Data Processing Agreement

Flexera is a software company which offers a range of IT management products and services, further detail of which can be found within the Master Agreement entered into, or to be entered into, between Flexera and Customer. This Data Processing Agreement supplements the Master Agreement to ensure that any Personal Information subject to the Master Agreement is transferred and processed in accordance with the Applicable Privacy Laws.

1. Definitions

   Unless otherwise defined, the following definitions shall apply:

   1.1. “Flexera” means the Flexera entity described in the Master Agreement.

   1.2. “Customer” means the Customer as described in the Master Agreement, which not only includes the contracting party, but may also encompass Customer affiliates (as defined in the Master Agreement) to the extent they are beneficiaries under the Master Agreement. Customer shall be the sole contact point for Flexera under this Data Processing Agreement and any communication shall take place with and claims must be asserted by the Customer only.

   1.3. “Master Agreement” means the agreement between Flexera and Customer which sets out the basis on which Flexera provides its products and/or services for the use of the Customer.

   1.4. “Applicable Privacy Laws” means any applicable laws and regulations relating to the processing, privacy, or security of Personal Information.

   1.5. “Personal Information” means any information relating to an identified or identifiable individual or device, or is otherwise “personal data,” “personal information,” “personally identifiable information” and similar terms, and such terms shall have the same meaning as defined by Applicable Privacy Laws.

   1.6. “Special Category or Criminal Offence Data” means any data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation as well as data relating to criminal convictions and offences or related security measures.

   1.7. “Processor” “Controller” and “Processing” shall have the meanings attributed to them in the Applicable Privacy Laws.

2. Commencement and Scope 

   This Data Processing Agreement shall commence on the earlier of either (a) Flexera and Customer entering into a Master Agreement, or if earlier, (b) when the Processor commences processing Personal Information provided by Controller to Processor in the context of the Master Agreement on behalf of the Controller in connection with the services as agreed under the Master Agreement (“Services”). This Data Processing Agreement shall remain in full force and effect as long as the Master Agreement (including any extension, renewal, or variation) remains effective and thereafter for as long as Processor continues to process Personal Information on behalf of Controller.

3. Conflict and Order of Precedence

   In the event of any conflict or inconsistency between the Master Agreement, the main body of this Data Processing Agreement, or the Schedules to this Data Processing Agreement, the following order of precedence shall apply:

   3.1. Schedules of this Data Processing Agreement,

   3.2. Main body of this Data Processing Agreement, and

   3.3. Master Agreement.

4. Designation of Parties

   Controller and Processor each agree that they shall always remain responsible for compliance with their respective obligations under the Applicable Privacy Laws.

5. Processing of Personal Information

   5.1. Processor will process Personal Information under the Agreement only as a Processor acting on behalf of Controller’s lawful instructions as reasonably necessary to deliver the Services as set out within the Master Agreement, processing initiated by Controller’s end users in their use of the Services, and to comply with other reasonable instructions proved by Controller via support ticket, email, or otherwise where such instructions are consistent with the terms of the Agreement. Controller may provide additional instructions in writing (email or other electronic means being sufficient) to Processor regarding the processing of Personal Information to the extent technically feasible and provided that such instructions are still covered by the Services purchased or needed to comply with statutory rights from individuals.

   5.2. Processor warrants that:

   • 5.2.1. It has complied and will continue to comply with Applicable Privacy Laws;

     5.2.2. Its instructions shall at all times comply with, and be compatible with, Applicable Privacy Laws;

     5.2.3. All Personal Information has been and will continue to be collected and processed in accordance with the notice, consent, and all other requirements of the Applicable Privacy Laws; and

     5.2.4. It has, and will continue to have, the right to transfer or provide access to the Personal Information to Processor, and that such processing by Processor will not contravene Applicable Privacy Laws.

   5.3. Where Controller submits additional instructions or wishes to vary the existing instructions in respect of processing of Personal Information and Processor believes that adopting the new instructions would adversely impact upon the delivery of the Services, or would lead to Processor incurring additional costs, Processor and Controller shall negotiate in good faith to reach an agreement in respect of either (a) varying the amended instructions, or (b) proportioning the associated costs of implementing the amended instructions.

   5.4. Except with the express prior agreement of both parties’ data protection officers (or other authorised representative) Controller shall not provide to Processor any Special Category or Criminal Offence Data.

6. Sub-Processors

   6.1. Where Processor engages any third parties, whether affiliated companies or not, Processor shall ensure that there is in place an agreement between Processor and such party that ensures a level of protection and security comparable to what is agreed in this Data Processing Agreement including any Schedules if applicable. The Sub-processors appointed by Flexera as set out in Schedule 1 at the commencement of this Data Processing Agreement are approved by Customer. Customer will provide a list of Sub-processors currently engaged by it to Controller upon Controllers request.

   6.2. Where Processor seeks to appoint a new sub-processor, it shall notify Controller of the same. In the absence of any objection from Controller within 28 days of notification, Controller shall be deemed to have consented to the appointment. If Controller wishes to object to the appointment of the intended sub-processor it should do so in accordance with the provisions of the Master Agreement.

   6.3. In the case Customer objects to the sub- processing, Flexera can choose to either not engage the sub-processor or to terminate the portion of the Master Agreement relating to the affected Services with 28 days prior written notice. Until the termination of the Master Agreement, Flexera may suspend the portion of the Services which is affected by the objection of Customer. Customer shall not be entitled to a pro-rata refund of the remuneration for the Services, unless the objection is based on justified reasons of incompliance with Applicable Privacy Laws.

7. International Data Transfers

   7.1. Processor may transfer Personal Information outside of the territory in which it originates; where this occurs any such transfer is executed in accordance with Applicable Privacy Laws.

