Terms
Data Processing Agreement
Last updated October 14, 2026
This Data Processing Agreement including its schedules and references (the DPA) shall apply whenever one party to the Agreement is processing personal data on behalf of the other party, to ensure such processing is conducted in accordance with applicable laws and respects the rights of individuals whose personal data is being processed. For each processing activity, Controller means the party giving lawful documented instructions and Processor means the party processing Personal Data on its behalf, including as a sub-processor. Where the instructing party is itself a processor, Controller is contractual shorthand and does not change its legal role. Either party may act in either role; actual purposes and means determine the legal role.
1. Definitions
Agreement means the agreement in place between Pax8 and the other party relating to the Services;
Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. Control, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity;
CCPA means the California Consumer Privacy Act of 2018;
Contractual Safeguards means (i) where the GDPR applies, the SCCs and (ii) where the UK General Data Protection Regulation (UK GDPR) applies, the SCCs as amended by the applicable UK Addendum set out in Schedule 3 (the UK Addendum);
The terms controller, data subject, personal data (notwithstanding the capitalized definition provided further below), process, processing, processor will have the same meanings as defined by Data Protection Legislation. Other relevant terms such as business, business purpose, consumer, personal information, sale (including the terms sell, selling, sold, and other variations thereof), service provider, and third party have the meanings given to those terms under the CCPA;
Data Protection Legislation means applicable national, federal, state, provincial, and local laws and regulations governing the use and disclosure of personal information;
GDPR means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Data Protection Directive);
Pax8 means the Pax8 entity which is a party to this DPA and/or this Agreement and that processes personal data as defined under relevant Data Protection Legislation;
Personal Data means the personal data that either party as Processor processes on behalf of the other party as Controller;
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
Restricted Transfer means: (i) where the GDPR applies, a transfer of Personal Data from the EEA to a country outside of the EEA or an (onward) transfer from a country outside of the EEA within the same country or to another country outside of the EEA, which are not subject to an adequacy decision under Article 45 GDPR by the European Commission; and (ii) where the UK GDPR applies, a transfer of Personal Data from the United Kingdom to any other country or an (onward) transfer from a country outside of the United Kingdom within the same country or to another country outside of the United Kingdom, which are not subject to adequacy regulations adopted pursuant to Article 45(1) UK GDPR in conjunction with Section 17A of the United Kingdom Data Protection Act 2018;
Services means the services or products to be provided by either party in accordance with any applicable Agreement;
SCCs means (i) the standard contractual clauses between controllers and processors adopted by the European Commission in its Implementing Decision (EU) 2021/914 of 4 June 2021, as set out in Schedule 2 (the “2021 Controller-to-Processor Clauses”); or (ii) the standard contractual clauses between processors adopted by the European Commission in its Implementing Decision (EU) 2021/914 of 4 June 2021, (the “2021 Processor-to-Processor Clauses”); where applicable.
Sub-processor means any processor engaged by the Processor who agrees to receive Personal Data intended for processing on behalf of the Controller in connection with the Services;
Supervisory Authority means an independent public authority or other legal body which is established in a jurisdiction under Data Protection Legislation and responsible for monitoring applicable Data Protection Legislation.
2. Scope and Application of this DPA
2.1. This DPA will apply where the Agreement incorporates this DPA and one party processes Personal Data on behalf of the other. Where the Controller acts as a processor on behalf of its own customers or clients, the Controller confirms that it is authorized by them to enter into this DPA and to give instructions to the Processor on their behalf, the Processor acts as a sub-processor of the Controller, and the Controller remains responsible to the Processor for the instructions it gives and for ensuring that its customers or clients are bound by terms consistent with this DPA. The parties to the Agreement agree to comply with the terms of this DPA which is incorporated into the Agreement and entered into by the parties on behalf of themselves and their Affiliates.
