This Data Processing Agreement (“DPA”), effective as of _________, 202_ (“Effective Date”), is by and between Tigera, Inc. (“Tigera”), a Delaware limited liability company with offices at 2890 Zanker Road, Suite 205, San Jose, CA 95134 U.S.A and _________________________, a _________________________ with offices at _________________________(“Customer”) and documents the parties’ agreement regarding the Processing of Personal Data by Tigera pursuant to the End User Subscription Agreement For Calico Cloud entered into between the parties (the “Subscription Agreement”).
Customer enters into this DPA for itself and, if any of its affiliates act as Controllers of Personal Data, on behalf of those affiliates. All capitalized terms not defined herein will have the meaning set forth in the Subscription Agreement.
In the course of providing the Solutions to Customer under the Subscription Agreement, Tigera may Process Personal Data on behalf of Customer. The parties agree to the following terms with respect to such Processing.
1. DEFINITIONS
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et. seq., as amended by the California Privacy Rights Act of 2020 and together with any implementing regulations.
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data and is deemed to also refer to a “business” as defined in the CCPA.
“Customer” means the entity named above and its Affiliates.
“Data Subject” means the identified or identifiable person to whom Personal Data relates and includes “consumer” as defined in Privacy Laws and Regulations.
“Europe” means the European Union, the European Economic Area, Switzerland, and the United Kingdom. Additional provisions applicable to Outside Europe Transfers are contained in Clause 12 below.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Outside Europe Transfer” means transfers of Personal Data from Europe to one or more countries that do not ensure an adequate level of data protection within the meaning of the Privacy Laws and Regulations.
“Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data, personal information, or personally identifiable information under applicable Privacy Laws and Regulations), where for each (i) or (ii), such data is uploaded to the Solutions (as defined in the Subscription Agreement).
“Privacy Laws and Regulations” means all laws and regulations of the European Union and its member states, the European Economic Area and its member states, the United Kingdom, Switzerland, the United States, Canada, New Zealand, Australia, and their respective political subdivisions, applicable to the Processing of Personal Data. These include, but are not limited to, the following, to the extent applicable: the GDPR, UK Data Protection Law, the CCPA and CPRA.
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable any “service provider” as that term is defined by the CCPA.
“Standard Contractual Clauses” means the Annex to the European Commission’s implementing decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union and subject to required amendments for Switzerland further described in Appendix 4.
“Sub-processor” means any Processor engaged by Tigera, by a member of the Tigera Group or by another Sub-processor.
“Supervisory Authority” means a governmental or government-chartered regulatory body having binding legal authority over Customer.
“Tigera Group” means Tigera and its affiliates engaged in the Processing of Personal Data.
“UK Addendum” means the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses available as of 21 March 2022, completed as described in Appendix 4.
“UK Data Protection Law” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as may be amended from time to time by the Privacy Laws and Regulations of the United Kingdom.
2. PROCESSING OF PERSONAL DATA
2.1. Scope. The parties agree that this DPA will apply only to the Processing of Personal Data within the Solutions.
2.2. Roles of the Parties. In relation to the Processing of Personal Data resulting from the provision of the Solutions under the Subscription Agreement, Customer is the Controller and Tigera is the Processor.
2.3. Tigera’s Processing of Personal Data. Tigera will treat Personal Data as Confidential Information and will Process Personal Data on behalf of and only in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Subscription Agreement and applicable Order Form(s); (ii) Processing resulting from Customer personnel’s use of the Solutions; and (iii) Processing to comply with other documented reasonable written instructions provided by Customer, where such instructions are consistent with the terms of the Subscription Agreement.
2.4. Processing Restrictions. Tigera will not: (i) “sell” or “share” Personal Data, as such terms are defined in Privacy Laws and Regulations; (ii) retain, use, disclose or Process Personal Data for any commercial or other purpose other than to perform the Solutions; or (iii) retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Tigera. Where applicable, Tigera will comply with applicable restrictions under Privacy Laws and Regulations on combining Personal Data with personal data that Tigera receives from, or on behalf of, another person or persons, or that Tigera collects from any interaction between it and any individual.
