Data Processing Agreement (DPA)

this DPA is required under Applicable Laws (defined below), and

where Airlock Digital Processes Customer Personal Data (both defined below).

installing any Airlock Digital software; or

executing a software subscription agreement or licence for the use of Airlock Digital’s software or other services.

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. Except as modified below, the terms of the Agreement shall remain in full force and effect. Cognate terms shall be construed to have the same meaning.

"Applicable Laws" means any laws that regulate the Processing, privacy or security of Customer Personal Data and that are directly applicable to each respective party to this DPA in the context of Airlock Digital Processing Customer Personal Data.

“Airlock Digital” means, as applicable, Airlock Digital Pty Ltd of Level 2, 136 Greenhill Road, Unley, South Australia, 5061, Australia, or Airlock Digital, Inc., a Delaware corporation, whichever of those two entities is named as the contracting party for Airlock Digital in the Agreement (the “Contracting Entity”). Where one of those entities is the Contracting Entity, the other is an Airlock Digital Affiliate for the purposes of this DPA.

“Airlock Digital Affiliate" means an entity belonging to the Airlock Digital group of companies named in Exhibit E as an Airlock Digital Affiliated Subprocessor. The term “Airlock Digital” is inclusive of the applicable Airlock Digital Affiliate when: (i) Applicable Laws require a direct relationship between Airlock Digital Affiliate and the Customer with respect to data protection agreements, and (ii) the Airlock Digital Affiliate processes Customer Personal Data. Airlock Digital represents that it is duly and effectively authorized (or will be subsequently ratified) to act on the Airlock Digital Affiliate’s behalf.

“Customer” means (i) the person or entity that is indicated below in the signature block, or (ii) if there is no signature block or it is not completed, then Customer is the person or entity that has entered into the Agreement with Airlock Digital. Customer also means a Customer Affiliate when: (i) Applicable Laws require a direct relationship between Airlock Digital and the Customer’s Affiliate with respect to data protection agreements, (ii) Customer is duly and effectively authorized (or subsequently ratified) to act on its Affiliate’s behalf, and (iii) Airlock Digital processes the Affiliate’s Customer Personal Data.

"Customer Personal Data" means any Personal Data Processed by Airlock Digital or a Subprocessor on behalf of the Customer in the provision of the Services.

"GDPR" means the General Data Protection Regulation 2016/679 (“GDPR”) and any local laws implementing or supplementing the GDPR.

“Onward Transfer” means any transfer of Customer Personal Data from Airlock Digital to a Subprocessor.

"Restricted Transfer" means any export of Customer Personal Data by Customer to Airlock Digital from its country of origin, either directly or via onward transfer, to a third country in the course of Airlock Digital’s provision of the Services under the Agreement that is prohibited under Applicable Laws, unless (a) the destination has been recognized as providing an adequate level of data protection by competent data protection authority, or otherwise in a legally binding way, or (b) Airlock Digital has adopted an appropriate, under Applicable Laws recognized, adequacy mechanism ensuring an adequate level of data protection.

“Services” means the products or services offered by Airlock Digital.

“Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR as to the European Commission Implementing Decision (EU) 2021/914 or any subsequent final version as adopted by Airlock Digital.

"Subprocessor" means any contracted service provider (including any third party and Airlock Digital Affiliate but excluding an employee of Airlock Digital or Airlock Digital sub­contractors unless specified in an applicable Statement of Work) Processing Customer Personal Data in the course of Airlock Digital’s provisioning of the Services set forth in the Agreement.

The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", “Processor”, "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR.

The word "include" shall be construed to mean include without limitation.

Airlock Digital acts as a Processor, and Customer and those entities that it permits to use the Services act as Controllers under the DPA.

The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, Customer determines the purposes and means of the Processing of Customer Personal Data, and Airlock Digital processes Customer Personal Data on Customer’s behalf in providing the Services.

Customer acts as a single point of contact and shall obtain any relevant authorizations, consents, and permissions for the processing of Personal Data in accordance with this DPA, including, where applicable approval by Controllers to use Airlock Digital as a Processor.

Airlock Digital shall:

process Customer Personal Data only on relevant Customer’s documented instructions, as set out in the Agreement, this DPA, including Customer providing instructions via configuration tools and APIs made available by Airlock Digital with the Services, and as required by Applicable Laws (the “Documented Instructions”). Any additional or alternate instructions, having an impact to the Services must be agreed upon by the Parties separately in writing; and

unless prohibited by Applicable Law, Airlock Digital shall inform the Customer in advance if Airlock Digital determines that:

Customer’s instructions conflict with Applicable Laws; or

Applicable Laws require any processing contrary to the Customer’s instructions.