2.2. The subject matter, nature, purpose and duration of processing, types of Personal Data, categories of data subjects, retention periods, processing locations and applicable technical and organizational measures shall be as detailed before processing starts in the Agreement or a versioned processing data sheet expressly incorporated into it. For Pax8, those details shall be as published on the Pax8 Trust Center found at https://trust.pax8.com/ and as otherwise specified in the Specific Product Terms, Services Terms and or Services Scope The Jurisdiction Specific Terms set out in Schedule 1 shall also apply for any Personal Data that is protected by Data Protection Legislation in those respective jurisdictions. The processing details supplement this DPA and are subject to section 12.1.
2.3. Each party shall comply with Data Protection Legislation for processing it carries out for its own purposes. The Agreement or incorporated data sheet shall identify the roles and any such purposes. A Processor shall not use Personal Data for its own purposes, or to train or fine-tune AI models, except as the Agreement expressly permits, and may only derive aggregated information that does not identify, and cannot reasonably be used to identify, any individual.
2.4. The remainder of this DPA shall only apply to the extent that either party acts as Processor with regards to the relevant Personal Data.
3. Data Processing
The Processor agrees to process the Personal Data in accordance with Data Protection Legislation and this DPA. In particular, the Processor agrees to:
3.1. act only on written instructions and directions from the Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by laws to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. For the purposes of this section, the Controller’s instructions shall include those contained in this DPA, the Agreement, and otherwise received from the Controller from time to time. Authorized configurations, prompts and actions made within the agreed purposes and permissions may constitute documented instructions, but content from third parties encountered by the Services is not an instruction and does not authorise additional processing or permissions;
3.2. only disclose the Personal Data to any government or third party on the Controller’s documented instructions (including disclosure to authorized Sub-processors under section 4) or where necessary to comply with the law or a binding order of a governmental body. Unless it would violate the law or binding order, the Processor will give the Controller notice of any legal requirement or order;
3.3. notify the Controller promptly where the Processor believes that compliance with any instructions by the Controller would result in a violation of Data Protection Legislation;
3.4. implement and maintain appropriate technical and organizational measures to adequately protect the Personal Data processed on behalf of the Controller against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as required under Data Protection Legislation.
3.5. ensure that any personnel of the Processor entrusted with the processing of Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality no less restrictive than those confidentiality obligations included in the Agreement;3.6. provide reasonable assistance to the Controller if requested, to assist with the Controller’s compliance with its obligations under Data Protection Legislation (including Articles 32 to 36 of the UK GDPR and the EU GDPR as applicable), and/or in responding to any request from a data subject;
3.7. take all appropriate measures pursuant to Article 32 of the UK GDPR and/or the EU GDPR (as applicable), having regard to the state of technological development and the cost of implementing any measures;
3.8. maintain a record of its processing activities and provide cooperation and information to the Controller as is necessary for the Controller to demonstrate compliance with its obligations pursuant to Data Protection Legislation;
4. Sub-processors
4.1. Authorized Sub-processors. Controller agrees that the Processor may engage Sub-processors to process Personal Data on Controller’s behalf. The Sub-processors engaged by the Processor and authorized by Controller are those identified in the approved, versioned Sub-processor register expressly incorporated into the Agreement. Pax8’s Sub-processors shall be as published on the Pax8 Trust Center found at https://trust.pax8.com/ and as otherwise specified in the Specific Product Terms, Services Terms and or Services Scope; for Services provided by the other party, it shall identify that party’s approved register. The Processor shall notify Controller in writing of any intended addition or replacement of a Sub-processor at least thirty (30) days before the Sub-processor starts processing Personal Data, so that Controller may exercise its objection rights under Schedule 1, Data Protection Legislation and the Contractual Safeguards. Notice may be given by email to the contact identified in the Agreement or to an email address that Controller has subscribed to receive Sub-processor notifications; publishing a change on a website without notifying Controller is not sufficient notice. Where a shorter period is necessary to maintain the security or continuity of the Services, the Processor shall notify Controller as soon as reasonably practicable, and Controller’s objection rights continue to apply. The Processor shall also notify Controller of the removal of a Sub-processor.