2.5. Notification of Unlawful Instructions; Unauthorized Processing. Tigera will immediately inform Customer if, in its opinion, an instruction given by Customer infringes any Privacy Laws and Regulations. Customer retains the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data, including uses of Personal Data not authorized in this DPA.
2.6. Details of Processing. The subject matter of the Processing of Personal Data by Tigera is the performance of the Solutions pursuant to the Subscription Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Appendix 2 (Details of the Processing).
2.7. Data Protection Impact Assessment. Upon Customer’s request, Tigera will reasonably assist Customer in fulfilling Customer’s obligation under Privacy Laws and Regulations to carry out a data protection impact assessment related to Customer’s use of the Solutions, to the extent Customer does not otherwise have access to the relevant information and such information is available to Tigera. Tigera will reasonably assist Customer in its cooperation or prior consultation with a Supervisory Authority regarding any such data protection impact assessment to the extent required under applicable Privacy Laws and Regulations.
2.8. Customer Obligations Regarding Personal Data. In its use of the Solutions, Customer will comply with the Privacy Laws and Regulations, including any applicable requirements to provide notice to and/or obtain consent from Data Subjects for Processing by Tigera. Customer will ensure that its instructions for the Processing of Personal Data comply with Privacy Laws and Regulations. Customer will be solely responsible for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer will ensure that its use of the Solutions will not violate the rights of any Data Subject that has opted-out from sales, sharing, or other disclosures of Personal Data, to the extent applicable.
3. REQUEST FOR CUSTOMER DATA
3.1. Requests from Data Subjects. Tigera will, to the extent legally permitted, promptly notify Customer if Tigera receives a request from a Data Subject to exercise the Data Subject’s right of access, right of rectification, right to restrict Processing, right of erasure (“right to be forgotten”), right of data portability, right to object to the Processing, or right not to be subject to automated individual decision making, each such request being a “Data Subject Request.” To the extent Customer, in its use of the Solutions, does not have the ability to address a Data Subject Request, Tigera will upon Customer’s request use commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent Tigera is legally permitted to do so and the response to such Data Subject Request is required under Privacy Laws and Regulations.
b. Requests from Other Third Parties. If Tigera receives a request from a third party other than a Data Subject (including, without limitation, a government agency) for Customer Data, Tigera will, where permitted by law, direct the requesting party to Customer and promptly notify Customer of the request. Where Tigera is not permitted by law to notify Customer of the request, Tigera will only respond to the requesting party if required by law to do so and will make reasonable efforts to work with the requesting party to narrow the scope of the Customer Data request.
4. TIGERA PERSONNEL
a. Confidentiality. Tigera will ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and are subject to relevant confidentiality obligations. Tigera will ensure that such confidentiality obligations survive the termination of the personnel engagement.
b. Limitation of Access. Tigera will ensure that Tigera’s access to Personal Data is limited to those personnel who require such access to perform the Solutions in accordance with the Subscription Agreement.
c. Data Protection Officer. Members of the Tigera Group will appoint a data protection officer where such appointment is required by Privacy Laws and Regulations.
5. SUB-PROCESSORS
a. Appointment of Sub-processors. Customer grants Tigera a general authorization to appoint third-party Sub-processors in connection with the Solutions, in accordance with the procedures outlined in this DPA. Tigera or a Tigera affiliate has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA with respect to the protection of Customer Data, to the extent applicable to the services provided by such Sub-processor.
b. Current Sub-processors and Notification of New Sub-processors. A list of Sub-processors for the Solutions, as of the date this DPA is executed, is attached in Appendix 1. Tigera will notify Customer in writing of any new Sub-processor before authorizing such new Sub-processor to Process Personal Data.
c. Objection Right for New Sub-processors. Customer may object to Tigera’s use of a new Sub-processor by notifying Tigera in writing within 30 days after receipt of a notice described in the preceding paragraph. If Customer objects to a new Sub-processor as permitted in the preceding sentence, Tigera will use commercially reasonable efforts to make available to Customer a change in the Solutions or recommend a change to Customer’s configuration or use of the Solutions, to avoid Processing of Personal Data by the new Sub-processor in question without unreasonably burdening Customer. If Tigera is unable to make available such change in the Solutions, or to recommend such a change to Customer’s configuration or use of the Solutions that is satisfactory to Customer, within a reasonable period of time (which will in no event exceed 30 days), Customer may terminate the applicable Order Form(s) by providing written notice to Tigera.
d. Liability for Sub-Processors. Tigera will be liable for the acts and omissions of its Sub-processors to the same extent Tigera would be liable if performing the services of each Sub-processor directly under the terms of this DPA.
