Open Text Data
Processing Addendum
1. Scope and Applicability
This Data Processing Agreement (“DPA”) (including its Appendices and incorporations by reference)
supplements and forms part of the agreement (“Agreement") between the Open Text entity (“OT”) andthe other party to the Agreement (“Customer”). The terms in this DPA apply to the extent OT and its Subprocessors Process Customer Personal Data in the course of providing the Services, either as a
Processor or Service Provider, and when such Processing is subject to the Data Protection Legislation.
This DPA is in addition to, and does not relieve, remove, or replace either party’s obligations under theapplicable Data Protection Legislation.
Customer enters into this DPA on behalf of itself and, to the extent applicable and permissible under the
Agreement, each Customer Affiliate (as defined below) that Customer grants access to the Services inaccordance with the terms of the Agreement.

2. Definitions
In this DPA, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly. Capitalized terms used in this DPA that are not expressly defined herein shallhave the meanings set forth in the Agreement.
2.1.

“Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common
control or ownership with a company, where control is defined as the possession, directly or
indirectly, of the power to direct or cause the direction of management and the policies of anentity, whether through ownership of voting securities, by contract or otherwise.

OpenText Global DPA / Version 1.0 (S)

1 of 15

2.2.

“Customer Personal Data” means Personal Data made available by Customer and/or its
authorized users in connection with their use of the Services pursuant to the Agreement.

2.3.

“Data Protection Legislation” means any laws, regulations, and other legal requirements, to theextent applicable to the Processing (as defined below) of Customer Personal Data under this
DPA and the Agreement relating to: (a) privacy, confidentiality, and data security of Personal
Data; and/or (b) the use, collection, retention, storage, security, disclosure, transfer, disposal,
and/or other Processing of any Personal Data (as defined below) to the extent applicable toperformance of the Services. Notwithstanding the preceding, Data Protection Legislation does notinclude the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”).

2.4.

"EEA" means the European Economic Area as set forth in the European Economic Area
Agreement of 1992, as amended.

2.5.

“Restricted Transfer” means an international transfer of Personal Data made in connection with
the Agreement where such transfer would be prohibited by applicable Data Protection Legislation
except where:i.

a Transfer Mechanism may be put in place in respect of the relevant international transfer;ii.

the jurisdiction to which the Personal Data is transferred has been approved by the relevant
authority in that jurisdiction as ensuring an adequate level of protection for the Processingof Personal Data under applicable Data Protection Legislation; oriii. a derogation that permits such transfer under applicable Data Protection Legislation
applies.
2.6.

“Services” means the services to be supplied to or carried out by or on behalf of OT for
Customer pursuant to the Agreement, excluding on-premises and software maintenanceservices.

2.7.

"Personal Data Breach" means a confirmed breach of security resulting in the accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to,
Customer Personal Data and also includes any incident classified as a “security incident,” “databreach,” or similarly defined term under Data Protection Legislation to the extent such Data
Protection Legislation is applicable to the Processing of Customer Personal Data.

2.8.

“Standard Contractual Clauses” means, to the extent applicable under Data Protection
Legislation, each of the: (i) EEA Standard Contractual Clauses; (ii) EEA Standard Contractual
Clauses, as modified to comply with requirements under Swiss law; and (iii) UK Standard
Contractual Clauses.

2.9.

“Sub-processor” means any third party (including any OT Affiliate) appointed by or on behalf of
OT as a sub-contractor to Process Personal Data on behalf of Customer or Customer Affiliate inconnection with the Agreement.

2.10.

“Supervisory Authority” means the data protection authority, public body, or government
department identified and authorized by the applicable Data Protection Legislation as being
responsible for regulating and enforcing compliance with Data Protection Legislation.

2.11.

“Technical and Organizational Measures” means the technical and organizational measures
set out at https://www.opentext.com/assets/documents/en-US/pdf/opentext-technical-andorganizational-measures-en.pdf (and also referred to as Appendix 3), as may be amended,
updated, or replaced from time to time, which are incorporated into this DPA by reference.

OpenText Global DPA / Version 1.0 (S)

2 of 15

2.12.

“Transfer Mechanism” means the Standard Contractual Clauses and/or any other appropriate
safeguards, technical or organizational measures, or controls implemented in connection withtransfers of Personal Data to a third country in compliance with Data Protection Legislation
applicable to the relevant transfer.

2.13.

The terms “Controller,”, “Data Subject,", “Personal Data,", “Processing,", “Process” and“Processor”; “Sell,”, “Sensitive Personal Data,”, “Service Provider,”, “Share” have the same
meaning as in the applicable Data Protection Legislation (or their closest equivalent concept orterm as defined under such legislation).

