Where, and in so far as, it is not possible to provide the information at the same time or becomes available
later, the information may be provided in phases without undue further delay;
2.4.10 not subcontract any of its Processing operations performed on behalf of OT or any OT Affiliate without theprior written consent of OT. The Supplier shall submit the request for prior written consent at least 60 days
prior to the engagement of the sub-processor, together with the information necessary to enable OT todecide whether to provide its prior written consent. OT has provided consent to those Sub-processors set
out at Appendix D. Where Supplier subcontracts its obligations, it shall do so only by way of a writtenagreement with the Sub-processor which imposes the same obligations on the Sub-processor as are
imposed on Supplier under this DPA. Supplier confirms that it has entered or (as the case may be) willenter into a written agreement with its Sub-processors incorporating terms which are substantially similar
to those set out in this DPA. Supplier shall remain fully liable to OT for all acts or omissions of any Subprocessor;
2.4.11 not make a transfer of Personal Data (including, without limitation any Restricted Transfer of Personal
Data by the Supplier to any Sub-processor), and procure that Sub-processors do not make a transfer of
Personal Data, without the prior written consent of OT and provided always that such transfer and/or
Restricted Transfer is compliant with Data Protection Legislation including, without limitation Standard
Contractual Clauses entered into between the Supplier and relevant Sub-processor. The Supplierconfirms that it has entered into Standard Contractual Clauses and/or Other Standard Contractual Clauses
with all Sub-processors where there is a Restricted Transfer. Supplier shall provide copies of the applicable
Transfer Mechanism in place with Sub-processors promptly if requested by OT (provided that Supplier
may redact commercially sensitive and confidential information);
2.4.12 within five (5) business days of receipt of a written request from OT:
2.4.12.1 provide OT (or OT's customers where applicable) with reasonable access to its personnel,
premises, facilities and Sub-processors to enable OT to conduct an on-site inspection audit;
2.4.12.2 authorise OT to make confidential copies of any materials including, without limitation, anyrecords and information required to be obtained and maintained under the Agreement, this DPA
and Data Protection Legislation which are relevant to assessing compliance with the Agreement
and DPA and, where applicable, to share such copies with OT's customers;
2.4.12.3 provide evidence of Supplier's relevant policies and other related documents to verify that
Supplier is complying with its obligations under this DPA and, where applicable, to share suchcopies with OT's customers; and2.4.12.4 where available, provide a copy of the latest Service Organization Control (SOC) audit report
and/or other third-party audit reports or information (in each case, provided by an entity reasonably
acceptable to OT) to demonstrate the processing activities of Supplier relating to the Personal Data
is in compliance with its obligations under this DPA and, where applicable, to share such copies
with OT's customers.
2.4.13 Any on site audit under Clauses 2.4.12.1 ("On Site Audit") shall be conducted during ordinary businesshours on business days and shall not interfere unreasonably with Supplier’s ordinary business. If theresults of an On Site Audit or other audit of information provided pursuant to Clause 2.4.12 (togetheran "Audit") show that Supplier is not complying with the Agreement and/or DPA, then Supplier mustensure prompt remedy of the non-compliance and comply with OT's reasonable directions to remedy
the non-compliance, including without limitation directions as to timing. Any Audit shall be conducted,
and all information to be provided pursuant to this clause shall be provided, at the cost of the Supplier;
OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 5

2.4.14 On termination of the Agreement, return to OT or permanently delete all copies of such Personal Data,
as directed by OT, and certify compliance with this obligation in writing to OT. Such certification ofcompliance to be signed by a signing officer of Supplier; and2.4.15 Indemnify OT and its Affiliates from and against all claims, damages, expenses, losses or liabilities
resulting from a breach of the DPA. Data Subjects may enforce the provisions of this DPA as a thirdparty beneficiary against Supplier with respect to their Personal Data. Breach of this DPA shall bedeemed a material breach of the Agreement.
2.5 Supplier agrees to comply with the terms of Appendix A: ‘Technical and Operational Measures’, which form
part of the Agreement and this DPA.
2.6 Notwithstanding anything to the contrary in the Agreement or elsewhere, the obligations of the Supplier under
this DPA shall not be subject to any limitations or exclusions to the liability of the Supplier or its Affiliates.
2.7 International transfers
2.7.1

The Parties shall have in place a Transfer Mechanism in respect of any Restricted Transfer between
the Parties and shall comply with Appendix C if there is a Restricted Transfer.