Customer shall:

be responsible for complying with Applicable Laws when making decisions and issuing instructions for the Processing of Customer Personal Data, including securing all permissions, consents or authorizations that may be required.

defend and indemnify Airlock Digital, Airlock Digital Affiliates, and Airlock Digital Subprocessors for any claim brought against them arising from an allegation of Customer’s breach of this section, whether by a Data Subject or a government authority. This provision does not diminish Customer or Data Subject’s rights under Applicable Laws related to Airlock Digital’s adherence to its obligations under Applicable Laws, and in the event of such a claim, the Parties shall follow the process set forth in the Agreement and if none, then Airlock Digital will:

notify Customer of such claim,

permit Customer to control the defense or settlement of such claim; provided, however, Customer shall not settle any claim in a manner that requires Airlock Digital to admit liability without Airlock Digital’s prior written consent, and

provide Customer with reasonable assistance in connection with the defense or settlement of such claim, at Customer’s cost and expense. In addition, Airlock Digital may participate in defense of any claim, and if Customer is already defending such claim, Airlock Digital’s participation will be at Airlock Digital’s expense.

Airlock Digital shall take reasonable steps to:

implement appropriate security controls designed to ensure access to Customer Personal Data is limited to those individuals who need to know/access the relevant Customer Personal Data as reasonably necessary for the purposes outlined in this DPA, the Agreement or required under Applicable Laws; and

ensure all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

disclose to Customer that Airlock Digital personnel who access Customer Personal Data in connection with the Services are currently located in Australia, the United States, the United Kingdom and Canada. Airlock Digital may add further locations from which its personnel access Customer Personal Data, provided it gives Customer notice in accordance with the same notice process that applies to new Subprocessors under the Subprocessing section of this DPA.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Airlock Digital shall in relation to the Processing of Customer Personal Data maintain appropriate technical and organizational measures as specified in the Agreement and designed to ensure a level of security appropriate to the risk, including, as appropriate, the measures referred to in the Applicable Laws.

In assessing the appropriate level of security, Airlock Digital shall take into account the nature of the data and the Processing activities in assessing the risks posed by a potential Personal Data Breach.

Airlock Digital is granted a general authorization to subcontract the processing of Personal Data to Subprocessors, provided that:

Airlock Digital or Airlock Digital Affiliates on its behalf shall engage Subprocessors under a written (including in electronic form) contract consistent with the terms of this DPA in relation to the Subprocessor's processing of Personal Data. Airlock Digital shall be liable for any breaches by the Subprocessor in accordance with the terms of this Agreement.

Airlock Digital will evaluate the security, privacy and confidentiality practices of a Subprocessor prior to selection to establish that it is capable of providing the level of protection of Personal Data required by this DPA; and

Airlock Digital' list of Subprocessors in place on the effective date of the Agreement is set out in Exhibit E.

Airlock Digital' use of Subprocessors is at its discretion, provided that:

Airlock Digital will inform Customer in advance (by email or by posting on the Cloud Service) of any intended additions or replacements to the list of Subprocessors including name, address and role of the new Subprocessor; and

Customer may object to such changes as set out in Section 6.

If Customer has a legitimate reason under Applicable Law to object to the new Subprocessors' processing of Personal Data, subject to the provisions of this Section 6 Customer may terminate the Agreement (limited to the Service(s) for which the new Subprocessor is intended to be used) on written notice to Airlock Digital.

A termination under section 6.1 shall take effect at the time determined by the Customer which shall be no later than 30 days from the date of Airlock Digital' notice to Customer informing Customer of the new Subprocessor provided that if Customer does not terminate within this 30 day period, Customer is deemed to have accepted the new Subprocessor.

Within the 30 day period from the date of Airlock Digital' notice to Customer informing Customer of the new Subprocessor, Customer may request that the parties discuss in good faith a resolution to the objection. Such discussions shall not extend the period for termination and do not affect Airlock Digital' right to use the new Subprocessor(s) after the 30 day period.

Any termination under this Section 6.3 shall be deemed to be without fault by either party and shall be subject to the terms of the Agreement.

Airlock Digital may replace a Subprocessor without advance notice where the reason for the change is outside of Airlock Digital' reasonable control and prompt replacement is required for security or other urgent reasons. In this case, Airlock Digital will inform Customer of the replacement Subprocessor as soon as possible following its appointment.

Customer represents and warrants to provide appropriate transparency to any Data Subjects concerned with Airlock Digital’s Processing of Customer Personal Data and respond to any request filed by Data Subjects as required under Applicable Laws.