3. Roles and Data Processing Obligations
3.1.

Roles and Scope of Processing
3.1.1.

The terms of this DPA apply only to the Processing of Customer Personal Data inenvironments controlled by OT and OT's Sub-processors. This includes Customer
Personal Data sent to OT but does not include data that remains on Customer's premises
or in any Customer selected third-party operating environments.

3.1.2.

Appendix 1 of this DPA sets out the subject matter, nature, and purpose of Processing ofCustomer Personal Data by OT, the duration of the Processing, and the types of
Personal Data and categories of Data Subjects.

3.1.3.

This DPA shall apply to the extent OT shall Process Customer Personal Data as a
Processor (or sub-processor) acting on behalf of Customer, in each case regardless ofwhether Customer acts as a Controller or as a Processor on behalf of another Controller.

3.1.4.

As a Controller, Customer is responsible for determining whether the Services areappropriate for storage and/or processing of Customer Personal Data that is subject toany specific law or regulation and for using the Services in a manner consistent with
Customer’s legal and regulatory obligations.

3.1.5.

Customer is responsible for providing notice to and obtaining all required valid consentsfrom Data Subjects including, without limitation, regarding any Processing (includingcollection, transfer, and storage) of Personal Data through the Services as required by
Data Protection Legislation; and confirms it is entitled to lawfully transfer the Customer
Personal Data to OT.

3.1.6.

Customer will act as, or appoint, a single point of contact for OT for the Processing of
Personal Data, and confirms that its instructions, including appointment of OT as a
Processor or Sub-processor, have been authorized by the relevant Controller.

3.1.7.

Each party will comply with applicable obligations under the Data Protection Legislation
given the nature and scope of that party’s Processing of Personal Data related to theAgreement and this DPA. Unless explicitly set forth herein, OT is not responsible forcompliance with any regulatory authority to which Customer is subject to or other laws or
regulations applicable to Customer that are not generally applicable to information
technology service providers.

OpenText Global DPA / Version 1.0 (S)

3 of 15

3.2.

OT Processing Obligations
3.2.1.

Customer Instructions: OT will Process Customer Personal Data solely for the purposeof providing the Services and in accordance with documented and commerciallyreasonable instructions from the Customer (to the extent necessary to provide theServices and to comply with its obligations under the Agreement). Customer agrees that
the Agreement (including this DPA) is its complete documented instructions to OT for theProcessing of Personal Data. Additional instructions, if any, require a written agreement
between the parties. Instructions by Customer related to the Processing of Personal Data
must be provided in writing duly signed by an authorized representative of Customer.
Where in the opinion of OT an instruction from the Customer infringes Data Protection
Legislation, OT shall inform Customer thereof which Customer agrees shall not constitutelegal advice by OT and shall not relieve Customer from its own responsibility forcompliance with Data Protection Legislation.

3.2.2.

Lawful Data Processing by OT: To the extent required by applicable law, OT may
Process Customer Personal Data outside of the documented instructions of Customer,
including transferring Customer Personal Data to a different jurisdiction or aninternational organization provided that, where permitted under such law, OT shall use
reasonable endeavors to inform Customer of that legal requirement before such
Processing.

3.2.3.

Confidentiality of Processing: OT will: (i) limit Customer Personal Data access to OT
personnel with a need to Process such information for the purpose of providing Services;and (ii) will ensure such persons have committed themselves to confidentiality or are
under an appropriate statutory obligation of confidentiality and have received appropriate
training on their responsibilities.

3.2.4.

Cooperation
3.2.4.1. Data Subjects Rights
i.

It is the Customer’s (or the party acting as Controller) responsibility to inform the Data
Subject(s) concerned of the purposes and the legal basis for which their Personal
Data will be Processed in accordance with Data Protection Legislation.

ii.