6. SECURITY
a. Controls for the Protection of Customer Data. Tigera will maintain appropriate physical, technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Data), confidentiality and integrity of Customer Data, including Personal Data, in accordance with Appendix 3 (Security Controls).
b. Third-Party Audit Reports and Certifications. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations in the Subscription Agreement, Tigera will make available to Customer a copy of Tigera’s then most recent third-party audit report SOC 2 audit report, and of any other audit reports and certifications that Tigera makes available to customers, provided Customer is not a competitor of Tigera.
7. CUSTOMER DATA INCIDENT MANAGEMENT AND NOTIFICATION
Tigera maintains security incident management policies and procedures and will notify Customer without undue delay after becoming aware of an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, including Personal Data, transmitted, stored or otherwise Processed by Tigera or its Sub-processors of which Tigera becomes aware (a “Customer Data Incident”). Tigera will make reasonable endeavors to identify the cause of such Customer Data Incident and take steps as Tigera deems necessary and reasonable to remediate the cause of such Customer Data Incident to the extent the remediation is within Tigera’s reasonable control. The obligations herein will not apply to incidents that are caused by Customer or its personnel.
8. RETURN AND DELETION OF CUSTOMER DATA
Tigera will return Customer Data to Customer and, to the extent allowed by applicable law, delete Customer Data in accordance with the procedures and timeframes specified in the Subscription Agreement.
9. AUDIT
Upon Customer’s request, and subject to the confidentiality obligations in the Subscription Agreement, Tigera will make available to Customer (or Customer’s third-party auditor and that has signed a nondisclosure agreement reasonably acceptable to Tigera) information necessary to demonstrate the Tigera Group’s compliance with the obligations set forth in this DPA and its obligations as a Processor under Privacy Laws and Regulations in the form of Tigera’s completed standardized security questionnaires, third-party certifications and audit reports (e.g., its completed Standardized Information Gathering (SIG) and Cloud Security Alliance Consensus Assessments Initiative (CSA CAIQ) questionnaires, SOC 2 report and summary penetration test reports) and, for its Sub-processors, the third-party certifications and audit reports made available by them. Following any notice by Tigera to Customer of an actual or reasonably suspected unauthorized disclosure of Personal Data, upon Customer’s reasonable belief that Tigera is in breach of its Personal Data protection obligations under this DPA, or if such audit is required by Customer’s Supervisory Authority, Customer may contact Tigera to request an audit of the procedures relevant to the protection of Personal Data. Any such audit will be conducted remotely, except Customer and/or its Supervisory Authority may conduct on on-site audit at Tigera’s premises if so required by the Privacy Laws and Regulations. Any such request will occur no more than once annually, except in the event of an actual or reasonably suspected unauthorized access to Personal Data. Before the commencement of any audit, Customer and Tigera will mutually agree upon the scope, timing, and duration of the audit. In no event will any audit of a Sub-processor, beyond a review of reports, certifications and documentation made available by the Sub-processor, be permitted without the Sub-processor’s consent.