Taking into account the nature of the Customer Personal Data Processing, Airlock Digital shall:

not respond to the Data Subject request itself or by Subprocessor unless required by Applicable Laws; and

notify Customer without undue delay if Airlock Digital or any Subprocessor receives a request from a Data Subject under any Applicable Laws in respect to Customer Personal Data; and

reasonably assist Customer through appropriate technical and organizational measures to fulfil Customer’s obligation to respond to Data Subject requests arising under Applicable Law, and where Customer is unable to respond to Data Subject requests through the information available by the Services.

Upon Airlock Digital becoming aware of any Personal Data Breach affecting Customer Personal Data Airlock Digital shall without undue delay, and in any event within seventy-two (72) hours of becoming aware, notify Customer of such Personal Data Breach, and Airlock Digital will:

to the extent known, provide Customer with sufficient information to meet obligations under Applicable Laws to report or inform Data Subjects of such Personal Data Breach; and

cooperate with Customer and take commercially reasonable steps to assist in the investigation, mitigation, and remediation of such Personal Data Breach.

Taking into account the nature of the Processing and information available to Customer in each case solely in relation to Airlock Digital’s Processing of Customer Personal Data, Airlock Digital shall provide reasonable assistance to Customer with any:

necessary data protection impact assessments required of Customer by Applicable Laws;

consultation with or requests of a competent data protection authority;

inquiries about Airlock Digital’s Processing of Customer Personal Data pursuant to the Agreement and this DPA.

Processing of Customer Personal Data by Airlock Digital shall only take place for the duration specified in Exhibit A.

At the end of the duration specified in Exhibit A or upon termination of the Services and pursuant to the Agreement:

Customer Personal Data will be deleted within 90 days of the Services being deprovisioned unless the retention of Customer Personal Data is required under Applicable Laws.

Upon Customer’s written request, Airlock Digital shall:

make Customer Personal Data available for return to Customer where such a request has been made prior to deletion by reasonably providing Customer with a means to retrieve Customer Personal Data from the Services; and

provide a written certification of deletion of Customer Personal Data to Customer.

Subject to the provisions of this clause 11 Airlock Digital shall make available to Customer on request information necessary to demonstrate compliance with Applicable Laws and this DPA.

Customer or its independent third party auditor reasonably acceptable to Airlock Digital (which shall not include any third party auditors who are either a competitor of Airlock Digital or not suitably qualified or independent) may audit Airlock Digital' control environment and security practices relevant to Personal Data processed by Airlock Digital only if:

Airlock Digital has not provided sufficient evidence of its compliance with the Technical and Organizational Measures that protect the production systems of the Cloud Service through providing either:

a certification as to compliance with ISO 27001 or other standards (scope as defined in the certificate); or

a valid ISAE3402 or ISAE3000 or other SOC1-3 attestation report.

a Personal Data Breach has occurred;

an audit is formally requested by Customer's data protection authority; or

provided under a mandatory Applicable Law conferring Customer a direct audit right and provided that Customer shall only audit once in any 12 month period unless a mandatory Applicable Law requires more frequent audits.

Another Controller may assume Customer's rights under Section 11.2 only if it applies directly to the Controller and such audit is permitted and coordinated by Customer.

Customer shall use all reasonable means to combine audits of multiple other Controllers to avoid multiple audits unless the audit must be undertaken by the other Controller itself under Applicable Law.

Notwithstanding the foregoing, Airlock Digital may exclude information and documentation that would reveal the identity of other Airlock Digital customers or information that Airlock Digital is required to keep confidential, and any information or records provided pursuant to this assessment process shall be considered Airlock Digital’s Confidential Information and subject to the Confidentiality section of the Agreement.

Customer shall provide at least 60 days advance notice of any audit unless mandatory Applicable Law or a competent data protection authority requires shorter notice.

Customer audits shall be limited in time to a maximum of 3 business days and beyond such restrictions, the parties will use current certifications or other audit reports to avoid or minimize repetitive audits.

Customer shall provide the results of any audit to Airlock Digital.

Customer shall bear the costs of any audit unless such audit reveals a material breach by Airlock Digital of this DPA, then Airlock Digital shall bear its own expenses of an audit. If an audit determines that Airlock Digital has breached its obligations under the DPA, Airlock Digital will promptly remedy the breach at its own cost

Where, in the use of the Services or performance of the Agreement, Customer directly, indirectly or via onward transfer makes a Restricted Transfer of Customer Personal Data originating from the EEA, Israel, Switzerland and/or the United Kingdom (“UK”) to a third country, not determined by the European Commission, on the basis of Article 45 of the GDPR, or another competent supervisory authority under Applicable Laws, offering an adequate level of data protection, and where Airlock Digital has not adopted another legally sufficient adequacy mechanism and provided notice to the Customer, the Standard Contractual Clauses will be incorporated into this DPA and shall apply as follows:

The Parties acknowledge and agree:

Airlock Digital will be a Data Importer acting as Processor of Customer Personal Data (or Subprocessor, as the context below requires) to a Restricted Transfer.

