Data Processing Addendum
How e6data processes Personal Data on behalf of customers: roles, sub-processors, security, breach notification, deletion and international transfers.
Visit the Trust CenterKey commitments
This Data Processing Addendum ("DPA") forms part of the Master Services Agreement or other written agreement between e6data, Inc. and Customer governing Customer's use of the Services (the "Agreement"), and applies to e6data's Processing of Personal Data on behalf of Customer in connection with the Services. Capitalized terms not defined here have the meanings given in the Agreement. For purposes of this DPA, "Services" means the Software and Services as defined in the Agreement.
Definitions
"Applicable Data Protection Laws" means all data protection and privacy laws applicable to Processing under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss data protection law, and the CCPA/CPRA.
"Controller", "Data Subject", "Personal Data", "Process", "Processing", and "Processor" have the meanings given under Applicable Data Protection Laws.
"Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by e6data or its Sub-processors.
"Sub-processor" means a Processor engaged by e6data to Process Personal Data on behalf of Customer.
"SCCs" means the European Commission Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced.
Processing of Personal Data
2.1 Roles. Customer is the Controller and e6data is the Processor with respect to Personal Data Processed by e6data on Customer's behalf. Schedule 2 describes the subject matter, duration, nature and purpose of Processing, categories of Data Subjects and types of Personal Data.
2.2 Instructions. e6data will Process Personal Data only on documented instructions from Customer, including the Agreement, this DPA, applicable Order Forms, Customer's configuration and use of the Services, and other written instructions agreed by the parties, unless Applicable Data Protection Laws require otherwise. e6data will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.
2.3 Customer Responsibilities. Customer is responsible for the lawfulness, accuracy and quality of Personal Data and for providing notices and obtaining rights, consents and authorizations required for e6data to Process Personal Data as contemplated by the Agreement and this DPA.
Data Subject Rights and Regulatory Assistance
3.1 e6data will, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject relating to Personal Data Processed on Customer's behalf and will not respond except on Customer's documented instructions or as required by law.
3.2 Taking into account the nature of Processing, e6data will provide reasonable assistance through appropriate technical and organizational measures to help Customer respond to Data Subject requests.
3.3 Upon reasonable request, e6data will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities where required by Applicable Data Protection Laws.
e6data Personnel
e6data will ensure personnel authorized to Process Personal Data are subject to appropriate confidentiality obligations, receive appropriate privacy and security training, and access Personal Data only to the extent necessary to provide and support the Services.
Sub-Processors
5.1 Customer provides general authorization for e6data to engage Sub-processors. e6data will impose written data protection obligations on each Sub-processor that are no less protective, in all material respects, than the obligations applicable to e6data under this DPA, to the extent relevant to the Sub-processor's services. e6data remains responsible for its Sub-processors' performance of those obligations.
5.2 e6data will maintain a current list of Sub-processors at the location identified in Schedule 1 and provide at least thirty (30) days' advance notice before authorizing a new Sub-processor to Process Personal Data, unless a shorter period is reasonably necessary for an urgent security or legal requirement.
5.3 Customer may object on reasonable data-protection grounds within thirty (30) days after notice. The parties will work in good faith to address the objection. If e6data cannot reasonably provide the affected Services without the objected-to Sub-processor, Customer may, upon written notice, terminate the affected Services and receive a pro-rata refund of prepaid Fees attributable to the unused terminated portion as the Customer's sole and exclusive remedy.
Security and Personal Data Breach
6.1 e6data will maintain appropriate technical and organizational measures designed to protect the security, confidentiality, integrity and availability of Personal Data, consistent with the security commitments in the Agreement and e6data's then-current security documentation. The measures may evolve provided the overall level of security is not materially decreased during a Subscription Period.
6.2 e6data will notify Customer without undue delay and in any event within forty-eight (48) hours after becoming aware of a Personal Data Breach. e6data will provide reasonably available information and material updates, reasonably cooperate with legally required investigation, notification and remediation, and will not notify regulators or Data Subjects in a manner identifying Customer without prior consultation unless required by law.
6.3 Upon reasonable request and subject to confidentiality obligations, e6data will make available its then-current SOC 2 Type II report and other current third-party assurance materials that it generally makes available to customers. Customer, its independent auditor and competent regulators may exercise audit and access rights reasonably necessary to verify compliance with Applicable Data Protection Laws. Any such audit must be requested with at least thirty (30) days' prior written notice, conducted during normal business hours and structured to prevent operational disruption to e6data. Customer audits will ordinarily be limited to once annually, except following a Personal Data Breach, where required by a regulator, or where there is reasonable evidence of material non-compliance. Audits are subject to reasonable scope, security, confidentiality, timing and cost protections.
