Data Processing Addendum

THIS DATA PROCESSING ADDENDUM (“DPA”) is entered into as of the Addendum Effective Date by and between: (1) Headline Services US, LLC, a Delaware corporation with its principal business address at 101 Montgomery Street, San Francisco, CA 94129 (“Headline”); and (2) the entity or other person who is a counterparty to the MSA (as defined below) into which this DPA is incorporated and forms a part (“Customer”), together the “Parties” and each a “Party”.

1. INTERPRETATION

1.1 In this DPA the following terms shall have the meanings set out in this Section 1, unless expressly stated otherwise:

1. "Addendum Effective Date" means the effective date of the MSA.
2. "Applicable Data Protection Laws" means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Customer Personal Data under the MSA, including, without limitation, GDPR and the CCPA (as and where applicable).   
3. "CCPA" means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder.
4. "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
5. "Customer Personal Data" means any Personal Data Processed by Headline or its Sub-Processor on behalf of Customer to perform the Services under the MSA (including, for the avoidance of doubt, any such Personal Data comprised within Customer Data). 
6. "Data Subject Request" means the exercise by a Data Subject of its rights in accordance with Applicable Data Protection Laws in respect of Customer Personal Data and the Processing thereof.
7. "Data Subject" means the identified or identifiable natural person to whom Customer Personal Data relates. 
8. "EEA" means the European Economic Area.
9. "GDPR" means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) ("UK GDPR"), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment, to or of the foregoing. References to "Articles" and "Chapters" of, and other relevant defined terms in, the GDPR shall be construed accordingly.
10. "MSA" means the Master Services Agreement entered into by and between the Parties.  
11. "Personal Data" means "personal data," "personal information," "personally identifiable information" or similar term defined in Applicable Data Protection Laws.
12. "Personal Data Breach" means a breach of Headline’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in Headline’s possession, custody or control. For clarity, Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).
13. "Personnel" means a person’s employees, agents, consultants or contractors.
14. "Process" and inflection thereof means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
15. "Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
16. "Restricted Transfer" means the disclosure, grant of access or other transfer of Customer Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); and (ii) in the context of the UK, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a "UK Restricted Transfer"), which would be prohibited without a legal basis under Chapter V of the GDPR.
17. "SCCs" means in respect of: (i) any EU Restricted Transfer, the standard contractual clauses approved by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as populated in accordance with Part 1 of Attachment 2 to Annex 1 (European Annex) ("EU SCCs"); and (ii) any UK Restricted Transfer, the standard contractual clauses adopted by the European Commission pursuant to implementing Decision (EU) 2010/87, as amended and populated in accordance with Part 2 of Attachment 2 to Annex 1 (European Annex) ("UK SCCs").
18. "Service Data" means any data relating to the use, support and/or operation of the Services, which is collected directly by Headline from and/or about users of the Services and/or Customer’s use of the Service for use for its own purposes (certain of which may constitute Personal Data).
19. "Services" means those services and activities to be supplied to or carried out by or on behalf of Headline for Customer pursuant to the MSA.
20. "Sub-Processor" means any third party appointed by or on behalf of Headline to Process Customer Personal Data.
21. "Supervisory Authority": (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; and (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office.

1.2 In this DPA:

1. the terms, “business,” “commercial purpose,” “sell” and “service provider” shall have the respective meanings given thereto in the CCPA; and “personal information” shall mean Customer Personal Data that constitutes “personal information” governed by the CCPA; and
2. unless otherwise defined in this DPA, all capitalised terms in this DPA shall have the meaning given to them in the MSA.

2. SCOPE OF THIS DATA PROCESSING ADDENDUM

2.1     The front-end of this DPA applies generally to Headline’s Processing of Customer Personal Data under the MSA.

2.2     Annex 1 (European Annex) to this DPA applies only if and to the extent Headline’s Processing of Customer Personal Data under the MSA is subject to the GDPR.

2.3     Annex 2 (California Annex) to this DPA applies only if and to the extent Headline’s Processing of Customer Personal Data under the MSA is subject to the CCPA with respect to which Customer is a “business” (as defined in the CCPA).

3. PROCESSING OF CUSTOMER PERSONAL DATA

3.1     Headline shall not Process Customer Personal Data other than on Customer’s instructions or as required by applicable laws.