4.2. Sub-processor obligations. The Processor shall: (i) enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Personal Data as those in this DPA, to the extent applicable to the nature of the service provided by such Sub-processor and as required by applicable Data Protection Legislation; and (ii) remain responsible for such Sub-processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-processor that cause the Processor to breach any of its obligations under this DPA. Controller acknowledges and agrees that, where applicable, the Processor fulfils its obligations under Clause 9 of the SCCs (as applicable) by complying with this section and that the Processor may be prevented from disclosing Sub-processor agreements to Controller due to confidentiality restrictions but the Processor shall, upon request, use reasonable efforts to provide Controller with all relevant information it reasonably can in connection with Sub-processor agreements.
5. Data Transfers
5.1. The Controller authorises the Processor and its Sub-processors to make Restricted Transfers of Personal Data to comply with the Controller’s instructions under this DPA and perform the obligations under the Agreement, provided such Restricted Transfer complies with Data Protection Legislation.
5.2. Data center locations. Controller acknowledges that the Processor may transfer to and process Personal Data in the locations specified in the Agreement or in the processing details incorporated under section 2.2, which may include the United States and other countries in which the Processor, its Affiliates or its Sub-processors maintain data processing operations. The Processor shall at all times ensure that such transfers are made in compliance with the requirements of Data Protection Legislation and this DPA.
5.3. EEA Data Transfers. To the extent the Personal Data is protected by the GDPR and requires transfer to a country outside of European Economic Area (EEA) that is not recognized as providing an adequate level of protection for personal data (as described in the GDPR or applicable Data Protection Legislation in Europe), the parties agree to abide by and process such Personal Data in compliance with the SCCs, which shall be incorporated into and form an integral part of this DPA. Module Two applies where the actual exporter is a controller and the importer is a processor. Module Three applies where the actual exporter is a processor and the importer is its processor or sub-processor. Under Clause 9(a) of the SCCs, Option 2 (general written authorization) applies and the notice period is the thirty (30) days set out in section 4.1. Required party details, module elections and annex particulars shall be completed for the actual transfer before it occurs, and the contractual shorthand “Controller” does not determine the roles under the SCCs.
5.4. UK Data Transfers. With respect to transfers to which the UK GDPR or the UK Data Protection Act 2018 apply, the SCCs shall apply as amended by the UK Addendum. The UK Addendum shall be deemed executed by the parties and incorporated into and form an integral part of this DPA.
6. Data Subject Rights
6.1. The Processor shall:
6.1.1. Upon becoming aware, promptly notify the Controller if the Processor receives a request from a Data Subject right under any Data Protection Legislation in respect of Personal Data;
6.1.2. not respond to that request except on the documented instructions of Controller or as required by a Supervisory Authority; and
6.1.3. upon request from Controller where required by Data Protection Legislation and in the context of the Services, reasonably assist Controller in dealing with an actionable Data Subject request to the extent Controller cannot fulfil this request without the Processor’s assistance. The Processor may fulfil this request by making available functionality that enables Controller to address such Data Subject requests without additional Processing by the Processor. To the extent such functionality is not available, in order for the Processor to provide such reasonable assistance, Controller must communicate such request in writing to the Processor providing sufficient information to enable the Processor to pinpoint and subsequently amend, export or delete the applicable record.
7. Personal Data Breach
7.1. The Processor shall notify Controller without undue delay upon the Processor or any Sub-processor becoming aware of a Personal Data Breach, and where the applicable Data Protection Legislation requires reporting to a Supervisory Authority within 72 hours, such notice shall be given to the Controller within 48 hours. Subject to Section 7.3 below, such notification shall as a minimum:7.1.1. describe the nature of the Personal Data Breach, the categories and numbers of Data Subjects concerned, and the categories and numbers of Personal Data records concerned;
7.1.2. communicate the name and contact details of the Processor’s data protection officer or other relevant contact from whom more information may be obtained;
7.1.3. describe the likely consequences of the Personal Data Breach in so far as the Processor is able to ascertain having regard to the nature of the Services and the Personal Data Breach; and
7.1.4. describe the measures taken or proposed to be taken to address the Personal Data Breach.
