Legal Center Index End User License Agreement Master Terms Definitions TIBCO ISV Customer and SaaS Customer Terms Cloud Service Equipment Terms Consulting Services Service Level Guide Partner Terms Cloud Computing Environment Licensing Policy TIBCO Mashery Service Level Guide Contractor Controller to Controller Addendum Controller to Controller Short Form Supplemental Terms - Foresight Personal Data Addendum - Contractor Agreement Inbound/Vendor - Contractor Exhibit A - Attachments 1 and 2 TIBCO Cloud Beta Agreement TIBCO Subprocessor List U.S. Services Supplement TIBCO GatherSmart EULA TIBCO Security Guidelines Maintenance Additional Product Specific Terms Supplemental Terms - Reseller VAR Supplemental Terms - ISV Alliance Partners Mashery Definitions OEM Terms TIBCO Data Processing Terms TIBCO Processor Licensing Policy TIBCO Data Processing Terms Download Page 1 of 25 Version 2.0 2021 Data Processing Terms Preamble These Data Processing terms apply to all activities relating to commissioned data Processing in the context of which employees of Licensor, or third parties retained by Licensor may have access to Personal Data of Custo mer during the term of the Agreement. 1. Definitions For the purposes of these terms, the following terms shall have the meanings set out below. a) “Agreement’’ shall have the same meaning as defined in the applicable software license and services agreement, work order, order form or any other agreement between the Parties or EULA; b) “Data Controller’’ shall mean the legal entity which determines the purposes and means of the Processing of Personal Data; c) “Data Processor” , in relation to Personal Data, shall mean the legal entity who Processes the Personal Data on behalf of the Data Controller; d) “Data Protection Laws and Regulations” means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their membe r states, Switzerland, the United Kingdom and the United States and its sta tes, applicable to the Processing of Personal Data under the Agreement, including the GDPR. e) “GDPR” shall mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the f ree movement of such data and repealing of Directive 95/46/EC. f) “Personal Data” shall mean any information relating to (i) an identified or identifiable natural person (“Data Subject”) and, (ii) an identified or identifiable legal entity (where protected under applicable Data Protection Laws and Regulations) o f which the Customer and/or its Affiliate(s) is the Data Controller and in relation to which the Licensor is providing Cloud Service under the Agreement; an identifiable person is one who can be identified, directly or indirectly, in particular by referenc e to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; g) “Processes” , “Processed” and “Processing” shall mean any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combinati on, blocking, erasure or destruction. h) “Customer” and “Licensor” , jointly referred to as the “Parties” , shall have the same meaning as defined in the Software Licenses and Services Agreement or other agreement between the parties or EULA; i) “Member State” s hall mean a state which is a member of the European Economic Area, that is, a member of the European Union or of the European Free Trade Area; j) “Standard Contractual Clauses” means the EU SCCs att ached hereto as Attachment 1 and UK SCCs attached hereto as Attachment 2 . k) “Supervisor” shall mean an independent public authority established by the Member States pursuant to the GDPR or, for the United Kingdom, the Information Commissioner’s Office (“ICO”) . l) “Sub - processor” me ans any Data Processor engaged by Licensor or its Affiliates. m) “EU SCC s ” means the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to th ird countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. n) “UK SCCs” means the model clauses for the transfer of Personal Data to processors set out in the European Commission’s Decision 2010/87/EU of 5 February 2010. Page 2 of 25 Version 2.0 2021 2. Data Controller and Data Processor (1) Where Licensor is Processing Personal Data on behalf of Customer, Licensor shall be a Data Processor. (2) Customer and Licensor acknowledge that Customer and/or its Affiliate(s) qualify as Data Controllers with regard to the Processing of Personal Data. (3) In relation to the Processing of Personal Data, Licensor will only act upon the instructions of Customer. (4) The provisions herein apply equally if other bodies are commissioned or employed to carry out the inspection or ma intenance of automated procedures or data Processing systems, during which the possibility exists of accessing Personal Data. 3. Obligations of Licensor (1) In relation to the Processing of Personal Data, Licensor will only act on behalf of and upon the instruc tions of Customer and shall treat Personal Data as Confidential Information. Customer instructs Licensor to Process Personal Data for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing init iated by Authorized Users in their use of the Cloud Service; and (iii) Processing to comply with other reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. (2) Licensor shall im plement reasonable general and technical/organisational measures to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the Processing involves the transmis sion of Personal Data over a network, and against all other unlawful forms of Processing. Such technical/organisational measures shall include but not be limited to, the TIBCO Security Guidelines located at https://terms.tibco.com/posts/868169 - tibco - secur ity - guidelines. The TIBCO Security Guidelines shall be subject to technical progress and continued development. In this regard, Licensor is permitted to implement adequate alternative measures that meet or exceed the security level set out in the TIBCO Sec urity Guidelines. (3) Licensor shall ensure that all its employees and contractors (a) are informed of the confidential nature of the Personal Data, (b) have undertaken training on their responsibilities, and (c) have executed confidentiality obligations surv ive the termination of the personnel engagement. Licensor shall take commercially reasonable steps to ensure the reliability of any Licensor personnel engaged in the Processing of Personal Data. Licensor shall ensure that Licensor’s access to Personal Data is limited to those personnel who require such access to perform the Agreement. A data protection officer has been appointed and may be reached at privacy@tibco.com. (4) Licensor will notify Customer without undue delay in the event of severe disruptions to operations or if it becomes aware of any unauthorised or unlawful Processing, loss of, damage to or destruction of the Personal Data. Licensor will take reasonable measures to identify the cause of such event and secure the Personal Data and to mitigate any adverse consequences for the Data Subjects. (5) All Personal Data stored and Processed by Licensor on behalf of Customer are and shall remain exclusively the property of Customer. 4. Obligations of Customer (1) With re spect to the Processing of Personal Data, Customer alone shall be responsible for ensuring compliance with all applicable Data Protection Laws and Regulations. For the sake of clarity, Customer’s instructions for the Processing of Personal Data shall compl y with Data Protection Laws and Regulations. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data . (2) Customer shall respond in a reasonable time to enquiries from Supervisor on the Processing of the relevant Personal Data; (3) Customer shall fully inform Licensor without undue delay if and when it identifies any mistakes or irregularities with respect to data protection and/or the Processing of Personal Data. (4) Cus tomer shall decide 30 days prior to the end of the Agreement whether the Personal Data is to be Legal Center powered by Ironclad Clickwrap Copyright © 2021, TIBCO Software Inc.