Exhibit 10.1

 

LOGO [g707842g80j58.jpg]

Data Processing Addendum

 

 

This Data Processing Addendum (“DPA”) is made a part of the Value-Added Reseller
Agreement dated as of September 2, 2010, as amended as of March 3, 2014, between
Veeva Systems Inc. (“Reseller”) and salesforce.com, inc. (“SFDC”) (the
“Agreement”), to reflect the parties’ agreement with regard to the Processing of
Reseller Customer Data, including Personal Data (as defined below), in
accordance with the requirements of European Directive 95/46/EC (the
“Directive”) and EU Member States’ national implementations thereof and
Switzerland’s Federal Act on Data Protection (collectively, “European Data
Protection Laws”). All capitalized terms not defined herein shall have the
meaning set forth in the Agreement.

In the course of providing the OEM Services pursuant to the Agreement, SFDC may
Process Reseller Customer Data. SFDC agrees to comply with the following
provisions with respect to any Reseller Customer Data.

 

1. Definitions

“Data Controller” has the meaning specified for “controller” in European Data
Protection Laws.

“Data Processor” has the meaning specified for “processor” in European Data
Protection Laws.

“Data Subject” has the meaning specified for “data subject” in European Data
Protection Laws.

“Personal Data” has the meaning specified for “personal data” in European Data
Protection Laws where such data is submitted to the Services as Reseller
Customer Data.

“Processing” has the meaning specified for “processing” in European Data
Protection Laws.

“Third Party Processing” shall mean any Processing of Reseller Customer Data
performed by a non-SFDC Affiliate third party engaged by SFDC to Process
Reseller Customer Data on behalf of SFDC.

 

2. Obligations of SFDC

 

  2.1 SFDC’s obligations under this DPA shall apply to its Processing of
Reseller Customer Data, including Personal Data.

 

  2.2 Reseller and SFDC acknowledge that with regard to the Processing of
Reseller Customer Data, Reseller Customer is the Data Controller, Reseller is a
Data Processor and SFDC is a further Data Processor.

 

  2.3 SFDC shall Process Reseller Customer Data in accordance with the
requirements of European Data Protection Laws, as they apply to SFDC’s
Processing of Reseller Customer Data, and Reseller Customer’s instructions as
set forth in the Agreement and this DPA. The following is deemed an instruction
by Reseller or Reseller Customer to Process Reseller Customer Data:
(a) Processing necessary for the performance of SFDC’s rights and obligations
under the Agreement and this DPA; and (b) Processing initiated by Reseller
Customer Users in their use of the Combined Solution.

 

  2.4 SFDC shall promptly comply with any commercially reasonable request from
Reseller Customer or Reseller, as appropriate, requiring SFDC to amend or delete
Reseller Customer Data, to the extent legally permitted, to the extent Reseller
Customer or Reseller, as appropriate, does not have the ability to do so itself
in its use of the Combined Solution or OEM Services, as appropriate.

 

  2.5

If SFDC receives any complaint, notice, or communication in which Reseller or
Reseller Customer is named that relates directly to (i) SFDC’s Processing of
Reseller Customer Data or (ii) either party’s compliance with European Data
Protection Laws in connection with SFDC’s Processing of Reseller Customer Data,
it shall promptly notify Reseller or

 

Page 1 of 4

--------------------------------------------------------------------------------

  Reseller Customer, as applicable, and it shall provide Reseller or Reseller
Customer, as applicable, with commercially reasonable cooperation and assistance
in relation to any such complaint, notice, or communication, to the extent
legally permitted.

 

  2.6 SFDC acknowledges that Reseller Customers, excluding Reseller Customers
whose instance of the Combined Solution is hosted from SFDC’s data center in
Japan, may submit Reseller Customer Data from around the world to SFDC data
centers located in the United States or European Economic Area. SFDC represents
that it is self-certified to the EU/US and Swiss/US Safe Harbor frameworks, as
administered by the U.S. Department of Commerce, and that it will maintain its
self-certification or any successor programs for the duration of the term of the
Agreement. For the avoidance of doubt, SFDC will comply with the relevant Safe
Harbor Privacy Principles in its Processing of Reseller Customer Data, including
the Onward Transfer Principle.