   7.2. Where the Processor entity is located outside the European Economic Area, the United Kingdom or Switzerland, the terms of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 (“SCC”), as further specified in Schedule 2 of this DPA, are hereby incorporated by reference and shall be deemed to have been executed by the parties and apply to any transfers of Personal Information falling within the scope of the European General Data Protection Regulation from Customer (as data exporter) to Flexera (as data importer). Schedule 2 will also specify the applicable module of the SCC.

   7.3. To the extent that the processing of Personal Information is subject to data protection laws in the United Kingdom, Schedule 3 shall apply in addition.

8. Security of Personal Information

   8.1. Processor has in place a comprehensive data protection and information security program which consists of a range of technical and organisational measures designed to establish an appropriate level of security for all Personal Information processed by Processor. The technical and organizational measures are specified in Annex 2 to Schedule 2.

   8.2. All personnel of Processor undergo appropriate pre-employment screening and are subject to written obligations of confidentiality extending to the Personal Information processed on behalf of Controller. Sub-processors will be bound by appropriate confidentiality agreements as well.

   8.3. Processor may alter the technical and organizational security measures provided that such alteration does not reduce the overall level of protection afforded to the Personal Information by Processor under this Data Processing Agreement, it will inform Controller of any substantial changes.

9. Requests for Information 

   9.1. Processor has a policy in place for handling requests to access Personal Information it processes by third parties, including in respect of warrants, subpoenas, court orders, or requests from individuals or governmental departments (including law enforcement and intelligence agencies).

   9.2. Processor will notify Controller of such request on receipt unless there is a restriction on such notification. Where Processor is prohibited from notifying Controller it shall provide such notification as soon as such restriction is no longer in effect.

   9.3. Where Processor receives such a request and is prohibited from notifying Controller, it shall use reasonable efforts to establish that the request is legitimate, is in accordance with applicable laws, and goes no further than is necessary to achieve the intended purpose.

   9.4. Flexera has not received a request for information in respect of Personal Information it processes on behalf of its customers from any government, law enforcement, or intelligence agency.

10. Audit

    10.1. Controller is entitled to audit Processor’s compliance with the obligations set out in this Data Processing Agreement including any Schedules were applicable once in any 12 months period, unless where an audit is recommended, or required by a regulator of Controller, following an Incident (as defined in Section 11 of this Data Processing Agreement), or where Controller has justifiable reason to believe that Processor is not complying with the terms and conditions under this Data Processing Agreement

    10.2. Controller may conduct any audit itself or appoint a suitably qualified third party to conduct the audit on its behalf. Where Controller appoints a third party it agrees that it will not appoint any third party who provides comparable Services as Processor, and that the third party must enter a written obligation of confidentiality approved by Processor.

    10.3. Any audit must be completed during Processor’s normal business hours and be conducted in such a manner as to prevent any unreasonable disruption or interference with Processor’s operations.

    10.4. To initiate an audit Controller shall submit a comprehensive audit plan to Processor no less than two weeks prior to the intended commencement date. Processor will consider the request and shall work collaboratively with Controller to finalise the scope of the audit and seek to have the relevant resources available. Processor shall use its reasonable endeavours to ensure that any third-party Sub-processors assist to the extent necessary with any such audit.

    10.5. Where the intended scope of an audit is covered in an approved industry standard, scheme, or certification, Controller agrees to accept a certification of said standard issued by a third-party auditor or certification body within the preceding twelve months as confirmation of adherence to said standard, scheme, or certification.

    10.6. Processor and Controller shall each be responsible for their own costs in relation to, or arising from, the audit. In the event the Processor is required to incur additional costs it shall notify Controller of the same prior to the audit commencing and both Processor and Controller will negotiate in good faith with respect to any such costs.

11. Security Incident

    11.1. Processor has implemented and deployed a range of technical and organisational measures to minimise the risk of any unauthorised disclosure of or access to, and accidental or unlawful destruction, loss, alteration, or extraction of Personal Information (an “Incident”). The measures in question are intended to prevent an Incident occurring, identify if an Incident occurs, and minimise the impact if an Incident occurs.

    11.2. Processor will notify Controller without undue delay after becoming aware of an Incident. Processor will provide the following information as it becomes available either at the time of notification or as soon as possible thereafter:

    • 11.2.2. A description of the Incident,

      11.2.3. Details of what Personal Information is affected,

      11.2.4. What measures have been taken to mitigate the impact of the Incident,

      11.2.5. If applicable, when access to the Personal Information will be restored.

    11.3. Processor will not make any public statement, notify any regulator, or notify the affected individuals without first notifying Controller. Controller agrees that it will coordinate with Processor on the content and timing of any public statements or regulatory notifications that Controller intends to make in relation to the Incident.

12. Rights of Individuals 

    Processor recognises there may be rights afforded to individuals under the Applicable Privacy Laws and has appropriate systems in place to enable such rights to be fulfilled within the stipulated timeframes. Where Processor receives a request for Personal Information and Processor is processing such Personal Information at the direction of Controller, Processor will forward the request on to Controller and may refer the individual making the request to Controller. If Customer receives a request and requires Flexera’s assistance to fulfil the request it shall forward the same to DataProtectionTeam@Flexera.com.

13. Data Erasure and Retention

    In the absence of any provision within the Master Agreement to the contrary within sixty days of Flexera ceasing to provide the Services to Customer Processor shall be hereby permitted to erase any Personal Information remaining on any of Processor’s systems.

14. Personal Information Subject to the CCPA 

    To the extent that the processing of Personal Information is subject to the California Consumer Privacy Act of 2018 (“CCPA”), Schedule 4 shall apply.