Taking into account the nature of the Processing, OT shall assist Customer, insofar
as is possible and reasonable for the fulfilment of Customer’s obligation under Data
Protection Legislation, to respond to Data Subject's rights requests under applicable
Data Protection Legislation (including, without limitation, requests relating to rights ofaccess, erasure, and rectification).

iii. Where a Data Subject directly submits a rights request to OT, OT shall forward such
request to the Customer email address on file with OT, without undue delay. If
Customer wishes for OT to forward Data Subject requests to a specific email
address, it shall notify OT of such address and provide updates where applicable. OT
shall not respond directly to a Data Subject rights request.
3.2.4.2 Data Protection Impact Assessments and Prior Consultation. Where requested by Customer
and to the extent required to be undertaken by Customer in compliance with Data Protection
Legislation, OT shall, taking into account the nature of Processing and the information available

OpenText Global DPA / Version 1.0 (S)

4 of 15

to OT, provide reasonable assistance to the Customer: (i) in carrying out data protection impact
assessments; or (ii) in relation to any prior consultation with a Supervisory Authority (or otherequivalent public authority or body with responsibility for compliance with Data Protection
Legislation).
3.2.4.3 Government and Law Enforcement Requests. If OT receives a request from a law
enforcement or other government entity (“Government Request(s)”) to retain, disclose, orotherwise Process Customer Personal Data, where permitted to do so, OT shall attempt toredirect the Government Request to Customer. If OT determines that a requirement to challenge
or appeal a Government Request regarding Customer’s Personal Data exists, Customer agrees
to participate in and support such challenge as reasonably requested. Where possible, theCustomer itself will seek a protective order or other appropriate remedy in response to theGovernment Request. OT will attempt to provide a minimum amount of information if OT is required todisclose any information by a Government Request.
3.3.

Sub-processing
3.3.1.

Customer provides OT a general authorization to appoint Sub-processors to Process
Customer Personal Data in connection with the provision of the Services. Customer
agrees that OT Sub-processors may include: (i) OT Affiliates and (ii) any other third party
engaged by OT in connection with the provision of the Services.

3.3.2.

OT shall inform Customer in advance of any new Sub-processor or replacement of Subprocessor to give the Customer opportunity to reasonably object to the changes. OT mustreceive the notice of objection in writing from the Customer within 14 days of receiving
the notification from OT. The parties agree that the name of the new or replacement Subprocessor together with details of the Processing activities it will carry out and thelocation of such activities is the information Customer requires to exercise such right.
“Inform” shall include by posting the update on a website (and providing Customer with amechanism to obtain notice of that update), by email or in other written form.

3.3.3.

Any objection raised by the Customer pursuant to Section 3.3.2 shall be limited to the
Sub-processor demonstrable failure to offer the same or a reasonably comparable levelof protection as that previously applicable to the relevant Processing of Customer
Personal Data (“Reasonable Objections”). OT shall have up to 30 days after receiving
the notice of objection (“Rectification Period”) to: (i) address any Reasonable
Objections raised by Customer; or (ii) propose an alternative Sub-processor provided that
Sections 3.3.1 and 3.3.2 shall apply to the appointment of the alternative Sub-processor.

3.3.4.

If Customer raises Reasonable Objections to the appointment of a new Sub-processor
pursuant to Section 3.3.3, and OT is unable to resolve such objections or provide analternative Sub-processor, the Parties shall enter into good faith negotiations to achieve aresolution. Unless otherwise agreed in writing by the parties, the good faith discussions
shall last for up to 14 days after the Rectification Period. Customer may terminate therespective part of the Services where the new Sub-processor is to be used by giving
written notice to OT no later than 30 days from the conclusion of the good faith
discussions where no resolution is reached. Such termination shall take effect no later
than 90 days following OT’s receipt of Customer’s notice of termination. If Customer does
not terminate within this 30-day period, Customer is deemed to have accepted the new
Sub-processor. Any termination under this Section 3.3.4 shall be deemed to be without

OpenText Global DPA / Version 1.0 (S)

5 of 15

fault by either Party and shall be subject to the terms of the Agreement (including any
documents agreed pursuant to it).

3.4.

3.3.5.

OT confirms that it has entered or will enter into a written agreement with its third-party
company Sub-processors incorporating terms, which are substantially similar to those set
out in this DPA.

3.3.6.

As between the Customer and OT, OT shall remain fully liable for all acts or omissions of
any Sub-processor appointed by it pursuant to this Section 3.3 unless the Sub-processor
acted in accordance with instructions directly or indirectly received from Customer.

Security Measures
3.4.1.

Taking into account the state of the art, the costs of implementation, and the nature,
scope, context, and purposes of Processing as well as the risk of varying likelihood andseverity for the rights and freedoms of natural persons, Customer and OT shall both beresponsible to implement appropriate technical and organizational measures to ensure alevel of security appropriate to the risk.

3.4.2.

OT shall implement the Technical and Organizational Measures in respect of theServices, and Customer acknowledges that the Technical and Organizational Measures
implemented by OT meet the standard of appropriateness as required under Data
Protection Legislation.

3.4.3.