10. AFFILIATES
a. Contractual Relationship. The Customer entity signing this DPA does so for itself and, as applicable, in the name and on behalf of its affiliates, thereby establishing a separate DPA between Tigera and each such affiliate subject to the provisions of the Subscription Agreement, this Clause 10, and Clause 11 below. Each such affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable for the purposes of this DPA, the Subscription Agreement. For the avoidance of doubt, such affiliates are not and do not become parties to the Subscription Agreement, and are only parties to this DPA. All access to and use of the Solutions by such affiliates must comply with the Subscription Agreement, and any breach of the Subscription Agreement by an affiliate will be deemed a breach by Customer.
b. Communication. The Customer entity signing this DPA will remain responsible for coordinating all communication with Tigera under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its affiliates.
c. Rights of Customer Affiliates. Where a Customer affiliate becomes a party to this DPA with Tigera, it will to the extent required under applicable Privacy Laws and Regulations be entitled to exercise the rights and seek remedies under this DPA, subject to the following:
i. Except where applicable Privacy Laws and Regulations require the Customer affiliate to exercise a right or seek any remedy under this DPA against Tigera directly, the parties agree that (i) solely the Customer entity that signed this DPA will exercise any such right or seek any such remedy on behalf of the Customer affiliate, and (ii) the Customer entity signing this DPA will exercise any such rights under this DPA not separately for each affiliate individually but in a combined manner for itself and all of its affiliates together (as set forth, for example, in Clause 10.c.ii below).
ii. The Customer entity signing this DPA will, when carrying out a permitted audit of the procedures relevant to the protection of Personal Data, take all reasonable measures to limit any impact on Tigera and its Sub-processors by combining, to the extent reasonably possible, several audit requests carried out on behalf of itself and all of its affiliates in one single audit.
11. LIMITATION OF LIABILITY
To the extent permitted by Privacy Laws and Regulations, each party’s and all of its affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the “Limitation of Liability” clause, and such other clauses that exclude or limit liability, of the Subscription Agreement, and any reference in such clauses to the liability of a party means the aggregate liability of that party and all of its affiliates.
12. APPLICABLE TRANSFER MECHANISM
a. All Outside Europe Transfers will be subject to the additional terms set out in Appendix 4.
b. In the event that the Standard Contractual Clauses are invalidated, amended, or replaced the parties will work in good faith to enact such alternative transfer mechanism to enable the continued Processing of Personal Data contemplated by the Subscription Agreement. The use of such alternative transfer mechanism will be subject to each party’s fulfilment of all legal requirements for use of such transfer mechanism.
IN WITNESS WHEREOF, the parties hereto have caused this DPA, including all applicable Appendices incorporated herein, to be executed as of the Effective Date.
TIGERA, INC.
By: __________________________
Name: __________________________
Title: __________________________
CUSTOMER: _____________________________
By: __________________________
Name: __________________________
Title: __________________________
Appendix 1
Current Sub-processor List
|
Solutions |
Sub-Processor Activity |
Sub-Processor Name and Address |
Location of Processing |
|
Calico Cloud |
Enterprise Support |
Tigera |
|
|
Application Hosting Service |
Google Cloud Platform |
|
|
|
Microsoft Azure |
|
||
|
Identity and Authentication Management |
Auth0 |
|
|
|
Database Service |
MongoDB Atlas |
|
Appendix 2
Details of processing
Data Exporter
Full Legal Name: Customer Name as specified above
Main Address: Customer Address as specified above
Contact: If not otherwise provided this will be the primary contact on the Customer account.
Contact Email: If not otherwise provided this will be the primary contact email address on the Customer account.
Data Importer
Full Legal Name: Tigera
Main Address: 2890 Zanker Road, Suite 205, San Jose, CA 95134, U.S.A.
Contact: Tigera Data Protection Officer
Contact Email: privacy@tigera.io
Nature and Purpose of Processing
Tigera will Process Personal Data as necessary to perform the Solutions pursuant to the Subscription Agreement and Order Form(s), and as further instructed by Customer in its use of the Solutions.
Duration of Processing
Tigera will Process Personal Data for the duration stated in the Subscription Agreement, unless otherwise agreed in writing.
Retention
Tigera will retain Personal Data in the Solutions for the duration of the Subscription Agreement, unless otherwise agreed in writing, and for a fixed period following termination of the Subscription Agreement prior to deletion in accordance with the terms of the Subscription Agreement.
Frequency of Transfer
As determined by Customer through its use of the Solutions.
Transfers to Sub-processor(s)
As necessary to perform the Solutions pursuant to the Subscription Agreement and Order Form(s), and as further described in Appendix 1.