 

  2.7 Excluding Reseller Customers whose instance of the Combined Solution is
hosted from SFDC’s data center based in Japan and subject to clause 2.8 below,
SFDC shall not (a) store any Reseller Customer Data on a server located outside
of the United States or European Economic Area, or (b) transfer for storage any
Reseller Customer Data stored on a server located in the United States or
European Economic Area to a server located outside the United States or European
Economic Area, unless SFDC has received prior written consent from Reseller
Customer.

 

  2.8 Notwithstanding clause 2.7 above, SFDC may store on servers located in the
jurisdictions where its data centers are, which may include jurisdictions
outside the United States and European Economic Area, and transfer for storage
to such servers identifying information about Reseller Customer’s instance(s) of
the Services and Reseller Customer’s End Users for the purposes of operating the
OEM Services, such as facilitating the login process and the provision of
customer support. Such identifying information shall only include the following
personal data about End Users, as provided by Reseller Customer or Reseller in
its provision of End User accounts: first and last name, email address,
username, phone number, and physical business address. For clarity, storage of
the foregoing identifying information constituting personal data on servers
outside of the European Economic Area shall be done pursuant to the relevant
Safe Harbor principles, including the Onward Transfer Principle, and subject to
a SFDC intracompany written agreement requiring the receiving party to provide
at least the same level of privacy protection as is required by the relevant
Safe Harbor principles.

 

  2.9 In accordance with the Agreement, SFDC shall maintain appropriate
administrative, physical, and technical safeguards for protection of security
including confidentiality, integrity and availability of Reseller Customer Data,
as least as stringent as the measures described at
http://trust.salesforce.com/trust/security.

 

  2.10 SFDC shall promptly notify Reseller or Reseller Customer, as appropriate,
if SFDC becomes aware of any unauthorized disclosure of or unauthorized access
to any Personal Data (“Security Breach”). In the event that SFDC or its agents
(either singly or collectively) are the sole cause of any such Security Breach,
SFDC will use commercially reasonable, good faith efforts to restore such
Personal Data at its own expense.

 

3. Reseller’s and Reseller Customer’s Obligations

Reseller shall, and shall contractually obligate Reseller Customers to, Process
Reseller Customer Data in accordance with requirements of European Data
Protection Laws, including those pertaining to transfers of or access to
Reseller Customer Data initiated by Users of the Combined Solution.

 

4. SFDC Personnel

 

  4.1 SFDC shall ensure that SFDC’s access to Personal Data is limited to those
personnel who need such access to meet SFDC’s obligations or rights under the
Agreement.

 

  4.2 SFDC shall ensure that its personnel who have access to Personal Data are
informed of the confidential nature of the Personal Data and have received
appropriate training on their responsibilities with respect to such access.

 

  4.3 SFDC shall take commercially reasonable steps to ensure the reliability of
any of SFDC’s personnel that have access to Personal Data.

 

Page 2 of 4

--------------------------------------------------------------------------------

5. Subcontractors

 

  5.1 Reseller acknowledges and agrees that SFDC engages non-SFDC Affiliate
third parties, which may provide Reseller Customer support to Reseller or
Reseller Customer, as applicable. Such provision of Reseller Customer support
may include Third Party Processing. Such Third Party Processing will only occur
with Reseller’s prior written consent, which consent may be made by a User via
the Services. Except as otherwise described in this Section, SFDC shall not
authorize Third Party Processing on behalf of SFDC without Reseller’s prior
written consent, which may include consent via email.

 

  5.2 SFDC will ensure that any third party engaging in Third Party Processing
for support purposes agrees to maintain appropriate safeguards for protection of
security including confidentiality, integrity, and availability of Reseller
Customer Data and to comply with European Data Protection Laws. For the
avoidance of doubt, contractual agreements between SFDC and any third party
engaging in Third Party Processing for support purposes will meet the
requirements of the Onward Transfer Principle as set out above at clause 2.6.