7.2. The Processor shall co-operate with Controller and take such reasonable commercial steps as are necessary to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
7.3. Where and in so far as, it is not possible to provide the information referred to in Section 7.1 at the same time, the information may be provided in phases without undue further delay. The Processor’s obligation to report or respond to a Personal Data Breach is not and will not be construed as an acknowledgement by the Processor of any fault or liability of the Processor (or its Affiliates) with respect to a Personal Data Breach.7.4. The Controller agrees that where there is an attempt to gain access to the Personal Data or the infrastructure and networks that provide the Services (as defined in the Agreement) (including pings, denial of service attacks, attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, packet sniffing or other unauthorized access to traffic data) which does not result in a Personal Data Breach the Processor has no obligation to notify the Controller under the Agreement or this DPA.
8. Duration; Termination; Return or Deletion of Personal Data
8.1. This DPA will become effective when the Parties’ Agreement enters into effect which this DPA has been incorporated.
8.2. This DPA will terminate automatically upon the later of (i) termination or expiry of the Agreement and (ii) termination of processing of the Personal Data by the Processor. On termination of this DPA, the Processor shall delete all Personal Data processed on behalf of the Controller (and certify deletion on request) unless the Controller requests the return of the Personal Data or to the extent that Data Protection Legislation requires storage of such Personal Data. Until return or deletion is complete, including during any legally required retention, this DPA continues to protect the Personal Data.
9. Other Privacy Laws
9.1. To the extent that Processing relates to Personal Data originating from a jurisdiction or in a jurisdiction which has any mandatory requirements in addition to those in this DPA, both parties may agree to any additional measures required to ensure compliance with applicable Data Protection Legislation and any such additional measure agreed to by the parties will be documented in a duly executed written addendum or amendment to this DPA or in an Order.
9.2. If any variation is required to this DPA as a result of a change in Data Protection Legislation, including any variation which is required to the Contractual Safeguards, then either party may provide written notice to the other party of that change in law. The parties will discuss and negotiate in good faith any necessary variations to this DPA, including the Contractual Safeguards, to address such changes.
10. Review, Audit and Inspection Rights
10.1. Upon Controller’s reasonable request, the Processor shall provide all relevant and necessary material, documentation and information in relation to the Processor’s technical and organizational security measures used to protect the Personal Data in relation to the Services provided in order to demonstrate compliance with Data Protection Legislation.
10.2. The Processor shall ensure a security audit of its technical and organizational security measures is carried out at least annually in compliance with Data Protection Legislation. Such security audit will be performed by a qualified or independent auditor against ISO 27001 or an equivalent recognized standard. The results of such security audit will be documented in a summary report. The Processor shall promptly provide Controller upon request with (i) a confidential summary of such report; and (ii) evidences of appropriate remediation of any critical issues within four (4) weeks from date of issuance of the audit report.
10.3. If, following the completion of the steps set out in sections 10.1 and 10.2 above Controller reasonably believes that the Processor is non-compliant with Data Protection Legislation, Controller may request that the Processor make available, either by webinar or in a face-to-face review, extracts of all relevant information necessary to further demonstrate compliance with Data Protection Legislation. Controller undertaking such review shall give the Processor reasonable notice of any review by contacting the Processor’s Data Protection Officer by submitting a request via the Processor’s privacy contact identified in the Agreement.
10.4. The rights of Controller under this section shall only be exercised once per calendar year unless Controller reasonably believes the Processor to be in material breach of its obligations under either this DPA or Data Protection Legislation. Nothing in this section limits audit or inspection rights required by Data Protection Legislation or the Contractual Safeguards.
11. Liability
11.1. The limits and exclusions on a Party’s liability set out in the Agreement shall apply to that Party’s liability under this DPA (and the Contractual Safeguards), provided that the foregoing shall not operate to limit or exclude a Party’s liability to a data subject under the Contractual Safeguards.