Categories of Data Subjects
Customer may submit Personal Data to the Solutions, the extent of which is determined and controlled by Customer in its sole discretion, and which may include but is not limited to Personal Data relating to the following categories of data subjects:
- Prospects, customers, business partners and vendors of Customer (who are natural persons)
- Customer’s users authorized by Customer to use the Solutions
Type of Personal Data
Customer may submit Personal Data to the Solutions, the extent of which is determined and controlled by Customer in its sole discretion, and which may include but is not limited to the following categories of Personal Data:
- First and last name
- Title
- Employer
- Contact information (company, email, phone, physical business address)
- ID data
- IP address
- Public Profile URL
- Localisation data
Special categories of data (if appropriate)
Customer may submit special categories of Personal Data to the Solutions, the extent of which is determined and controlled by Customer in its sole discretion, and which for the sake of clarity could include the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person or data concerning health. See the measures in Appendix 3 for how Tigera protects special categories of data and other personal data.
Appendix 3
Security Controls
1 – Introduction
These security controls apply to Tigera’s Calico Cloud system. The fully managed SaaS provides active security for cloud-native applications running on containers and Kubernetes, and enables organizations to prevent attacks using zero trust, and to detect, troubleshoot, and automatically remediate exposure risks from security issues in build, deploy, and runtime stages across multi-cloud and hybrid deployments.
2 – Audits & Certifications
Tigera’s security posture is verified through internal and external assurance activities. The solution is subjected to yearly SOC 2 examinations, and relies on Google Cloud Platform and Microsoft Azure, both of which maintain ISO 27001 certifications and undergo SOC 1/SOC 2 Type 2 examinations, which are reviewed annually as part of Tigera’s vendor management process. Tigera also performs its own penetration testing, at least annually, engaging independent third parties to assess application and infrastructure security. Findings from these tests are tracked to closure, and internal security reviews are carried out periodically to validate that remediation actions are completed and controls continue to operate effectively.
3 – Web Application Security Controls
All communications between clients and the service are encrypted using TLS 1.2, protecting confidentiality and integrity in transit. Access to production environments is tightly controlled through multi-factor authentication for administrative accounts, with permissions being reviewed regularly for all application, database, and system components. The central management console allows administrators to immediately revoke user access where necessary. These measures help maintain strict separation between environments and enforce least-privilege principles across engineering and operations teams.
4 – Encryption
The Calico Cloud solution employs strong encryption controls for both data in transit and sensitive data within the application. Transmission channels between the application, users, and third-party components are protected by TLS 1.2. Within the hosted environment, each customer’s sensitive information is encrypted with a unique per-tenant encryption key, providing logical segregation and protection from unauthorized disclosure. Encryption keys are generated, stored, and managed by the provider within its secure environment to maintain confidentiality and key integrity throughout the data lifecycle.
5 – Network Security
The production network is designed for layered defence and controlled connectivity. Hardened firewalls enforce ingress and egress rules, and intrusion and extrusion detection systems monitor network traffic for abnormal or malicious activity. Services operate within a private, isolated cloud-hosted network that is logically separated from the corporate office environment, which itself is protected with WPA2-secured wireless networks. The application is deployed across multiple availability zones in a Kubernetes cluster to ensure redundancy and to contain potential impacts of network or host-level compromise.
6 – Monitoring and Auditing
System health and security events are continuously monitored through a combination of tooling and dedicated alerting channels integrated with Slack. Application exceptions, authentication activity, and system events are logged centrally to support detection and response efforts. The Security Incident Response Team (SIRT) receives real-time alerts and triages issues as they arise. Logs and alerts are reviewed during regular operational meetings to ensure anomalies are investigated and that trends in system or user behaviour are identified early.
7 – Isolation Between Accounts
Customer environments are designed to maintain strict logical and cryptographic separation. Each tenant’s data is protected by a unique encryption key and processed within a private cloud network that enforces access boundaries through identity-based controls. Engineering access to customer data is restricted by policy and technical enforcement to ensure staff can interact only with information necessary for support or maintenance activities.
