Data Processing Addendum

This Data Processing Addendum (the “Addendum”) is an addendum to the Terms of Service (“Agreement”) between Dropbox, Inc., or Dropbox International Unlimited Company (as applicable, “DocSend”) and the DocSend customer that has executed or agreed to the Agreement (the “Customer”) for DocSend services (the “Services”).

This Addendum is incorporated into the Agreement and applies to the provision of the Services to the Customer if the Processing of Customer Personal Data (as defined below) is subject to the CCPA or the GDPR, only to the extent the Customer is a Business or Data Controller of Customer Personal Data and DocSend is a Service Provider or Data Processor. The Addendum is intended to satisfy the requirements of the CCPA and Article 28(3) of the GDPR. This Addendum shall be effective for the term of the Agreement.

1. Definitions

1.1. For the purposes of the Addendum:

1.1.1. “Business” shall have the meaning set forth in Section 1798.140(c) of the CCPA;

1.1.2. “CCPA” means the California Consumer Privacy Act of 2018;

1.1.3. “Customer Personal Data” means the Personal Data described under Section 2 of this Addendum, in respect of which the Customer is the Business or Data Controller;

1.1.4. “Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

1.1.5. “Data Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller;

1.1.6. “Data Protection Legislation” means the CCPA or the GDPR, as applicable, together with any national implementing laws in any Member State of the European Union or, to the extent applicable, in any other country, as amended, repealed, consolidated, or replaced from time to time;

1.1.7. “Data Subject” means the individual to whom Personal Data relates;

1.1.8. “Dropbox International” means Dropbox International Unlimited Company.

1.1.9. “EEA” means the European Economic Area;

1.1.10. “European Data” means Customer Personal Data that is subject to Data Protection Legislation in the EEA, United Kingdom, or Switzerland.

1.1.11. “GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

1.1.12. “Personal Data” shall have the meaning assigned to the terms “personal data” and/or “personal information” under applicable Data Protection Legislation;

1.1.13. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed;

1.1.14. “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. The terms “process”, “processes”, and “processed” will be construed accordingly;

1.1.13. “Security Incident” means any actual unauthorized disclosure of or access to Customer Data, or compromise of DocSend systems that DocSend determines is reasonably likely to result in such disclosure or access, caused by failure of DocSend’s security measures and excluding any unauthorized disclosure or access that is caused by Customer or its End Users, including Customer or its End Users’ failure to adequately secure equipment or accounts; and

1.1.14. “Service Provider” shall have the meaning set forth in Section 1798.140(v) of the CCPA.

1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

2. Details of the Processing

2.1. Types of Personal Data; Categories of Data Subjects. Customer Personal Data includes Personal Data contained in documents or other content shared, sent or otherwise transmitted by the Customer (and as appropriate Customer’s representatives, employees or other Data Subjects as elected by the Customer) on or through DocSend’s platform and Services, including names and email addresses of any recipients of such documents or other content, the extent of which is determined by the Customer in its sole discretion, and information about the interaction of recipients of documents with such documents or other content (including IP address, whether or not the document or other content has been viewed and when).

2.2. Subject-Matter and Nature of the Processing. The subject-matter of Processing of Customer Personal Data is the performance of the Services that involves the Processing of Customer Personal Data. The processing activities that will be performed by DocSend on behalf of Customer include analyzing, storing, and transmitting Data as necessary to deliver the Services pursuant to the Agreement.

2.3. Purpose of the Processing. Customer Personal Data will be processed by DocSend for purposes of providing the Services set out into the Agreement.

2.4. Duration of The Processing. Customer Personal Data will be processed for the duration of the Agreement, subject to Section 10 of this Addendum.

3. Processing of Customer Personal Data

3.1. Roles. The parties acknowledge and agree that Customer is the Business and/or Data Controller of Customer Personal Data and DocSend is the Service Provider and/or Data Processor of such Customer Personal Data.

3.2. Customer Instructions. The Agreement, this Addendum, and Customer’s use of the Services constitute Customer’s instructions to DocSend to Process Customer Personal Data. DocSend will use and Process Customer Data as Customer instructs in order to deliver the Services and to fulfill DocSend’s obligations under the Agreement and this Addendum. Notwithstanding the foregoing, Customer permits DocSend to collect and use usage data regarding Customer’s use of the Services for research and development, industry analysis, benchmarking, and analytics purposes, which data will be de-identified and/or aggregated and will not identify Customer or any users of the Services. DocSend will inform Customer of any legal requirement which prevents it from complying with Customer’s instructions, unless prohibited from doing so by applicable law or on important grounds of public interest. If DocSend cannot process Customer Personal Data in accordance with Customer’s instructions due to a legal requirement under any applicable law, DocSend will cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data). If this provision is invoked, DocSend will not be liable to the Customer under the Agreement for failure to perform the Services with respect to Processing activities relating to the affected Customer Personal Data.