3.2     Customer instructs Headline to Process Customer Personal Data as necessary to provide the Services to Customer under and in accordance with the MSA.

3.2     Customer acknowledges and agrees that Headline may create and derive from Processing related to the MSA, deidentified, anonymized and/or aggregated data that does not identify Customer or any natural person and use, publicize, or share with third parties such data to improve Headline’s products and services and for its other legitimate business purposes.

4. HEADLINE PERSONNEL

Headline shall take commercially reasonable steps to ascertain the reliability of any Headline Personnel who Process Customer Personal Data, and shall enter into written confidentiality agreements with all Headline Personnel who Process Customer Personal Data that are not subject to professional or statutory obligations of confidentiality.

5. SECURITY

5.1     Headline shall implement and maintain technical and organisational measures in relation to Customer Personal Data designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access as described in Annex 3 (Security Measures) (the “Security Measures”).

5.2     Headline may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

6. DATA SUBJECT RIGHTS

6.1     Headline, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests. If Headline receives a Data Subject Request, Customer will be responsible for responding to any such request.

6.2     Headline shall:

1. promptly notify Customer if it receives a Data Subject Request; and
2. not respond to any Data Subject Request, other than to advise the Data Subject to submit the request to Customer, except on the written instructions of Customer or as required by Applicable Data Protection Laws.

6.3     Operational clarifications:

1. When complying with its transparency obligations under Clause 8.3 of the EU SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Headline’s and its licensors’ trade secrets, business secrets, confidential information and/or other commercially sensitive information.

2. Where applicable, for the purposes of Clause 10(a) of Module Three of the EU SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Headline to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer.

3. For the purposes of Clause 15.1(a) of the EU SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required.

4. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Headline (at Headline’s then-current professional services rates) in Headline’s cooperation and assistance provided to Customer under this Section 6, and shall on demand reimburse Headline any such costs incurred by Headline.

7. PERSONAL DATA BREACH

Breach notification and assistance

7.1     Headline shall notify Customer without undue delay upon Headline’s discovering a Personal Data Breach affecting Customer Personal Data. Headline shall provide Customer with information (insofar as such information is within Headline’s possession and knowledge and does not otherwise compromise the security of any Personal Data Processed by Headline) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. Headline’s notification of or response to a Personal Data Breach shall not be construed as Headline’s acknowledgement of any fault or liability with respect to the Personal Data Breach.

7.2     Headline shall reasonably co-operate with Customer and take such commercially reasonable steps as may be directed by Customer to assist in the investigation of any such Personal Data Breach.

7.3     Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breaches.

7.4     Operational clarifications:

1. The Parties agree that the provisions of this Section 7 satisfy applicable requirements of the UK SCCs.
2. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Headline (at Headline’s then-current professional services rates) in Headline’s cooperation and assistance provided to Customer under Section 7.2, and shall on demand reimburse Headline any such costs incurred by Headline.

7.5     Notification to Headline:

If Customer determines that a Personal Data Breach must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Headline, where permitted by applicable laws, Customer agrees to:

1. notify Headline in advance; and
2. in good faith, consult with Headline and consider any clarifications or corrections Headline may reasonably recommend or request to any such notification, which: (i) relate to Headline’s involvement in or relevance to such Personal Data Breach; and (ii) are consistent with applicable laws.

8. CUSTOMER’S RESPONSIBILITIES

8.1     Customer agrees that, without limiting Headline’s obligations under Section 5 (Security), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; (c) securing Customer’s systems and devices that Headline uses to provide the Services; and (d) backing up Customer Personal Data.

8.2     Customer shall ensure:

1. that there is, and will be throughout the term of the MSA, a valid legal basis for the Processing by Headline of Customer Personal Data in accordance with this DPA and the MSA (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)); and
2. that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Headline of Customer Personal Data.

8.3     Customer agrees that the Service, the Security Measures, and Headline’s commitments under this DPA are adequate to meet Customer’s needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Customer Personal Data.

8.4     Customer shall not provide or otherwise make available to Headline any Customer Personal Data that contains any (a) Social Security numbers or other government-issued identification numbers; (b) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (c) health insurance information; (d) biometric information; (e) passwords to any online accounts; (f) credentials to any financial accounts; (g) tax return data; (h) any payment card information subject to the Payment Card Industry Data Security Standard; (i) Personal Data of children under 13 years of age; or (j) any other information that falls within any special categories of personal data (as defined in GDPR) and/or data relating to criminal convictions and offences or related security measures (together, “Restricted Data”).