8 – Disaster Recovery and Business Continuity
Tigera maintains a documented Disaster Recovery and Business Continuity Plan to ensure continued service provision in the event of infrastructure failure or regional outage. Application workloads run in a multi-availability-zone Kubernetes environment, supported by managed high-availability databases with real-time replication across zones. Annual Disaster Recovery exercises are conducted to validate the effectiveness of failover procedures and data restoration capabilities.
9 – Vulnerability Management
Vulnerabilities are managed through a continuous identification, assessment, and remediation cycle integrated into the software development process. Automated tools perform static code analysis and dependency scanning within the continuous-integration pipeline. The environment undergoes annual external and internal penetration tests, with detailed remediation plans for any findings.
10 – Incident Response
Tigera’s Security Incident Response Team (SIRT) follows a formal incident-handling process. Incidents are logged in JIRA and assessed within one business day to determine severity and potential impact. Confirmed incidents trigger internal communications and, where applicable, customer notifications. Root-cause analyses are performed after each event, and lessons learned are used to strengthen technical controls. Disciplinary actions are applied when policy violations are identified.
11 – Secure Software Development
Security is embedded into every stage of the software development lifecycle. All code changes undergo peer review and automated security testing before deployment. The continuous-integration pipeline performs static application security testing (SAST), dependency scanning, and comprehensive unit, integration, and acceptance testing. Deployments progress through staging and sandbox environments prior to release to production. Change management is tracked through JIRA, Confluence, and GitHub.
12 – Dedicated Security Team
Tigera has a dedicated security team that oversees the implementation and monitoring of the company’s security program. The team is responsible for daily operational security, vulnerability management, incident response, and compliance activities, ensuring that defined controls remain effective and that the company’s security posture is continuously improved.
13 – Privacy
The Calico Cloud solution allows its users to access, correct and delete their data through functionalities offered within the solution. In addition, Tigera maintains a privacy program designed to protect its processing of personal data. The program includes entering into relevant agreements with its customers and subprocessors to ensure that relevant protections are in place, in compliance with applicable privacy laws.
14 – Background checks
Potential Tigera employees must pass local and national criminal background checks, and global watchlist screening, which are reviewed by management, before beginning work at Tigera.
Appendix 4
European Provisions
This Appendix will only apply to Outside Europe Transfers that, in the absence of the application of these provisions, would cause either Customer or Tigera to breach applicable Privacy Laws and Regulations.
1- Transfer Mechanism for Data Transfers
The Standard Contractual Clauses apply to any Outside Europe Transfers, to the extent such transfers are subject to the Privacy Laws and Regulations. Tigera enters into the Standard Contractual Clauses as data importer. The additional terms in this Appendix also apply to such data transfers.
2- Transfers Subject to the Standard Contractual Clauses
a) Customers Covered by the Standard Contractual Clauses. The Standard Contractual Clauses and the additional terms specified in this Appendix apply to (i) Customer, to the extent Customer is subject to the Privacy Laws and Regulations of Europe and, (ii) any of its affiliates that use the Solutions. For the purpose of the Standard Contractual Clauses and this Appendix, such entities are “data exporters”.
b) Modules. The Parties agree that where optional modules may be applied within the Standard Contractual Clauses, (i) “MODULE TWO: Transfer controller to processor” will be applied where Customer, acting as Controller, transfers Personal Data to Tigera, acting as Processor.
c) Instructions. The instructions described in Clause 2 of the DPA are deemed to be instructions by Customer to process Personal Data for the purposes of Clause 8.1 of the Standard Contractual Clauses.
d) Appointment of New Sub-processors and List of Current Sub-processors. Pursuant to OPTION 2 to Clause 9(a) of the Standard Contractual Clauses, Customer agrees that Tigera may engage new Sub-processors as described in Clauses 5a., 5b., and 5c. of the DPA and that Tigera’s affiliates may be retained as Sub-processors, and Tigera and Tigera’s affiliates may engage third-party Sub-processors in connection with the provision of the Solutions. The current list of Sub-processors is attached as Appendix 1.