2.7.2

In the event of an EEA Restricted Transfer or Swiss Restricted Transfer where Personal Data istransferred from OT as data exporter acting as a Controller to Supplier as data importer acting as a
Processor, the Parties shall, as part of this DPA, comply with the EEA Controller to Processor SCCs,
which are hereby incorporated into this DPA.

2.7.3

In the event of an EEA Restricted Transfer or Swiss Restricted Transfer where Personal Data istransferred from OT as data exporter acting as a Processor to Supplier as data importer acting as a
Processor, the Parties shall, as part of this DPA, comply with the EEA Processor to Processor SCCs,
which are hereby incorporated into this DPA.

2.7.4

In the event of a UK Restricted Transfer, the Parties shall, as part of this DPA, comply with the UK
Standard Contractual Clauses, which are hereby incorporated into this DPA.

2.7.5

In the event of an Other Restricted Transfer, the Parties shall. as part of this DPA, comply with the
Other Standard Contractual Clauses, which are hereby incorporated into this DPA. To the extent
applicable, the information set out in the Appendices of the EEA Standard Contractual Clauses shallapply (where relevant) in respect of the Other Standard Contractual Clauses.

2.7.6

For the purposes of the EEA Standard Contractual Clauses, Annex 1 (Description of Transfer) shall bedeemed to incorporate the information set out at Appendix E to this DPA; Annex 2 (Description ofTechnical and Organisational measures) shall be deemed to incorporate the terms set forth in Appendix
A to this DPA (Technical and Organisational measures) and Annex 3 (List of Sub-processors) shall bedeemed to incorporate the information set forth in Appendix D to this DPA.

2.7.7

If there is a conflict between the provisions of the Standard Contractual Clauses and this DPA the
Standard Contractual Clauses shall prevail. OT may at its discretion, utilise another appropriate crossborder transfer mechanism approved by an appropriate data protection authority or the European
Commission (as applicable) which has been adopted by and agreed to by OT.

2.7.8

Where the Standard Contractual Clauses apply between OT and Supplier, if the Supplier has factuallydisappeared, ceased to exist in law or has become insolvent, OT’s customer (as a third-party beneficiary

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 6

right) shall have the right to terminate the relevant portion of the agreement with the Supplier pertaining
to that customer and to instruct the Supplier to erase or return its Personal Data.
2.8 Where any replacement of , or amendment to, the Standard Contractual Clauses is approved by the competentauthority/ies or governmental body/ies (including, without limitation, a supervisory authority or the European
Commission or a UK Government Department) (“New Solution”), the New Solution will be deemedincorporated into the DPA and Agreement and take effect and be binding on the parties from the date of suchapproval by the applicable competent authority or governmental body or, if later, the end of any grace period
applicable to the New Solution. In the event reasonably required by OT or Supplier or where required byapplicable Data Protection Legislation or on request by the competent authority/ies or governmental body/ies,
OT and Supplier shall enter into signed copies of the New Solution with details of processing as set out in, or
substantially similar to, those set out in the Standard Contractual Clauses.
2.9 Conflict
2.9.1

2.10

If there is an inconsistency between any of the provisions of the Standard Contractual Clauses, this
DPA and the provisions of the Agreement in relation to the Processing of Personal Data, the provisionsof the Standard Contractual Clauses shall prevail over the DPA and Agreement, and this DPA shallprevail over the Agreement.
Other provisions

2.10.1 The Parties agree that on and from 27th September 2021 this DPA shall replace and supersede any
existing data processing addendum, attachment, exhibit or standard contractual clauses that Supplierand OT may have previously entered into in connection with the Services.
2.10.2 The parties confirm that in all other respects, the terms, covenants and conditions of the Agreement
remain unchanged and in full force and effect, except as modified by this DPA. It is understood andagreed that all terms and expressions when used in this DPA, unless a contrary intention is expressedherein, have the same meaning as they have in the Agreement.