Where Customer will be a Data Exporter acting as Controller, Module 2 (Controller to Processor) will apply to a Restricted Transfer.

Where Customer will be a Data Exporter acting as a Processor, Module 3 (Processor to Processor) will apply to a Restricted Transfer. Taking into account the nature of the Processing, Customer agrees that it is unlikely that Airlock Digital will know the identity of Customer’s Controllers because Airlock Digital has no direct relationship with Customer’s Controllers and therefore, Customer will fulfil Airlock Digital’s obligations to Customer’s Controllers under the Module 3 (Processor to Processor) Clauses.

Where Airlock Digital will be Data Importer Processing Customer Personal Data in its own discretion as Controller in the provisioning of the Services agreed, e.g., for administering the Agreement, Module 1 (Controller to Controller) will apply to the relationship between Customer (Data Exporter) and Airlock Digital (Data Importer).

that Customer’s instructions may not conflict with the Services and any additional or alternate instructions, having impact to the Services, must be agreed upon separately between the Parties.

The following is a mutually agreed instruction: (a) Processing of Customer Personal Data in accordance with the Agreement and any applicable orders; (b) Processing initiated by users in their use of the Airlock Digital Services, and (c) Processing to comply with other reasonable documented instructions provided by Customer (e.g. via email) where such instructions are consistent with the terms of the Agreement.

A reference to a Clause in this Section 12 is a reference to the Standard Contractual Clauses.

Customer acknowledges and expressly agrees that the process described in Section 10 of the DPA shall govern the fulfilment of requirements related to data erasure and return of Customer Personal Data.

Clause 9 (Use of sub-processors). The Parties agree to and choose Option 2 (General written authorization) and specify the time period set forth in Section 6.3 of this DPA provided that Customer further acknowledges and agrees that Airlock Digital may engage existing Subprocessors (Exhibit E), and new Subprocessors as described there and Airlock Digital maintains an up-to-date List of Subprocessors online as outlined in Exhibit E.

Where the Customer is a Processor to Customer Personal Data, Customer agrees and warrants to be duly authorized to receive and pass on information about Airlock Digital’s new Subprocessor engagement to Controllers with whom Airlock Digital has no direct relationship, assisting Airlock Digital to meet its obligation under Clause 9 towards the Controllers.

Clause 11(a) (Redress). The Parties agree that the option provided shall not apply.

Clause 13 (Supervision). The options in Clause 13 will be selected in line with the Customer’s establishment.

Clause 17 (Governing law). The Parties agree to and choose Option 2; where such law does not allow for third-party beneficiary rights, the Parties agree that this shall be the law of the Netherlands.

The Exhibits A to E of this DPA substitutes the Annexes I to III required under the Standard Contractual Clauses providing the mandatory information under Applicable Laws.

Where the Restricted Transfer concerns Customer Personal Data originating from Switzerland, in line with the Swiss Federal Data Protection and Information Commissioner’s statement as of August, 27, 2021, the following additional requirements shall apply to the extent the Customer Personal Data transferred is exclusively subject to the Swiss Data Protection Act (FADP) or to both the FADP and the GDPR: (i) The term ’member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 (c) of these Standard Contractual Clauses. (ii) Insofar as the data transfers underlying these Standard Contractual Clauses are exclusively subject to the FADP, references to the GDPR are to be understood as references to the FADP. Insofar as the data transfers underlying these Standard Contractual Clauses are subject to both the FADP and the GDPR, the references to the GDPR are to be understood as references to the FADP insofar as the data transfers are subject to the FADP. (iii) Until the revised Swiss Data Protection Act (rev. FADP) enters into force, the provisions of these Standard Contractual Clauses and all Exhibits also protect any Customer Personal Data to the extent that these provisions are applicable to them under Applicable Swiss Laws.

Where the Restricted Transfer concerns Customer Personal Data originating from the UK, the Standard Contractual Clauses will apply subject to the conditions set out by the United Kingdom Information Commissioner Office’s (“ICO”) International Data Transfer Addendum to the Standard Contractual Clauses that shall be incorporated herein by reference. The Parties acknowledge and agree that this DPA and the Exhibits A to E (i) provide the information needed and required by the ICO for completing Part One of the International Data Transfer Addendum, and (ii) shall be governed by the laws and courts of England and Wales (Clauses 17 and 18 of the Standard Contractual Clauses) for completing Part Two of the International Data Transfer Addendum.