e) Sub-processor Agreements. The parties agree that data transfers to Sub-processors may rely on a transfer mechanism other than the Standard Contractual Clauses, and that Tigera’s agreements with such Sub-processors may therefore not incorporate or mirror the Standard Contractual Clauses, notwithstanding anything to the contrary in clause 9(b) of the Standard Contractual Clauses. Notwithstanding the above, any such agreement with a Sub-processor will contain data protection obligations not less protective than those in the DPA regarding protection of Customer Data, to the extent applicable to the services provided by such Sub-processor. Copies of the Sub-processor agreements that must be provided by Tigera to Customer pursuant to Clause 9(c) of the Standard Contractual Clauses will be provided by Tigera only upon the written request of Customer and may be redacted by Tigera in relation to commercial information, or clauses unrelated to the Standard Contractual Clauses or their equivalent.
f) Audits and Certifications. The parties agree that the audits described in Clause 8.9 and Clause 13(b) of the Standard Contractual Clauses will be carried out in accordance with Clause 9 of the DPA.
g) Erasure of Data. The parties agree that the erasure or return of data contemplated by Clause 8.5 or Clause 16(d) of the Standard Contractual Clauses will be done in accordance with Clause 8 of the DPA and any certification of deletion will be provided by Tigera only upon Customer’s request.
h) Impact Assessment. In accordance with Clause 14 of the Standard Contractual Clauses the parties have conducted an analysis, in the context of the specific circumstances of the transfer, of the laws and practices of the destination country, as well as the specific supplemental contractual, organizational, and technical safeguards that apply, and, based on information reasonably known to them at the time, have determined that the laws and practices of the destination country do not prevent the parties from fulfilling each party’s obligations under the Standard Contractual Clauses.
i) Governing Law and Forum. The parties agree, with respect to OPTION 2 to Clause 17, that in the event that the EU Member State in which the data exporter is established does not allow for third-party beneficiary rights, the Standard Contractual Clauses will be governed by the law of Ireland. In accordance with Clause 18, disputes associated with the Standard Contractual Clauses will be resolved by the courts specified in the Subscription Agreement, unless such court is not located in an EU Member State, in which case the forum for such disputes will be the courts of Ireland.
k) Annexes. For purposes of execution of the Standard Contractual Clauses, Appendix 2: Details of the Processing will be incorporated as ANNEX IA and IB, Appendix 3: Tigera Security Controls will be incorporated as ANNEX II, and Appendix 1: Current Sub-Processor List (as may be updated from time-to-time in accordance with Clause 5 of the DPA) will be incorporated as ANNEX III.
l) Interpretation. The terms of this Appendix are intended to clarify and not to modify the Standard Contractual Clauses. In the event of any conflict or inconsistency between the body of this Appendix and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.
3- Provisions Applicable to Transfers from Switzerland
The parties agree that for purposes of the applicability of the Standard Contractual Clauses to facilitate transfers of Personal Data from Switzerland the following additional provisions will apply: (i) Any references to Regulation (EU) 2016/679 will be interpreted to reference the corresponding provisions of the Swiss Federal Act on Data Protection and other data protection laws of Switzerland (“Swiss Data Protection Laws”), (ii) Any references to “Member State” or “EU Member State” or “EU” will be interpreted to reference Switzerland, and (iii) Any references to Supervisory Authority, will interpreted to refer to the Swiss Federal Data Protection and Information Commissioner.
4- Provisions Applicable to Transfers from the United Kingdom
The parties agree that the UK Addendum applies to transfers of Personal Data governed by UK Data Protection Law and will be deemed completed as follows (with capitalized terms not defined elsewhere having the definition set forth in the UK Addendum):
a) Table 1: The parties, their details, and their contacts are those set forth in Appendix 2.
b) Table 2: the “Approved EU Standard Contractual Clauses” will be the Standard Contractual Clauses as set forth in this Appendix 4.
c) Table 3: Annexes I(A), I(B), and II are completed as set forth in section 2(k) of this Appendix 4.
d) Table 4: Tigera may exercise the optional early termination right described in Section 19 of the UK Addendum.