9. LIABILITY

The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this DPA and the SCCs (if and as they apply) will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the MSA; provided that, nothing in this Section 9 will affect any person’s liability to Data Subjects under the third-party beneficiary provisions of the SCCs (if and as they apply).

10. SERVICE DATA

10.1     Customer acknowledges that Headline may collect, use and disclose Service Data for its own business purposes, such as:

1. for accounting, tax, billing, audit, and compliance purposes;
2. to provide, improve, develop, optimise and maintain the Services;
3. to investigate fraud, spam, wrongful or unlawful use of the Services; and/or
4. as otherwise permitted or required by applicable law.

10.2     In respect of any such Processing described in Section 10.1, Headline:

1. independently determines the purposes and means of such Processing;
2. shall comply with Applicable Data Protection Laws (if and as applicable in the context);
3. shall Process such Service Data as described in Headline’s relevant privacy notices/policies, if and as applicable in the context (such as that shown at https://deepdive.headline.com/public/privacy, as updated from time to time); and
4. where possible, shall apply technical and organisational safeguards to any relevant Personal Data that are no less protective than the Security Measures.

10.3     For the avoidance of doubt, this DPA shall not apply to Headline’s collection, use, disclosure or other Processing of Service Data, and Service Data does not constitute Customer Personal Data.

11. INCORPORATION AND PRECEDENCE

11.1     This DPA shall be incorporated into and form part of the MSA with effect from the Addendum Effective Date.

11.2     In the event of any conflict or inconsistency between:

1. this DPA and the MSA, this DPA shall prevail; or
2. any SCCs entered into pursuant to Paragraph 6 of Annex 1 (European Annex) and this DPA and/or the MSA, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.

1. PROCESSING OF CUSTOMER PERSONAL DATA

1.1     The Parties acknowledge and agree that the details of Headline’s Processing of Personal Data under this DPA and the MSA (including the respective roles of the Parties relating to such Processing) are as set out in Attachment 1 to Annex 1 (European Annex) to the DPA.

1.2     Where Headline receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Headline shall inform Customer.

1.3     Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Headline pursuant to or in connection with the MSA shall be in strict compliance with the GDPR and all other applicable laws.

2. SUBPROCESSING

2.1     Customer generally authorises Headline to appoint Sub-Processors in accordance with this Paragraph 2.

2.2     Headline may continue to use those Sub-Processors already engaged by Headline as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in the Sub-Processor list shown at https://deepdive.headline.com/public/subprocessor (the “Sub-Processor List”).

2.3     Headline shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex). If, within [fourteen (14)] days of receipt of that notice, Customer notifies Headline in writing of any objections (on reasonable grounds) to the proposed appointment:

1. Headline shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and
2. where: (i) such a change cannot be made within thirty (30) days from Headline’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the MSA, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy.

2.4     If Customer does not object to Headline’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor.

2.5     With respect to each Sub-Processor, Headline shall maintain a written contract between Headline and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Headline shall remain liable for any breach of this DPA caused by a Sub-Processor.

2.6     Operational clarifications:

If Customer determines that a Personal Data Breach must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Headline, where permitted by applicable laws, Customer agrees to:

1. The terms and conditions of this Paragraph 2 apply in relation to Headline’s appointment and use of Sub-Processors under the SCCs.
2. Any approval by Customer of Headline’s appointment of a Sub-Processor that is given expressly or deemed given pursuant to this Paragraph 2 constitutes Customer’s: (i) prior written consent to Headline’s appointment of that Sub-Processor if and as required under Clause 5(h) of the UK SCCs; and (ii) documented instructions to effect disclosures and onward transfers to any relevant Sub-Processors if and as required under Clause 8.8 of the EU SCCs.
3. Headline will only provide copies of Sub-Processor agreements to Customer under Clause 5(j) of the UK SCCs upon Customer’s request; provided that, Headline may remove or redact therefrom all information as may be necessary to protect business secrets or other confidential information, and/or any clauses, recitals, schedules, annexes, appendices etc., unrelated to the UK SCCs beforehand.

3. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

3.1     Headline, taking into account the nature of the Processing and the information available to Headline, shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments and prior consultations with Supervisory Authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Headline.

3.2     Operational clarifications:

Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Headline (at Headline’s then-current professional services rates) in Headline’s provision of any cooperation and assistance provided to Customer under Paragraph 3.1, and shall on demand reimburse Headline any such costs incurred by Headline.

4. RETURN AND DELETION

4.1     Subject to Paragraph 4.2 and 4.3, upon the date of cessation of any Services involving the Processing of Customer Personal Data (the “Cessation Date”), Headline shall promptly cease all Processing of Customer Personal Data for any purpose other than for storage or as otherwise permitted or required under this DPA.

4.2     Subject to Paragraph 4.4, to the extent technically possible in the circumstances (as determined in Headline’s sole discretion), on written request to Headline (to be made no later than fourteen (14) days after the Cessation Date (“Post-cessation Storage Period”)), Headline shall within thirty (30) days of such request:

1. return a complete copy of all Customer Personal Data within Headline’s possession to Customer by secure file transfer, promptly following which Headline shall delete or irreversibly anonymise all other copies of such Customer Personal Data; or
2. either (at its option) delete or irreversibly anonymise all Customer Personal Data within Headline’s possession.

4.3     In the event that during the Post-cessation Storage Period, Customer does not instruct Headline in writing to either delete or return Customer Personal Data pursuant to Paragraph 4.2, Headline shall promptly after the expiry of the Post-cessation Storage Period either (at its option) delete; or irreversibly render anonymous, all Customer Personal Data then within Headline possession to the fullest extent technically possible in the circumstances.

4.4     Headline may retain Customer Personal Data where permitted or required by applicable law, for such period as may be required by such applicable law, provided that Headline shall:

1. maintain the confidentiality of all such Customer Personal Data; and
2. Process the Customer Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention.

4.5     Operational clarifications:

Certification of deletion of Customer Personal Data as described in:

1. Clause 12(1) of the UK SCCs; and
2. Clauses 8.5 and 16(d) of the EU SCCs,

shall be provided only upon Customer’s written request.

5. AUDIT RIGHTS

5.1     Headline shall make available to Customer on request, such information as Headline (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this DPA.

5.2     Subject to Paragraphs 5.3 to 5.8, in the event that Customer (acting reasonably) is able to provide documentary evidence that the information made available by Headline pursuant to Paragraph 5.1 is not sufficient in the circumstances to demonstrate Headline’s compliance with this DPA, Headline shall allow for and contribute to audits, including on-premise inspections, by Customer or an auditor mandated by Customer in relation to the Processing of Customer Personal Data by Headline.

5.3     Customer shall give Headline reasonable notice of any audit or inspection to be conducted under Paragraph 5.2 (which shall in no event be less than fourteen (14) days’ notice) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Headline’s premises, equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of Headline’s other customers or the availability of Headline’s services to such other customers).

5.4     Prior to conducting any audit, Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Headline will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Headline security, privacy, employment or other relevant policies). Headline will work cooperatively with Customer to agree on a final audit plan.

5.5     If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer’s audit request (“Audit Report”) and Headline has confirmed in writing that there are no known material changes in the controls audited and covered by such Audit Report(s), Customer agrees to accept provision of such Audit Report(s) in lieu of requesting an audit of such controls or measures.

5.6     Headline need not give access to its premises for the purposes of such an audit or inspection:

1. where an Audit Report is accepted in lieu of such controls or measures in accordance with Paragraph 5.5;
2. to any individual unless they produce reasonable evidence of their identity;
3. to any auditor whom Headline has not approved in advance (acting reasonably);
4. to any individual who has not entered into a non-disclosure agreement with Headline on terms acceptable to Headline;
5. outside normal business hours at those premises; or
6. on more than one occasion in any calendar year during the term of the MSA, except for any audits or inspections which Customer is required to carry out under the GDPR or by a Supervisory Authority.

5.7     Nothing in this DPA shall require Headline to furnish more information about its Sub-Processors in connection with such audits than such Sub-Processors make generally available to their customers.