Where the Restricted Transfer concerns Customer Personal Data originating from Argentina, the standard contractual clauses made under Regulation No. 60-E/2016 will be incorporated into this DPA by reference and shall apply to the extent required under Applicable Laws and where this DPA does not provide adequate safeguards.

Where the Restricted Transfer concerns Customer Personal Data originating from another jurisdiction requiring certain privacy safeguards, standard contractual clauses, or any other contractual privacy provisions, not provided through this DPA:

the Standard Contractual Clauses will be incorporated into this DPA by reference and shall apply to the extent required under Applicable Laws and where this DPA does not provide adequate safeguards. For the avoidance of any doubt, by applying the Standard Contractual Clauses in this event, the Parties do not intend to grant third-party beneficiary rights to Data Subjects under the Standard Contractual Clauses when Data Subjects concerned would not otherwise benefit from such rights under the Applicable Laws or this DPA; and

Customer represents and warrants that it has given all notices to, and obtained all consents, authorisations and approvals from, Data Subjects and any other person or authority necessary under Applicable Laws to permit Airlock Digital (and any Subprocessor) to Process, and where relevant transfer, Customer Personal Data as contemplated by the Agreement and this DPA, and that it will maintain such notices, consents, authorisations and approvals for as long as Airlock Digital Processes Customer Personal Data under the Agreement.

The Parties to this DPA hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims arising under this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity. Where, in line with section 11 of this DPA the Standard Contractual Clauses apply, and it is required under Applicable Laws, for disputes arising the governing law and jurisdiction are stipulated in Clause 17 of the Standard Contractual Clauses.

Any conflict between the terms of the Agreement and this DPA related to the processing of Customer Personal Data are resolved in the following order of priority:

the Standard Contractual Clauses (where applicable and materially affecting the adequacy of the Restricted Transfer);

this DPA;

the Agreement.

For the avoidance of doubt, provisions in this DPA, that merely go beyond the Standard Contractual Clauses without contradicting them, shall remain valid. The same applies to conflicts between this DPA and the Agreement where this DPA shall only prevail regarding the Parties’ Personal Data protection obligations.

Should any provision of this DPA be invalid or unenforceable then the remainder of this DPA shall remain valid and in force and the invalid or unenforceable provision shall be either:

amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, should this not be possible; or

construed in a manner as if the invalid or unenforceable part had never been contained therein.

For the avoidance of doubt, by applying the provisions of this DPA, the Parties do not intend to grant third-party beneficiary rights to Data Subjects under the DPA when those Data Subjects would not otherwise benefit from such rights under the Applicable Laws.

Unless required by Applicable Laws, Customer shall exercise any right or seek any remedy on behalf of itself, its Affiliates, and any other Controller that Customer instructs Airlock Digital to process Customer Personal Data for under this DPA (collectively, the “Customer Parties”).

Customer shall exercise any such rights or seek any such remedies in a combined manner for all Customer Parties together, rather than separately for each entity individually.

To the maximum extent allowed by Applicable Laws, the limitations of liability and any exclusions of damages set forth in the Agreement govern the aggregate liability for all Customer Parties’ claims arising out of or related to this DPA, and/or the Agreement against Airlock Digital and any Airlock Digital Affiliate(s).

These limitations of liability and exclusions of damages apply to all claims, whether arising under contract, tort or any other theory of liability, and any reference to the liability of Airlock Digital means the aggregate liability of Airlock Digital and all Airlock Digital Affiliates together for claims by Customer and all other Customer Parties.

To the extent required by Applicable Laws:

this section is not intended to modify or limit the Parties’ liability for Data Subject claims made against a Party where there is joint and several liability, or

limit either Party's responsibility to pay penalties imposed on such Party by a regulatory authority.

sell or share Customer Personal Data;

retain, use, or disclose Customer Personal Data for any purpose other than the specific business purposes set out in the Agreement, except as permitted under the applicable US Privacy Law;

retain, use, or disclose Customer Personal Data outside the direct business relationship between Airlock Digital and Customer except as permitted under the applicable US Privacy Law; or

combine Customer Personal Data with personal information Airlock Digital receives from or on behalf of another party, except as permitted under the applicable US Privacy Law, including to detect security incidents, protect against fraudulent or illegal activity, or as otherwise directed by Customer.