3.3. Compliance with Laws. Each of the Customer and DocSend will comply with their respective obligations under the Data Protection Legislation. Customer represents and warrants that its instructions relating to the Processing of Customer Personal Data will comply with the applicable law and that Customer has provided any necessary notices to Data Subjects and has obtained or will obtain all lawful bases (including consents) and rights necessary for DocSend to process Customer Personal Data in accordance with this Addendum.

3.4. Data Transfers. Customer agrees that DocSend and its sub-processors may transfer, store, and Process Customer Personal Data in locations other than Customer’s country. In connection with the performance of the Agreement, Customer authorizes DocSend to transfer Customer Personal Data across international borders, including from the EEA, Switzerland, and/or the United Kingdom to the United States, in accordance with this Section 3.4.

3.4.1. Instructions. Customer hereby instructs Dropbox International to process European Data in accordance with this DPA to deliver the Services. Customer acknowledges that all communications with DocSend in connection with the processing of European Data will be coordinated and directed through Dropbox International.

3.4.2. Transfers. Customer acknowledges and agrees that, to provide the Services, Dropbox International may transfer European Data to DocSend and this transfer will be made pursuant to the Processor-to-Processor Standard Contractual Clauses between DocSend and Dropbox International, or an alternative transfer means recognized by the applicable Data Protection Legislation.

4. Confidentiality

4.1. DocSend will ensure that any person whom DocSend authorises to process Customer Personal Data on its behalf is subject to confidentiality obligations in respect of that Customer Personal Data.

5. Security Measures

5.1. DocSend will use commercially reasonable efforts to implement and maintain appropriate technical and organizational measures designed to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data, including encryption, measures to help ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services, restore timely availability and access to Customer Personal Data in the event of a physical or technical incident, and for regularly testing, assessing, and evaluating the effectiveness of the security measures.

6. Sub-Processing

6.1. Customer hereby grants DocSend general written authorization to engage sub-processors to carry out specific processing activities on behalf of Customer. Information about sub-processors currently engaged by DocSend is available at: https://www.docsend.com/sub-processors/ (as may be updated by DocSend from time to time in accordance with this Addendum). DocSend will enter into a written agreement with each sub-processor that imposes on the sub-processor substantially similar obligations that apply to DocSend under this Addendum. DocSend will remain liable for all acts or omissions of its Sub-processors in connection with the Agreement and this Addendum, and for any subcontracted obligations.

6.2. Before DocSend engages any new sub‐processor to carry out specific processing activities on behalf of Customer, DocSend will update the list of sub-processors. Customer has a right to object to new sub‐processor on reasonable grounds within 30 days of such change. If it does so, then DocSend may provide reasonable accommodations that Customer or DocSend may take to limit or prevent the objectionable sub-processor from processing the Customer Personal Data. If DocSend fails to respond to the objection as described above within thirty days of the objection or cannot reasonably accommodate Customer’s objection, either party may terminate the Agreement by providing written notice to the other party within thirty (30) days of the date DocSend was required to respond or the date on which DocSend informs Customer it cannot reasonably accommodate the objection.

7. Data Subject Rights

7.1. If DocSend receives any request from Data Subjects in relation to Customer Personal Data, DocSend will advise Data Subjects to submit their request to the Customer without undue delay upon verifying the request pertains to Customer Personal Data. DocSend shall not respond to such requests without Customer’s prior written consent and written instructions, except to the extent required by applicable laws. Customer shall be solely responsible for responding to any Data Subjects’ requests.

7.2. Taking into account the nature of the Processing, DocSend will assist the Customer by appropriate technical and organizational measures, insofar as this is possible and to the extent permitted by the law, for the fulfilment of the Customer’s obligation to respond to Data Subjects’ requests for the exercise of Data Subjects’ rights under the Data Protection Legislation.

8. Personal Data Breaches

8.1. DocSend will notify the Customer without undue delay as soon as practicable after it becomes aware of any Security Incident that results in a Personal Data Breach affecting any Customer Personal Data, so long as applicable law allows this notice. Without limiting the foregoing, DocSend may limit the scope of, or refrain from delivering, any disclosures to the extent reasonably necessary to avoid compromising the integrity of DocSend’s security, an ongoing investigation, or any DocSend customer’s or end user’s data. At the Customer’s request, DocSend will promptly provide the Customer with all reasonable assistance required under Data Protection Legislation to enable the Customer to notify the competent data protection authorities and/or affected Data Subjects of the Personal Data Breach, provided that Customer is required to do so under Data Protection Legislation. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breach.