Customer is responsible for implementing and maintaining privacy protections ofcomponents including technical architecture or infrastructure that Customer or any
Customer Affiliate provides, controls, or procures from athird party. Customer shall apply the principle of data minimization and limit OT access to systems or
Customer’s Personal Data to only where essential for the performance of the Services. Where OT is
performing Services on Customer’s premises (or of any Customer Affiliate or sub-contractor, agent, or
similar) or in connection with access to any of such party’s systems and data, Customer shall be
responsible for providing OT personnel with user authorizations and passwords to access those systems,
overseeing their use of those passwords, and terminating these as required. Customer shall not store
Customer’s Personal Data in a non-production environment unless it has production environment
equivalent controls in place.
3.5.

Notification of Personal Data Breach
3.5.1.

Unless prohibited under applicable law, OT shall notify Customer of Personal Data
Breach without undue delay, and in all instances within the time frames set forth underapplicable Data Protection Legislation, by contacting the Customer email address on file.
Such notification will include any available documentation necessary to enable theCustomer to make legally required notifications to Data Subject and/or the competentSupervisory Authority.

3.5.2.

If available and taking into account the nature of the Processing, the notification sent inaccordance with Section 3.5.1 shall at least:
3.5.2.1. describe the nature of the Personal Data Breach including where possible, thecategories, and approximate number of Data Subjects concerned, and thecategories and approximate number of Personal Data records concerned;

OpenText Global DPA / Version 1.0 (S)

6 of 15

3.5.2.2. communicate the name and contact details of the data protection officer or othercontact point where more information can be obtained;
3.5.2.3. describe the likely consequences of the Personal Data Breach; and3.5.2.4. describe the measures taken or proposed to be taken by OT to address the
Personal Data Breach, including, where appropriate, measures to mitigate its
possible adverse effects.

3.6.

3.5.3.

Where, and in so far as it is not possible to provide the information at the same time, theinformation may be provided in phases without undue further delay.

3.5.4.

The Customer (or the party acting as Controller) is responsible to notify the Personal
Data Breach to the Supervisory Authority, and to the Data Subjects, when such is
required by the applicable Data Protection Legislation.

Data Return or Destruction.

Where OT has stored Customer’s Personal Data as part of the Services: at the end of the Service(s)upon Customer’s written instruction, OT shall (i) return such Customer Personal Data to Customer in suchformat as OT reasonably determines, which may be provided via the enablement of export and retrieval
functions when available or (ii) delete the Customer Personal Data, unless applicable law requires further
storage of the Personal Data. Where Customer has not notified OT whether to return or destroy Customer
Personal Data within 30 days after termination of the Services, the parties agree that OT shall delete thedata in accordance with subsection (ii) above. OT may charge a fee for certain data return services.
3.7.

Inspections and Audits
3.7.1.

For the purpose of fulfilling any inspection obligations under applicable Data Protection
Legislation and/or any Standard Contractual Clauses:
3.7.1.1. Upon written request from Customer, OT shall, where available, provide to
Customer a copy of its latest Service Organization Control (SOC) audit report
and/or other third-party audit reports (“Audit Report”) or information todemonstrate OT’s compliance with its obligations under this DPA.
3.7.1.2. In the absence of an Audit Report or where the Audit Report or information madeavailable under Section 3.7.1.1 does not address OT's compliance applicable to
the Processing undertaken in connection with the Services, OT shall, upon
Customer's reasonable request either: (i) provide additional documentation ormaterials to evidence compliance; or (ii) permit an inspection of OT's
environment to the extent relevant to the provision of the Services and required
to demonstrate OT's compliance with its obligations under this DPA.

3.7.2.

Any inspection to be undertaken pursuant to Section 3.7.1: (a) may be carried out nomore than once annually (unless otherwise mandated by a Supervisory Authority); (b)shall not be conducted on less than thirty (30) days prior written notice; (c) may be
conducted by Customer or an independent third-party auditor mandated by Customer(which is not a competitor of OT), provided such third-party auditor enters into a writtenagreement with OT protecting the confidentiality of all disclosed information related to theinspection; (d) shall be subject to agreement in advance between the parties of the scopeof the inspection and the duration (which shall not extend beyond two consecutive
business days or infringe upon the confidential information of third parties); (e) must be
conducted during local business hours, not unreasonably disrupt OT business

OpenText Global DPA / Version 1.0 (S)

7 of 15

operations, and not unduly burden the provision of services by OT to its customers; (f)must be undertaken in accordance with OT’s relevant policies and procedures (as areprovided to Customer in advance); and (g) shall as far as reasonably possible, be limited
to remote inspections or meetings with senior representatives of OT (including by relying
on latest Audit Report or current certifications, other audit reports and combining themwith other information available to Customer under the Agreement) Customer shall, at its
own cost, provide OT with a written report documenting the results of any inspection
undertaken pursuant to this Section.
3.7.3.