5.8     Operational clarifications:

1. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Headline (at Headline’s then-current professional services rates) in Headline’s provision of any cooperation and assistance provided to Customer under this Paragraph 5 (excluding any costs incurred in the procurement, preparation or delivery of Audit Reports to Customer pursuant to Paragraph 5.5 ), and shall on demand reimburse Headline any such costs incurred by Headline.
2. The audits described in: (i) Clauses 8.9(c) and 8.9(d) of the EU SCCs; and (ii) Clauses 5(f) and 12(2) of the UK SCCs, shall be subject to any relevant terms and conditions detailed in this Paragraph 5.

6. RESTRICTED TRANSFERS

6.1     The Parties acknowledge that Customer’s transmission of Customer Personal Data to Headline hereunder may involve a Restricted Transfer. The relevant set(s) of SCCs that may be entered into under Paragraph 6.2 and/or 6.3 shall apply and have effect only if and to the extent permitted and required under the EU GDPR and/or UK GDPR (if and as applicable) to establish a valid basis under Chapter V of the EU GDPR and/or UK GDPR in respect of the transfer from Customer to Headline of Customer Personal Data.

6.2     EU Restricted Transfers

To the extent that any Processing of Customer Personal Data under this DPA involves an EU Restricted Transfer from Customer to Headline, the Parties shall comply with their respective obligations set out in the EU SCCs, which are hereby deemed to be:

1. populated in accordance with Part 1 of Attachment 2 to Annex 1 (European Annex); and
2. entered into by the Parties and incorporated by reference into this DPA.

6.3     UK Restricted Transfers

To the extent that any Processing of Customer Personal Data under this DPA involves a UK Restricted Transfer from Customer to Headline, the Parties shall comply with their respective obligations set out in the UK SCCs, which are hereby deemed to be:

1. populated in accordance with Part 2 of Attachment 2 to Annex 1 (European Annex); and
2. entered into by the Parties and incorporated by reference into this DPA.

6.4     In respect of any UK Restricted Transfer involving Processing in respect of which Customer is itself acting as a Processor on behalf of any other person, Customer warrants and represents on an ongoing basis, and further undertakes, that it has full and sufficient authority to enter into the UK SCCs for and on behalf of each such other person.

6.5     To the extent that Headline effects an onward transfer to a Sub-Processor in respect of Customer Personal Data to which the UK SCCs apply, Customer hereby authorises Headline to enter into the UK SCCs as agent for Customer (as ‘data exporter’) with that Sub-Processor (as ‘data importer’), which it may (at its option) elect to do in order to meet its obligations to Customer under Clause 11 of the UK SCCs (which it is agreed may be discharged by inclusion of any relevant delegated Processing within generic descriptions detailed in any such further UK SCCs).

6.6     Adoption of new transfer mechanism

Headline may on notice vary this DPA and replace the relevant SCCs with:

1. any new form of the relevant SCCs or any replacement therefor prepared and populated accordingly (e.g., a form of ‘International Data Transfer Agreement’ or appropriate Annex to the EU SCCs issued by the UK Information Commissioner’s Office and approved by the UK Government for use in respect of UK Restricted Transfers; or standard data protection clauses adopted by the European Commission for use specifically in respect of transfers to data importers subject to Article 3(2) of the EU GDPR); or
2. another transfer mechanism, other than the SCCs,

that enables the lawful transfer of Customer Personal Data to Headline under this DPA in compliance with Chapter V of the GDPR.

6.7     Provision of full-form SCCs

In respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) – on specific written request (made to the contact details set out in Attachment 1 to this Annex 1 (European Annex); accompanied by suitable supporting evidence of the relevant request), Headline shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with Attachment 2 to Annex 1 (European Annex) in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer’s compliance with Applicable Data Protection Laws.

Data Processing Details

Note:

This Attachment 1 to Annex 1 (European Annex) to the DPA includes certain details of the Processing of Personal Data as required:

• by Article 28(3) GDPR; and
• to populate the Appendices to the UK SCCs and EU SCCs in the manner described in Attachment 2 to Annex 1 (European Annex) to the DPA.