 

6. Rights of the Data Subject

 

  6.1 SFDC shall promptly notify Reseller or Reseller Customer, as appropriate,
if it receives a request from a Data Subject for access to that person’s
Personal Data, to the extent legally permitted. SFDC shall provide Reseller or
Reseller Customer, as appropriate, with commercially reasonable cooperation and
assistance in relation to any request made by a Data Subject for access to that
person’s Personal Data, to the extent legally permitted and to the extent
Reseller or Reseller Customer, as applicable, does not have access to such
Personal Data through its use of the Services.

 

  6.2 SFDC shall not disclose the Data Subject’s Personal Data to the Data
Subject or to a third party other than at the written instruction of Reseller or
Reseller Customer, as appropriate, which may be provided via email, unless
otherwise permitted in the Agreement or this DPA or as required by law. For
clarity, SFDC’s disclosures of Personal Data to Users as contemplated under the
Agreement shall be permitted and is not in violation of non-disclosure
provisions set forth herein.

 

7. Third Party Certifications and Audit Rights

 

  7.1 For the duration of the Agreement, SFDC will maintain an information
security management system with respect to Processing Reseller Customer Data in
accordance with the ISO 27001 international standard.

 

  7.2 Upon Reseller’s written request at reasonable intervals, SFDC shall
provide a copy of SFDC’s then most recent copy of the SSAE 16 Service
Organization Controls report relating to SFDC’s compliance with information
security obligations herein and the status of any open observations.

 

  7.3 Upon Reseller’s request, Reseller or its industry-recognized third party
auditor may audit or inspect the records, architecture, systems and procedures
of SFDC used in connection with the OEM Services to confirm compliance with the
terms and conditions of the Agreement relevant to the security and integrity of
Customer Data. Reseller or a third-party independent representative performing
such audit or inspection shall execute a nondisclosure agreement with SFDC in a
form acceptable to SFDC and Reseller and containing confidentiality provisions
substantially similar to those set forth in the Agreement with respect to the
confidential treatment and restricted use of any proprietary or confidential
SFDC information. Any access at SFDC’s facilities shall be subject to SFDC’s
reasonable access requirements and security policies, and shall be of reasonable
duration and shall not unreasonably interfere with SFDC’s day-to-day operations.
Such audit or inspection shall be conducted up to one time per year; Reseller
must give SFDC at least 4 weeks prior notice of an audit or site inspection,
provided that if such audit or inspection is required by applicable law and
Reseller is unable to give such advance notice, such audit may be conducted with
one week prior notice. Veeva shall pay for all expenses for an audit or
inspection described herein, and if an audit requires the equivalent of more
than one business day of time expended by an SFDC employee, Reseller agrees to
reimburse SFDC for any additional time expended at SFDC’s then current
professional services rates. Reseller may share a summary of the results of its
audit or inspection with a Reseller Customer, provided that prior to sharing
such summary, the Reseller Customer has entered into a non-disclosure agreement
containing confidentiality provisions substantially similar to those set forth
in the Agreement to protect SFDC’s proprietary information.

 

  7.4 The parties agree that this DPA may be shared with Reseller Customers upon
request and will be designated as Reseller confidential information by Reseller.

 

Page 3 of 4

--------------------------------------------------------------------------------

8. Effect of DPA. Subject to the above additions, the Agreement remains in full
force and effect.

 

9. Execution. This DPA may be executed in counterparts and exchanged by
facsimile or electronically scanned copy exchanged via email or via electronic
signature. Each such counterpart shall be deemed to be an original and all such
counterparts together shall constitute one and the same DPA.

The authorized representatives of the parties have executed this DPA by their
signatures below:

 

Veeva Systems Inc.     salesforce.com, inc. By:   /s/ Josh Faddis     By:   /s/
Jeffrey Snyder   Authorized Signature       Authorized Signature Name:   Josh
Faddis     Name:   Jeffrey Snyder Title:   Vice President & General Counsel    
Title:   Manager, Sales Ops. – Commercial Sales Date:   March 24, 2014     Date:
  April 4, 2014

 

Page 4 of 4