Customer shall bear all expenses related to any inspections undertaken pursuant tosection 3.7.1 that are carried out in excess that permitted under Section 3.7.2 and shall
reimburse OT for time spent by OT personnel for any such inspection at then-current
professional service rates unless such inspection reveals non-compliance by OT with its
obligations under this DPA in which case OT shall be responsible for its costs associatedwith such on-site inspection.

4. Geographical Specific Data Processing
Terms and International Transfers
Where the applicable Data Protection Legislation provides for specific requirements pertaining to theProcessing and transfer of Personal Data within each of the scopes set out in this Section, theappropriate provisions of this Section 4 shall also apply.
4.1.

Processing Personal Data of EEA Swiss and UK-based Data Subjects: The terms in thisSection 4.1 apply where Customer provides Personal Data collected from individuals located in
the EEA, Switzerland, and the UK.
4.1.1.

For the purposes of Section 4.1, the following terms shall have the meanings set out
below and related terms shall be construed accordingly.
4.1.1.1. “Data Exporter” and “Data Importer” have the meaning set out in the applicableStandard Contractual Clauses.
4.1.1.2. “EEA Controller to Processor SCCs” means Module 2 of the Standard
Contractual Clauses for the transfer of Personal Data from a Data Exporter
acting as a Controller to a Data Importer acting as a Processor, which isapproved by the European Commission Implementing Decision (EU) 2021/914 of
4 June 2021 and which are set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-eea-controllerto-processor-clauses-module-2-en.pdf (and also sometimes referred to as
Appendix 4) which are incorporated into this DPA by reference, as may beamended, updated or replaced from time to time.
4.1.1.3. “EEA Processor to Processor SCCs” means Module 3 of the Standard
Contractual Clauses for the transfer of Personal Data from a Data Exporter
acting as a Processor to a Data Importer acting as a Processor, which isapproved by the European Commission Implementing Decision (EU) 2021/914 of
4 June 2021 and which are set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-eea-processor-

OpenText Global DPA / Version 1.0 (S)

8 of 15

to-processor-clauses-module-3-en.pdf (and also sometimes referred to as
Appendix 5) which are incorporated into this DPA by reference, as may beamended, updated or replaced from time to time.
4.1.1.4. “EEA Standard Contractual Clauses” means the EEA Controller to Processor
SCCs and EEA Processor to Processor SCCs.
4.1.1.5. “UK Controller to Processor SCCs” means the UK International Data Transfer
Addendum (incorporating Module 2) to the European Commission's Standard
Contractual Clauses for international data transfers (including the Mandatory
Clauses, Part 2) issued by the Information Commissioner's Office in accordancewith s119A(1) of the Data Protection Act 2018 and which came into force on 21
March 2021 and which are set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-ukinternational-data-transfer-addendum-en.pdf (and also referred to sometimes as
Appendix 6) which are incorporated into this DPA by reference, as may beamended, updated or replaced from time to time.
4.1.1.6. “UK Processor to Processor SCCs” means the UK International Data Transfer
Addendum (incorporating Module 3) to the European Commission's Standard
Contractual Clauses for international data transfers (including the Mandatory
Clauses, Part 2) issued by the Information Commissioner's Office in accordancewith s119A(1) of the Data Protection Act 2018 and which came into force on 21
March 2021 and which are set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-ukinternational-data-transfer-addendum-en.pdf (and also referred to sometimes as
Appendix 6) which are incorporated into this DPA by reference, as may beamended, updated or replaced from time to time.
4.1.1.7. “UK Standard Contractual Clauses” means the UK Controller to Processor
SCCs and UK Processor to Processor SCCs.
4.1.2.