HEADLINE / ‘DATA IMPORTER’ DETAILS

Name:	Headline (as set out in the pre-amble to the DPA)
Address:	As set out in the pre-amble to the DPA
Contact Details for Data Protection:	Role: Operating Partner Email: privacy@headline.com
Headline Activities:	Headline is a provider of a software-as-a-service solution for start-up data analytics known as Deepdive
Role:	Processor

CUSTOMER / ‘DATA EXPORTER’ DETAILS

Name:	Customer (as set out in the pre-amble to the DPA)
Address:	Customer’s address is Customer’s principal business trading address – unless otherwise notified to the email address set out under ‘Headline / ‘Data Importer’ Details’
Contact Details for Data Protection:	Role: Operating Partner Email: privacy@headline.com
Customer Activities:	Customer’s activities relevant to this DPA are the use and receipt of the Services under and in accordance with, and for the purposes anticipated and permitted in, the MSA as part of its ongoing business operations.
Role:	Controller – in respect of any Processing of Customer Personal Data in respect of which Customer is a Controller in its own right; and Processor – in respect of any Processing of Customer Personal Data in respect of which Customer is itself acting as a Processor on behalf of any other person (including its affiliates if and where applicable).

DETAILS OF PROCESSING

Categories of Data Subjects:	Any individuals whose Personal Data is comprised within data submitted to the Services by or on behalf of Customer under the MSA, which will be as determined by Customer in its sole discretion through its use of the Services – but may include Customer’s and its affiliates’: “Staff”, namely: employees and non-employee workers; students, interns, apprentices and volunteers; directors and officers; advisers, consultants, independent contractors, agents and autonomous, temporary or casual workers. Customers, clients, (sub-)licensees, users and end-users, website visitors and marketing prospects. Suppliers, service providers, consultants, advisers and other providers of goods or services. Distributors, resellers, sales agents, introducers, sales representatives, collaborators, joint-venturers and other commercial partners. Shareholders, partners, members and supporters. Advisers, consultants and other professionals and experts. Where any of the above is a business or organisation, it includes their Staff. Each category includes current, past and prospective Data Subjects.
Categories of Personal Data:	Any Personal Data comprised within data submitted to the Services by or on behalf of Customer under the MSA, which will be as determined by Customer in its sole discretion through its use of the Services – but may include: Personal details, including any information that identifies the Data Subject and their personal characteristics, including: name, address, contact details (including email address, telephone details and other contact information), age, date of birth, sex, and physical description. Personal details issued as an identifier by a public authority, including passport details, national insurance numbers, identity card numbers, driving licence details. Technological details, such as internet protocol (IP) addresses, unique identifiers and numbers (including unique identifier in tracking cookies or similar technology), pseudonymous identifiers, precise and imprecise location data, internet / application / program activity data, and device IDs and addresses.
Sensitive Categories of Data, and associated additional restrictions/safeguards:	Categories of sensitive data: None – as noted in Section 8.4 of the DPA, Customer agrees that Restricted Data, which includes ‘sensitive data’ (as defined in Clause 8.7 of the EU SCCs), must not be submitted to the Services. Additional safeguards for sensitive data: N/A
Frequency of transfer:	Ongoing – as initiated by Customer in and through its use, or use on its behalf, of the Services.
Nature of the Processing:	Processing operations required in order to provide the Services in accordance with the MSA.
Purpose of the Processing:	Customer Personal Data will be processed: (i) as necessary to provide the Services as initiated by Customer in its use thereof, and (ii) to comply with any other reasonable instructions provided by Customer in accordance with the terms of this DPA.
Duration of Processing / Retention Period:	For the period determined in accordance with the MSA and DPA, including Paragraph 4 of Annex 1 (European Annex) to the DPA.
Transfers to (sub-)processors:	Transfers to Sub-Processors are as, and for the purposes, described from time to time in the Sub-Processor List (as may be updated from time to time in accordance with Paragraph 2 of Annex 1 (European Annex) to the DPA).

POPULATION OF SCCs

Notes:

• The EU SCCs populated in accordance with Part 1 of this Attachment 2 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraphs 6.1 and 6.2 of Annex 1 (European Annex) to the DPA).
• The UK SCCs amended and populated in accordance with Part 2 of this Attachment 2 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraphs 6.1 and 6.3 of Annex 1 (European Annex) to the DPA).
• Capitalized terms used in this Attachment 2 have the meanings given to them in the DPA.