ACCEPTED AND AGREED:ACCEPTED AND AGREED:

OPEN TEXT CORPORATIONOn behalf of itself and its affiliates___________________________________
Supplier Legal Entity Name

By: _______________________________

By: _______________________________

Name:

Name:

Title:

Title:

Date:

Date:

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 7APPENDIX ATECHNICAL AND ORGANISATIONAL MEASURES(IT SECURITY TERMS AND CONDITIONS)
Supplier must comply with the Technical and Organisational Measures (IT Security Terms and Conditions) including,
without limitation, its appendices and ensure any subcontractor engaged by the Supplier, also complies with theTechnical and Organisational Measures.
For the Technical and Organisational Measures (IT Security Terms and Conditions) see here as may be amended,
updated or replaced from time to time (which are also available on OpenText’s Supplier Information page:https://www.opentext.com/about/supplier-information). These Technical and Organisational Measures (IT Security
Terms and Conditions) are incorporated into this DPA by reference (with the same force and effect as though fully set
forth in this DPA).
References to OpenText information, OpenText data and OpenText assets shall be deemed to include Personal Data
of OpenText and/or its customers or other Personal Data that Supplier has or will generate, process, store or transmit
in providing the Services.

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 8APPENDIX B
DETAILS OF THE PROCESSING OF PERSONAL DATA
Subject matter and duration of the Processing of Personal Data
Supplier is processing Personal Data in order to provide Services to OT and its affiliates under the Agreement
The duration of the Processing of the Personal Data is set out in the Agreement (and documentation governed by it)
and this DPA.
The nature and purpose of the Processing of Personal Data
In the performance of Services under the Agreement, Supplier may from time to time perform data processing activities
which may include, without limitation,
1. use of Personal Data to provide the Services.
2.collecting, recording, storing, structuring, modifying, adapting, altering or destroying the Personal Data of a
Data Subject.
3.execution of instructions of OT in accordance with the Agreement and DPA.
The types of Personal Data to be processed
As further described in the Agreement, the categories of Personal Data may include without limitation the following:
1. Personal contact information (e.g. name, and personal addresses, phone numbers, and email addresses)
2. Work contact information (e.g. work addresses, phone numbers, and email addresses)
3. Detailed personal information (e.g. age and/or date of birth, gender, marital status, photos, former names,
emergency contact information, and dependent information)
4. Identification number (e.g., employment number, social security number, social insurance number, driving
license number, student number, national ID card number, and passport number)
5. Education and skills information (e.g. education history, degrees earned, institutions attended, academic
records, qualifications, skills, training details, training records, professional expertise, work history andexperience, and other resume/CV information)
6. Financial information (e.g. bank account information or details, information pertaining to salary, bonus,
equity, taxes, benefits, credit, credit cards, and expenses)
7. Geo location / Time-zone
8. Any application-specific data
9. IT systems information (such as user credentials, computer name, domain name, IP address, and software
usage pattern tracking information i.e. cookies)
Special categories of data (if appropriate)As further described in the Agreement, the special categories of Personal Data within the scope of this DPA may include,
without limitation sensitive personal data
The categories of Data Subject to whom the Customer Personal Data relates
Data subjects under this DPA may include, without limitation:
1. Employees and other staff members, agents, suppliers, advisors or sub-contractors of OT’s end customer(s)and/or their client(s).
2. User’s of OT’s end Customer’s software or application(s) or services;
3. Employees and other staff members, agents, suppliers, advisors or sub-contractors of OT or its Affiliates;
4. Partners of OT or of its Affiliates, including without limitation their employees and other staff members,
agents, suppliers, advisors or sub-contractors
5. Any other natural person or individual having Personal Data stored, transmitted to, made available to,accessed or otherwise processed by Supplier.