12. General
12.1. In the case of conflict between the terms of the Agreement and the terms of this DPA, the terms of the DPA shall take precedence, except that the roles, processing details and Sub-processor register to be specified in the Agreement or an incorporated data sheet under sections 2.2, 2.3 and 4.1 apply as stated there, provided that nothing in the Agreement or a data sheet reduces the protection afforded to Personal Data by this DPA or the Contractual Safeguards. In the event of any conflict or inconsistency between this DPA and the Contractual Safeguards, the Contractual Safeguards shall prevail.
12.2. Amendments or additions to this DPA must be made in writing and agreed between the Parties to be effective. This shall also apply to amendments of this written form requirement. For the purposes of this section, the written form requirement includes signature by commercially acceptable electronic means but does not include email. Where the Agreement permits a party to update terms that it publishes (including this DPA, data sheets and Sub-processor registers), such updates take effect as the Agreement provides, provided that no update reduces the protection afforded by the Contractual Safeguards or Data Protection Legislation, and any variation to the Contractual Safeguards is agreed under section 9.2.
12.3. Should any provision of this DPA be or become invalid, this shall not affect the validity of the remaining terms.
12.4. Any obligations arising from statutory provisions or according to a judicial or regulatory decision shall remain unaffected by this DPA.
12.5. This DPA shall be governed by the same law that is governing the Agreement between the Parties, save that to the extent the Personal Data is protected by a) the GDPR, the governing law shall be the Netherlands; and b) the Contractual Safeguards, which shall be governed by the law applicable pursuant to the applicable Contractual Safeguards.
Schedule 1: Jurisdiction Specific Terms
EU:
- Objection to Sub-processors. Controller may object in writing to the Processor’s appointment of a new Sub-processor within thirty (30) calendar days of receiving notice in accordance with section 4 of the DPA, provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss such concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, the Processor will, at its sole discretion, either not appoint such Sub-processor, or permit Controller to suspend or terminate the affected Service in accordance with the termination provisions in the Agreement without liability to either party (but without prejudice to any fees incurred by Controller prior to suspension or termination).
- Government data access requests. As a matter of general practice, the Processor does not voluntarily provide government agencies or authorities (including law enforcement) with access to or information about accounts with the Processor (including Personal Data). If the Processor receives a compulsory request (whether through a subpoena, court order, search warrant, or other valid legal process) from any government agency or authority (including law enforcement) for access to or information about the Processor account (including Personal Data) belonging to a Controller whose primary contact information indicates the Controller is located in the EU, the Processor shall: (i) review the legality of the request; (ii) inform the government agency that the Processor is a processor of the data; (iii) attempt to redirect the agency to request the data directly from Controller; (iv) notify Controller via email sent to Controller’s primary contact email address of the request to allow Controller to seek a protective order or other appropriate remedy; and (v) provide the minimum amount of information permissible when responding to the agency or authority based on a reasonable interpretation of the request. As part of this effort, the Processor may provide Controller’s primary and billing contact information to the agency. The Processor shall not be required to comply with this paragraph 2 if it is legally prohibited from doing so, or it has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual, public safety, or the Processor’s property, the Processor’s Site, or the Service’s, but where the Processor is legally prohibited from notifying Controller of requests it shall use its best efforts to obtain a waiver of the prohibition.
California:
- Except as described otherwise, the definitions of: “controller” includes “Business”; “processor” includes “Service Provider”; “data subject” includes “Consumer”; “personal data” includes “Personal Information”; in each case as defined under the CCPA.
- For this “California” section only, “Permitted Purposes” shall include processing Personal Data only for the purposes described in this DPA and in accordance with Controller’s documented lawful instructions as set forth in this DPA, as necessary to comply with applicable law, as otherwise agreed in writing, including, without limitation, in the Agreement, or as otherwise may be permitted for “service providers” under the CCPA.