1. SIGNATURE OF THE EU SCCs:

1.1     Where applicable in accordance with Paragraphs 6.1 and 6.2 of Annex 1 (European Annex) to the DPA:

1. each of the Parties is hereby deemed to have signed the EU SCCs at the relevant signature block in Annex I to the Appendix to the EU SCCs; and
2. those EU SCCs are entered into by and between the Parties with effect from (i) the Addendum Effective Date; or (ii) the date of the first EU Restricted Transfer to which they apply in accordance with Paragraphs 6.1 and 6.2 of Annex 1 (European Annex) to the DPA, whichever is the later.

2. MODULES

The following modules of the EU SCCs apply in the manner set out below (having regard to the role(s) of Customer set out in Attachment 1 to Annex 1 (European Annex) to the DPA):

1. Module Two of the EU SCCs applies to any EU Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is a Controller in its own right; and/or
2. Module Three of the EU SCCs applies to any EU Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is itself acting as a Processor on behalf of any other person.

3. POPULATION OF THE BODY OF THE EU SCCs

3.1     For each Module of the EU SCCs, the following applies as and where applicable to that Module and the Clauses thereof:

1. The optional ‘Docking Clause’ in Clause 7 is not used and the body of that Clause 7 is left intentionally blank.
2. In Clause 9:
   
   1. OPTION 2: GENERAL WRITTEN AUTHORISATION applies, and the minimum time period for advance notice of the addition or replacement of Sub-Processors shall be the advance notice period set out in Paragraph 2.3 of Annex 1 (European Annex) to the DPA; and
   2. OPTION 1: SPECIFIC PRIOR AUTHORISATION is not used and that optional language is deleted; as is, therefore, Annex III to the Appendix to the EU SCCs.
3. In Clause 11, the optional language is not used and is deleted.
4. In Clause 13, all square brackets are removed and all text therein is retained.
5. In Clause 17:
   
   1. OPTION 1 applies, and the Parties agree that the EU SCCs shall governed by the law of Ireland; and
   2. OPTION 2 is not used and that optional language is deleted.
6. For the purposes of Clause 18, the Parties agree that any dispute arising from the EU SCCs shall be resolved by the courts of Ireland, and Clause 18(b) is populated accordingly.

3.1     In this Paragraph 3, references to “Clauses” are references to the Clauses of the EU SCCs.

4. POPULATION OF ANNEXES TO THE APPENDIX TO THE EU SCCs

4.1     Annex I to the Appendix to the EU SCCs is populated with the corresponding information detailed in Attachment 1 to Annex 1 (European Annex) to the DPA, with:

1. Customer being ‘data exporter’; and
2. Headline being ‘data importer’.

4.2     Part C of Annex I to the Appendix to the EU SCCs is populated as below:
The competent supervisory authority shall be determined as follows:

• Where Customer is established in an EU Member State: the competent supervisory authority shall be the supervisory authority of that EU Member State in which Customer is established.
• Where Customer is not established in an EU Member State, Article 3(2) of the GDPR applies and Customer has appointed an EU representative under Article 27 of the GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State in which Customer’s EU representative relevant to the processing hereunder is based (from time-to-time).
• Where Customer is not established in an EU Member State, Article 3(2) of the GDPR applies, but Customer has not appointed an EU representative under Article 27 of the GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State notified in writing to Headline’s contact point for data protection identified in Attachment 1 to Annex 1 (European Annex) to the DPA, which must be an EU Member State in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

4.3     Annex II to the Appendix to the EU SCCs is populated as below:

General:

• Please refer to Section 5 of the DPA and Annex 3 (Security Measures) to the DPA.
• In the event that Customer receives a Data Subject Request under the EU GDPR and requires assistance from Headline, Customer should email Headline’s contact point for data protection identified in Attachment 1 to Annex 1 (European Annex) to the DPA.

Sub-Processors: When Headline engages a Sub-Processor under these Clauses, Headline shall enter into a binding contractual arrangement with such Sub-Processor that imposes upon them data protection obligations which, in substance, meet or exceed the relevant standards required under these Clauses and the DPA – including in respect of:

• applicable information security measures;
• notification of Personal Data Breaches to Headline;
• return or deletion of Customer Personal Data as and where required; and

engagement of further Sub-Processors.