Personal Data may be Processed in the EEA, the United Kingdom, and Switzerland(each a “Designated Country”) and in countries outside of a Designated Country (“OtherCountries”) by OT or its Sub-processors. The transfer to Other Countries shall be inaccordance with Data Protection Legislation (to the extent it applies).
4.1.2.1. The parties shall have in place a Transfer Mechanism in respect of any
Restricted Transfer.
4.1.2.2. In the event of an EEA Restricted Transfer where Personal Data is transferredfrom Customer as Data Exporter acting as a Controller or Processor (asapplicable), to OT as Data Importer acting as a Processor, and where OT as acontracting party is located in an Other Country, the parties shall, as part of this
DPA, comply with the EEA Controller to Processor SCCs where the Customer
acts as a Controller and the EEA Processor to Processor SCCs where theCustomer acts as a Processor.
4.1.2.3. In the event of a UK Restricted Transfer, where Personal Data is transferred from
Customer as Data Exporter acting as a Controller or Processor (as applicable) to
OT as Data Importer acting as a Processor and where OT as a contracting party
is located in an Other Country, the parties shall, as part of this DPA, comply with
the UK Controller to Processor SCCs where the Customer acts as a Controller

OpenText Global DPA / Version 1.0 (S)

9 of 15

and the UK Processor to Processor SCCs where the Customer acts as a
Processor.
4.1.2.4. In the event of a Swiss Restricted Transfer, whereby Personal Data is transferredfrom Customer as Data Exporter, acting as a Controller or Processor (asapplicable), to OpenText as Data Importer acting as a Processor and where OT
as a contracting party is located in an Other Country, the parties shall, as part ofthis DPA, comply with the corresponding module of the EEA Standard
Contractual Clauses.
4.1.2.5. Where OT as a contracting party is located in a Designated Country and acts asa Data Exporter, OT shall ensure that Restricted transfers to OT Sub-processors
which are located in Other Countries shall be in accordance with applicable Data
Protection Legislation which may include an adequacy decision or the conclusionof the relevant EU or Swiss or UK Standard Contractual Clauses or any
appropriate safeguards.
4.1.2.6. The Standard Contractual Clauses will not apply to a Restricted Transfer to theextent that OT has adopted Binding Corporate Rules for Processors or analternative recognized compliance standard for lawful Restricted Transfers.
4.1.3.

4.2.

The parties agree that the Sub-processors shared with Customer is the 'agreed list’ for
Sub-processors in relation to Clause 9(a) of the EEA Standard Contractual Clauses andfor the UK Standard Contractual Clauses.

Processing Personal Data of US-based Data Subjects: The following terms apply where
Customer provides Customer Personal Data collected from individuals in the United States ofAmerica (US).
4.2.1

For the purposes of Section 4.2, the following terms shall have the meanings set out below
and related terms shall be construed accordingly.

4.2.1.1 “US State Privacy Laws” means the subset of Data Protection Legislation originating fromUS state, territorial, and local laws, regulations, and governmental requirements including,
without limitation, the CCPA.
4.2.1.2 “Specified Business Purpose” means the provision of the Services as set forth under the
Agreement.
4.2.1.3 “Business Purpose,”, “Sell,”, “Service Provider,”, and “Share” have the meanings set
forth in the US State Privacy Laws.
4.2.2

To the extent OT Processes Customer Personal Data containing any data regulated by the
CCPA, the Parties agree OT does so acting as a Service Provider to Customer. Additionally,taking into account the context of the Processing and Services, each Party will comply with its
obligations under US State Privacy Laws. Given the nature and scope of its Processing, OT:(i) acknowledges that Customer is disclosing Personal Data to OT only for the Specified
Business Purpose; (ii) shall Process all Personal Data on behalf of Customer only; (iii) shallnot Sell or Share Customer Personal Data; (iii) shall not retain, use, or disclose Customer
Personal Data for any purpose other than for the Specified Business Purpose, including notretaining, using, or disclosing Customer Personal Data: (a) for a commercial purpose otherthan the Specified Business Purpose or (b) outside of the direct business relationshipbetween OT and Customer unless expressly permitted by applicable law; (iv) shall not,

OpenText Global DPA / Version 1.0 (S)

10 of 15

unless otherwise permitted by applicable law or for the purpose of performing the Services,
combine Customer Personal Data with other personal information it: (a) receives from or on
behalf of another person or third party, or (b) collects from its own interactions with theapplicable individual; (v) shall notify Customer if it makes a determination that it can no longer
meet its obligations under this Agreement, and cooperate with Customer to take reasonable
and appropriate steps to stop and remediate unauthorized use of Customer Personal Data to
the extent required by US State Privacy Laws; and (vi) shall enable Customer to comply withprivacy requests made pursuant to applicable US State Privacy Laws.
4.2.3

4.3.

In accordance with HIPAA requirements, Customer shall not provide to OT protected healthinformation (as defined under HIPAA) without the execution of a mutually agreed upon
Business Associate Agreement.

Processing Personal Data of Data Subjects Based in Other Jurisdictions
4.3.1

Where the Data Protection Legislation requires a Transfer Mechanism other than thosereferred to in clauses 4.1 and 4.2 of this DPA, the parties agree that clause 3, Appendix 1
and Appendix 2 of this DPA shall constitute such a Transfer Mechanism.