- If and to the extent that the Processor processes Personal Data that is personal information within the scope of the CCPA, the Processor acts as a Service Provider and the Controller acts as a Business, each as defined in the CCPA. The Controller discloses that personal information to the Processor solely for (i) a valid business purpose and (ii) to permit the Processor to provide the Services under the Agreement. The Processor will not (i) sell or share the personal information; (ii) retain, use or disclose it for any purpose, including a commercial purpose, other than providing the Services or as otherwise permitted by the CCPA; or (iii) retain, use or disclose it outside the direct business relationship between the parties.
- The Processor’s obligations regarding data subject requests, as described in section 6 (Data Subject Rights) of this DPA, extend to rights requests under the CCPA.
- Notwithstanding any use restriction contained elsewhere in this DPA, the Processor shall process Personal Data to perform the Service, for the Permitted Purposes and/or in accordance with Controller’s documented lawful instructions, or as otherwise permitted or required by applicable law.
- Notwithstanding any use restriction contained elsewhere in this Schedule 1, the Processor may de-identify or aggregate Personal Data only as permitted by section 2.3 of the DPA and the Agreement.7. Where Sub-processors process the Personal Information of Controller contacts, the Processor takes steps to ensure that such Sub-processors are Service Providers under the CCPA with whom the Processor has entered into a written contract that includes terms substantially similar to this “California” section or are otherwise exempt from the CCPA’s definition of “sale”. The Processor conducts appropriate due diligence on its Sub-processors.
Canada:
- The Processor takes steps to ensure that the Processor’s Sub-processors, as described in section 4 (Sub-processors) of the DPA, are third parties under PIPEDA, with whom the Processor has entered into a written contract that includes terms substantially similar to this DPA. The Processor conducts appropriate due diligence on its Sub-processors.
- The Processor will implement technical and organizational measures identified in the Agreement or incorporated processing details under section 2.2.
Schedule 2: Standard Contractual Clauses
- Incorporation. The SCCs are Module Two (controller to processor) and Module Three (processor to processor) of the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj). They are incorporated into this DPA by reference and apply as set out in section 5.3. They are not modified.
- Elections. For the purposes of the SCCs:
- Clause 7 (docking clause) applies.
- Clause 9(a): Option 2 (general written authorization) applies, and the notice period is thirty (30) days as set out in section 4.1.
- Clause 11(a): the optional independent dispute resolution wording does not apply.
- Clause 13: the competent supervisory authority is determined in accordance with Annex I.C.
- Clause 17: Option 1 applies, and the governing law is that of the Netherlands.
- Clause 18(b): the courts of the Netherlands.
- Annexes. Annex I (A: parties, B: description of the transfer, C: competent supervisory authority) is completed from the Agreement or data sheet incorporated under section 2.2. Annex II (technical and organizational measures) is completed by identifying the applicable measures by document title, version or effective date, and URL or attached copy. Annex III (sub-processors) is the register incorporated under section 4.1. Each Annex is completed for the actual transfer before it takes place.
- Hierarchy. If there is a conflict between the SCCs and the rest of this DPA or the Agreement, the SCCs prevail.
Schedule 3: UK International Data Transfer Addendum
- Incorporation. The UK Addendum is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022. It is incorporated into this DPA by reference, including as revised under Section 18 of it, and applies to Restricted Transfers to which the UK GDPR applies.
- Tables.
- Table 1 (Parties): as in the Agreement or data sheet, for each transfer. The start date is the date the Agreement takes effect.
- Table 2 (Selected SCCs): the Approved EU SCCs are Modules Two and Three as set out in Schedule 2. Clause 7 applies, the optional Clause 11 wording does not apply, and Clause 9(a) is general authorization with a thirty (30) day period.
- Table 3 (Appendix Information): as set out in paragraph 3 of Schedule 2.
- Table 4 (Ending the Addendum when the Approved Addendum changes): neither party.
- Conflict. If there is a conflict between the UK Addendum and this DPA, the UK Addendum prevails.
END