PART 2: POPULATION OF UK SCCs

1. SIGNATURE OF THE UK SCCs:

Where applicable in accordance with Paragraphs 6.1 and 6.3 of Annex 1 (European Annex) to the DPA:

1. each of the Parties is hereby deemed to have signed the UK SCCs and their Appendices at the relevant signature block; and
2. those UK SCCs are entered into by and between the Parties with effect from (i) the Addendum Effective Date; or (ii) the date of the first UK Restricted Transfer to which they apply in accordance with Paragraphs 6.1 and 6.3 of Annex 1 (European Annex) to the DPA, whichever is the later.

2. POPULATION OF DETAILS OF PARTIES TO THE UK SCCs

The details of the parties to the UK SCCs set out on the first page of UK SCCs is populated with the relevant information of the Parties as detailed in Attachment 1 to Annex 1 (European Annex) to the DPA, with:

1. Customer being ‘data exporter’, both on its own behalf as a Controller or as agent for applicable Controllers to the extent Customer is acting as a Processor (having regard to Customer’s role(s) set out in Attachment 1 to Annex 1 (European Annex) to the DPA); and
2. Headline being ‘data importer’.

3. VARIATION OF THE UK SCCs TO REFLECT THE UK GDPR

3.1     The UK SCCs are hereby deemed to be amended to reflect the versions of those UK SCCs issued and published by the UK Information Commissioner’s Office to reflect variations:

1. required to account for the specific requirements of the UK GDPR;
2. required to reflect the UK no longer being a member state of the European Union; and
3. permitted by paragraph 7 of Schedule 21 to the UK Data Protection Act 2018,

which as the Addendum Effective Date, are as shown at the following webpage https://ico.org.uk/media/for-organisations/documents/2618973/uk-sccs-c-p-202012.docx.

3.2     Notwithstanding the above, it is agreed that neither:

1. the optional ‘Indemnification’ clause; nor
2. the optional ‘Effective date of the Standard Contractual Clauses’ clause,

are used, and all such optional language is deleted.

4. POPULATION OF THE APPENDICES TO THE UK SCCs

4.1     Appendix I to the UK SCCs is populated with the corresponding information detailed in Attachment 1 to Annex 1 (European Annex) to the DPA.

4.2     Appendix II to the UK SCCs is populated as follows:
The technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) to the UK SCCs are those established and maintained under Section 5 of the DPA and Annex 3 (Security Measures) to the DPA.

Annex 2

California Annex

1.     It is the Parties’ intent that with respect to any personal information, Headline is a service provider. Headline shall not:

1. sell any personal information;
2. retain, use or disclose any personal information for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the personal information for a commercial purpose other than the provision of the Service; or
3. retain, use or disclose the personal information outside of the direct business relationship between Headline and Customer. Headline hereby certifies that it understands its obligations under this Annex 2 and will comply with them.

2.     The Parties acknowledge that Headline’s retention, use and disclosure of personal information authorised by Customer’s instructions stated in the DPA are integral to the Services and the business relationship between the Parties. The exchange of Customer Personal Data does not form part of the consideration exchanged between the Parties in respect of the MSA or any other business dealings.

Annex 3

Security Measures

As from the Addendum Effective Date, Headline will implement and maintain the Security Measures as set out in this Annex 3.

1.     Organisational management and dedicated staff responsible for the development, implementation and maintenance of Headline’s information security program.

2.     Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Headline’s organisation, monitoring and maintaining compliance with Headline’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.

3.     Data security controls which include at a minimum logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilisation of commercially available and industry standard encryption technologies for Customer Personal Data.

4.     Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.

5.     Password controls designed to manage and control password strength, expiration and usage.

6.     System audit or event logging and related monitoring procedures to proactively record user access and system activity.

7.     Physical and environmental security of data centres, server room facilities and other areas containing Customer Personal Data designed to protect information assets from unauthorised physical access or damage.

8.     Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Headline’s possession.

9.     Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to Headline’s technology and information assets.

10.     Incident management procedures designed to allow Headline to investigate, respond to, mitigate and notify of events related to Headline’s technology and information assets.

11.     Network security controls that provide for the use of enterprise firewalls and intrusion detection systems designed to protect systems from intrusion and limit the scope of any successful attack.

12.     Vulnerability assessment and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.

13.     Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disasters.