4.3.2

Where Data Protection Legislation related to the Processing of Personal Data in otherjurisdictions requires additional contractual terms, including without limitation terms related to
Restricted Transfers other than the Restricted Transfers detailed above, Customer shallnotify OT of such requirement and the parties agree to cooperate in good faith to negotiate
such terms.

4.4 Onward Transfers
The parties agree that OT is permitted to transfer Customer Personal Data to additional third parties(“Onward Transfer”), for the purposes and subject to the terms of this DPA, provided that such transfer
complies, where applicable, with the terms and conditions set forth under clauses 3.3 (Sub-processing)and this Section 4 of this DPA.

5. General Provisions
5.1 Execution of this DPA. Where requested by Customer, OT and Customer shall execute this DPA
in one or more counterparts, each of which shall be deemed an original and all of which together
shall constitute one and the same instrument. For the purposes hereof, a facsimile or scanned
copy of this DPA, including all pages hereof, shall be deemed an original.
5.2 Superseding Agreement. The parties agree that with respect to the period on and after the datethat this DPA comes into effect between the parties (or if earlier, the mandatory date when therelevant Standard Contractual Clauses must apply), this DPA shall replace and supersede any
existing data processing addendum, attachment, exhibit, or standard contractual clauses that
Customer and OT may have previously entered into in connection with the Services.
5.3 Order of Precedence To the extent there is any conflict or inconsistency between the terms of this
DPA, the Standard Contractual Clauses, and/or the Agreement, in relation to the Processing ofCustomer Personal Data, the parties agree that the documents shall prevail in the following order:(i) the Standard Contractual Clauses; (ii) this DPA; and (iii) the Agreement.

OpenText Global DPA / Version 1.0 (S)

11 of 15

5.4 Termination The parties agree that this DPA shall terminate automatically upon (i) termination of
the Agreement; or (ii) expiry or termination of all service contracts, statements of work, workorders, or similar contract documents entered into by the parties pursuant to the Agreement,
whichever is later. This Section 5.4 shall be without prejudice to any rights to terminate Standard
Contractual Clauses (if applicable).
5.5 Changes in Law. The parties shall negotiate in good faith and mutually agree in writing to any
amendments to this Addendum that are necessary to reflect changes in Data Protection
Legislation.
5.6 Communications. OT’s data protection office can be reached by emailing dpo@opentext.com.

6.

Partner Agreements

6.1 If the Agreement relates to the resale or supply of Services with a partner under an OT partner
program or a partner agreement (a “Partner”), with OT acting as the Partner’s Processor or Service
Provider under that arrangement and OT having no direct contractual relationship to the direct andindirect customers of the Partner which are entitled to use the Services such as the End User or, inthe case of a Partner who is a Managed Service Provider (MSP), the Beneficiary (as in each caseas defined in the Agreement) (hereinafter “Using Parties”), then the following provisions shallapply:
6.2 All references to “Customer” in this DPA shall mean the Partner; Sections 3.1.4, 3.1.5, and 3.1.6 ofthis DPA shall be amended to read as follows:•

3.1.4: “As a Controller, Partner is responsible for determining whether the Services areappropriate for storage and Processing of Partner and Using Parties' Personal Data that is
subject to any specific law or regulation and for using the Services in a manner consistent
with Partner's legal and regulatory obligations.”.

•

3.1.5: “Partner is responsible for ensuring that Partner and Using Parties have all necessaryconsents and notices in place that may be required under Data Protection Legislation andconfirms that Partner and the Using Parties are entitled to lawfully transfer Personal Data to
OT.”.

•

3.1.6: “Partner will act as, or appoint, a single point of contact for OT for the Processing of
Personal Data, and confirms that its instructions, including appointment of OT as a Processor
or sub-Processor, have been authorized by the relevant Controller.”.

6.3 Section 3.4.3 of this DPA shall be amended to read as follows:“Partner is responsible for implementing and maintaining privacy protections and security measures forcomponents of the technical architecture or infrastructure that Partner or any Using Party provides,
controls, or procures from a third party. Partner shall (and shall procure that the Using Parties shall) apply
the principle of data minimization and limit OT access to systems or Partner's Personal Data to only
where essential for the performance of the Services. Where OT is performing Services on premises of thePartner or Using Parties (or of an Affiliate, sub-contractor, agent, or similar of any of these) or inconnection with access to any of their systems and data, Partner shall be responsible for procuringprovision to OT personnel of user authorizations and passwords to access those systems, oversight of
their use of those passwords and termination of these as required. Partner shall not store any Personal

OpenText Global DPA / Version 1.0 (S)

12 of 15

Data in a non-production environment unless it has production environment equivalent controls in place(and procure the same from Using Parties)”.