9. Data Protection Impact Assessment; Prior Consultation; Security

9.1. To reasonably assist Customer with its obligations under the GDPR related to security, data protection impact assessments, and prior consultation with supervisory authorities, and solely to the extent that such assistance is necessary and relates to the Processing by DocSend of the Customer Personal Data, taking into account the nature of the Processing and the information available to DocSend, DocSend will make the following available during the Term: (a) DocSend’s SOC 2 Report; (b) the information contained in this Addendum and (c) any information available to Customer through the Services.

10. Return or Deletion of Customer Personal Data

10.1. Upon termination or expiration of the Agreement, DocSend will promptly delete or return (at Customer’s election, such election to be made within 10 calendar days of the expiration or termination of the Agreement) all Customer Personal Data in its possession or control, except if DocSend is required by applicable law to retain some or all of the Customer Personal Data (in which event DocSend shall isolate and protect the relevant Customer Personal Data from any further processing except to the extent required by such law). If Customer elects to require the Customer Personal Data be returned, return will be effected by Customer’s retrieving the Customer Personal Data from DocSend’s systems within 15 business days as of DocSend’s making such data available for retrieval. Once this period has expired Customer instructs DocSend to destroy all Customer Personal Data. If Customer makes no such election, DocSend will retain Customer Personal Data until the Customer elects to make the choice. DocSend agrees to preserve the confidentiality of any retained Customer Personal Data.

11. Inspections; Audits

11.1. DocSend has completed (and will continue to undergo) Service Organization Control 2 (SOC 2) Type II audits for the Services, which were conducted by an independent auditor that evaluated the design and effectiveness of DocSend security policies, procedures, and controls. Upon written request, DocSend will make available for review by Customer the then-current SOC 2 audit report (“SOC 2 Report”) to demonstrate compliance by DocSend with its obligations under this Addendum. The Report will constitute DocSend’s confidential information.

11.2. If Customer reasonably determines that information regarding DocSend’s compliance with the obligations set forth in this Addendum cannot be obtained by Customer through the SOC 2 Report, DocSend will use commercially reasonable efforts to respond to written questions by Customer regarding the SOC 2 Report and DocSend’s compliance with this Addendum.

11.3. If Customer reasonably believes additional information is required and Data Protection Legislation affords Customer with an audit right, DocSend will allow Customer or an independent auditor appointed by Customer, subject to appropriate confidentiality obligations, to conduct an audit or inspection to verify DocSend’s compliance with its obligations under this Addendum relating to Customer Personal Data, provided that such audit shall be carried out with reasonable notice during regular business hours not more often than once per year. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.

11.4. Following receipt by DocSend of a request under this Section 11, the parties will agree in advance on the security and confidentiality controls applicable to any such provision of information and documentation. For Customer inspections pursuant to Section 11.3, the Parties will first mutually agree on the scope, timing, and duration of the inspection. DocSend reserves the right to: (a) charge a separate fee for its reasonable costs associated with performing any of its obligations in Section 11.2 or 11.3, provided that DocSend will provide an estimate of these fees to Customer prior to incurring the costs; (b) limit the scope and duration of an inspection to the extent reasonably necessary to avoid compromising the integrity of DocSend security or any DocSend customer’s or end user’s data; and (c) object to any Customer representative participating in an inspection on the basis that they are not qualified, are not bound by an adequate requirement to protect confidential DocSend information, or are a competitor of DocSend.

12. Liability

12.1. The provisions of this Addendum notwithstanding, the total combined liability of each party towards the other party under or in connection with this Addendum will be subject to the limitation of liability set forth in the Agreement. Customer agrees that any regulatory penalties incurred by DocSend in relation to the Customer Personal Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this Addendum and the Data Protection Legislation shall count towards and reduce DocSend’s liability under the Agreement as if it were liability to the Customer under the Agreement.

12.2. Customer acknowledges that DocSend is reliant on the Customer for direction as to the extent to which DocSend is entitled to process Customer Personal Data on behalf of Customer in performance of the Services. Consequently, to the fullest extent permitted by applicable law, DocSend will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by DocSend, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable Data Protection Legislation.

13. General Provisions

13.1. Costs. DocSend may charge a reasonable fee for time spent in connection with any assistance or cooperation required by the Customer under this Addendum if such assistance or cooperation involves the commitment of significant resources over a prolonged period or significant third party costs and does not arise from any breach by DocSend of the Agreement or this Addendum.

13.2. Conflict. With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum or any of its Exhibits and the Agreement, the provisions of this Addendum shall prevail.