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 9APPENDIX CINTERNATIONAL DATA EXPORT REQUIREMENTS
The Supplier certifies and confirms that the responses provided by the Supplier in the Privacy and IT Security
Questionnaire are true and accurate in respect of both the Supplier and its Sub-processors and that the Supplier andits Sub-processors are compliant with such responses. The Supplier shall notify OT promptly of any actual or potentialchange that would impact the responses provided.
Supplier will adopt supplementary measures to provide such safeguards for the Personal Data as are necessary, inparticular as regards to any access by public authorities, to protect the Personal Data against any interference that goesbeyond what is necessary and proportionate in a democratic society to safeguard national security, defence and public
security and/or that would impinge on the parties’ ability to comply with the Standard Contractual Clauses.
The supplier commits to provide evidence of supplementary measures that ensure the protection of the Personal Data.

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 10APPENDIX D
SUB-PROCESSORS AND LOCATIONS OF PROCESSING
In the event there is any international data transfer the Supplier will provide information relating to the jurisdictions
the processing of Personal Data will take place and provide it in the format set out below.
Approved Sub-processors and locations of processing by those Sub-processors are set out below:
Supplier Group Sub-processors:
Name

Address

Contact
person’s name,position andcontact details

Subprocessor
location(s)Locations ofonward datatransfers by
Subprocessor

Description of
the processing(including aclear
delimitation of
responsibilities
in case several
sub-processors
are authorised)

Subprocessor
location(s)Locations ofonwarddatatransfers by
Subprocessor

Description of theprocessing(including a clear
delimitation of
responsibilities incase several Subprocessors areauthorised)Transfer
Mechanism

Third Party Sub-processors
Name

Address

Contact
person’sname, positionand contact
details

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Transfer
Mechanism

Page 11APPENDIX EDESCRIPTION OF TRANSFER
1

Data exporter(s): Identity and contact details of the data exporter(s) and, where applicable, of its/theirdata protection officer and/or representative in the European Union
Name:

OT (as defined in the DPA)

Address:

As set out in the Agreement.

Contact person’s name,

DPO@opentext.com

position and contact details:

OT Data Protection Officer
Prof. E.M. Meijerslaan 1
1183 AV Amstelveen
The Netherlands

Activities relevant to the data transferred under these Clauses: OT is obtaining Services from the Supplier.
Role:
2

Controller or Processor (as applicable)

Data importer(s): Identity and contact details of the data importer(s) and, where applicable, of its/theirdata protection officer and/or representative in the European Union
Name:

Supplier (as defined in the DPA)

Address:

As set out in the Agreement.

Contact person’s name,Contact details as set out in the Agreement

position and contact details:
Activities relevant to the data transferred under these Clauses: Provision of Services pursuant to theAgreement.
Role:

3

Processor or Sub-processor

Categories of data subjects whose personal data is transferred

See Appendix B.
4

Categories of personal data transferred

See Appendix B.
5

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose
limitation, access restrictions (including access only for staff having followed specialised training),
keeping a record of access to the data, restrictions for onward transfers or additional security measures.

See Appendix B for details of special categories of personal data.
OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 12

Additional safeguards may include, without limitation, specific access restriction, encryption at rest, policies andprocedures on handling of the personal data for specific teams
6

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Transfers shall be made on a continuous basis during the term of the Agreement or otherwise provided as per theService configuration or documentation.
7

Nature of the processing

See Appendix B.
8

Purpose(s) of the data transfer and further processing

See Appendix B.
9The period for which the personal data will be retained, or, if that is not possible, the criteria used todetermine that period

See Appendix B.
10

Subject matter, nature and duration of the processing for transfer to (sub-) processors

In respect of the Standard Contractual Clauses, transfers to Sub-processors shall be on the same basis as set out in
the DPA.
11

Competent Supervisory authority

Where the data exporter is established in an EU Member State: Netherlands
Where the data exporter is not established in an EU Member State, but falls within the territorial scope of applicationof Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article
27(1) of Regulation (EU) 2016/679: Netherlands
Where the data exporter is not established in an EU Member State, but falls within the territorial scope of applicationof Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative
pursuant to Article 27(2) of Regulation (EU) 2016/679: Netherlands

OpenText Supplier Personal Data Processing Addendum v.3 – November 2023

Page 13