OpenText Global DPA / Version 1.0 (S)

13 of 15

APPENDIX 1
DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA
See Appendix 2 of this DPA for each of following: Subject matter and duration of the Processing of
Personal Data, the nature and purpose of the Processing of Personal Data, the types of Personal Data to
be Processed, special categories of data (if appropriate) and the categories of Data Subject to whom theCustomer Personal Data relates.

APPENDIX 2DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Data Subjects may include Customer employees, contractors, business partners, prospects, customers,
vendors, agents, advisors, and freelancers or other individuals having Personal Data stored, transmitted
to, made available to, accessed, or otherwise Processed by OT.
Categories of personal data transferred
Customer determines the categories of Personal Data that are Processed by OT in connection with theServices in accordance with the terms of the Agreement (and documentation governed by it). Customer
submits Personal Data for Processing after careful evaluation of compliance with applicable laws. The
Personal Data may include but are not limited to the following categories of data: Identification andcontact data (name, address, title, contact details phone numbers, email address, time zone, company
name), IT information, Usage Data, Content Data, credentials, plus any application-specific data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose
limitation, access restrictions (including access only for staff having followed specialized
training), keeping a record of access to the data, restrictions for onward transfers or additional
security measures.
The choice and type of Personal Data that will be Processed using the OT Services remains solely within
the discretion and choice of the Customer. In selecting the Personal Data of any categories, theCustomer shall ensure that such Personal Data is suitable for Processing with and through the Services
in compliance with applicable Data Protection Legislation. As part of such assessment, prior to providing
OT with or giving OT access to any ‘special categories of personal data’ or Sensitive Personal Data
subject to enhanced protection requirements under applicable Data Protection Legislation (“Enhanced
Requirements”), Customer shall notify OT of the Enhanced Requirements and seek prior written
confirmation from OT of its ability to comply with such. Customer agrees that the Technical andOrganizational Measures shall (i) apply to the Processing of all Customer Personal Data, including
special category of personal data or Sensitive Personal Data; and (ii) be appropriate safeguards for theProcessing of special category of personal data or Sensitive Personal Data for the provision of theServices taking into consideration the nature of the data and risks involved in Processing such data,
unless otherwise agreed between the parties. OT disclaims all liabilities in relation to the selection of data

OpenText Global DPA / Version 1.0 (S)

14 of 15

for use with the Services or non-compliance with Enhanced Requirements unless prior written
confirmation has been provided.
The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous
basis).
Transfers shall be made on a continuous basis.
Nature of the Processing
OT offers its Services, and in doing so, OT requires to Process Personal Data. The Personal Data issubject to the basic Processing activities as set out in the Agreement and pursuant to Customer’s
Processing instructions as provided in accordance with the Agreement and this DPA, which may include:(a) use of Personal Data to provide the Services;(b) storage of Personal Data;(c) computer Processing of Personal Data for data transmission; and(d) other Processing activities to deliver the Services.
Purpose(s) of the data transfer and further Processing
See “Nature of Processing” above.
The period for which the personal data will be retained, or, if that is not possible, the criteria used
to determine that period.
The duration of the Processing of Personal Data is set out in the Agreement (and documentation
governed by it) and this DPA.
Subject matter, nature, and duration of the Processing for transfer to (sub-) processors
As above.

OT partner programs and partner agreements: Where Section 6 of the DPA applies: for the purposesof these Appendices 1, 2, and 3, categories of Personal Data shall also include that of Using Parties (asdefined in Section 6 of the DPA). In Appendix 3, “Customer systems” refers to those of the Partner andUsing Parties. Notwithstanding the foregoing, this shall not release the Partner of its obligations, either inthese Appendices, the Annexes, the DPA, or otherwise, and the Partner shall remain responsible for thedecisions, acts, and omissions of Using Parties, and shall procure that Using Parties comply with theprovisions of these Appendices.

APPENDIX 3TECHNICAL AND ORGANIZATIONAL MEASURESOT has implemented and will apply the Technical and Organizational Measures that are set out athttps://www.opentext.com/assets/documents/en-US/pdf/opentext-technical-and-organizational-measuresen.pdf

OpenText Global DPA / Version 1.0 (S)270-000008-001

15 of 15