Return and Deletion
Upon termination or expiration of the applicable Services, e6data will return or make available for export Personal Data where technically applicable and delete remaining Personal Data within sixty (60) days, except where retention is required by Applicable Laws. Customer acknowledges that Personal Data in archival or backup systems cannot be selectively deleted immediately and such backups will be isolated from further Processing and deleted in accordance with e6data's documented backup-retention cycle. Upon request, e6data will provide reasonable written confirmation of deletion.
International Data Transfers
8.1 e6data may Process Personal Data in the United States and other countries in which e6data or its Sub-processors operate, subject to Applicable Data Protection Laws.
8.2 Where the GDPR applies to a restricted transfer, the SCCs are incorporated. Module Two applies where Customer is a Controller and Module Three where Customer is a Processor. Clause 7 applies. Clause 9(a), Option 2 applies with the thirty (30) day notice period in Section 5.2. Optional Clause 11 does not apply. Ireland is selected for Clauses 17 and 18. Schedule 2 supplies Annex I, Schedule 3 supplies Annex II, and Schedule 1 supplies Annex III.
8.3 For transfers subject to the UK GDPR, the SCCs apply as modified by the then-current UK International Data Transfer Addendum issued by the UK Information Commissioner's Office. For transfers subject to Swiss data protection law, the SCCs apply with adaptations required by Swiss law.
8.4 If another lawful transfer mechanism becomes available and applies to a transfer, the parties may rely on that mechanism. The invalidity or unavailability of one transfer mechanism does not invalidate the remainder of this DPA.
CCPA / CPRA
To the extent the CCPA/CPRA or analogous U.S. state privacy laws apply, e6data acts as a service provider or contractor, as applicable. e6data will not sell or share Personal Information, retain, use or disclose it outside the direct business relationship with Customer, combine it with Personal Information from other sources except as permitted by applicable law, or Process it for purposes other than those specified in the Agreement and this DPA. e6data will promptly notify Customer if it determines it can no longer meet these obligations, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. e6data certifies that it understands and will comply with these restrictions.
Government Requests
If e6data receives a binding governmental or law-enforcement demand for Personal Data, e6data will, to the extent legally permitted, notify Customer, use reasonable efforts to redirect the requesting authority to Customer, challenge requests that e6data reasonably believes are unlawful or overbroad where appropriate, and disclose only the minimum Personal Data legally required.
Term and Survival
This DPA remains in effect for as long as e6data Processes Personal Data on behalf of Customer. Obligations concerning confidentiality, security, return/deletion, international transfers and liability survive for as long as e6data retains Personal Data or as required by Applicable Data Protection Laws.
Processing Locations
e6data will Process Personal Data only in the locations identified through its Sub-processor list or applicable Order Form. Any contractual data-residency commitment must be stated in the applicable Order Form.
Liability; Order of Precedence; Governing Law
13.1 Each party's liability arising out of or relating to this DPA is subject to the exclusions and limitations in the Agreement, including any applicable protected-claims super cap or aggregate liability cap set forth therein. In no event shall e6data be liable for any indirect, incidental, special, consequential, or punitive damages arising under or in connection with this DPA. Nothing in the Agreement or this DPA limits liability to Data Subjects or other liability to the extent it cannot lawfully be limited under Applicable Data Protection Laws or the SCCs.
13.2 If there is a conflict between this DPA and the Agreement regarding Processing of Personal Data, this DPA controls. If there is a conflict between this DPA and applicable SCCs or another mandatory transfer mechanism, that transfer mechanism controls to the extent of the conflict.
13.3 Except where Applicable Data Protection Laws or an applicable transfer mechanism require otherwise, the governing law, jurisdiction and dispute-resolution provisions of the Agreement apply to this DPA.
Sub-Processors
e6data maintains its current list of Sub-processors, including each Sub-processor's identity, processing function and processing location, at security.e6data.com. e6data will also provide the then-current list to Customer on request. The then-current list, as updated from time to time in accordance with Section 5, constitutes the agreed list of Sub-processors and serves as Annex III to the SCCs.
Details of Processing
Subject matter and purpose: Processing necessary to provide, operate, secure, support and troubleshoot the e6data query engine and related Services, including execution of Customer queries and workloads, authentication, orchestration, monitoring, cluster management and workspace functionality.
Duration: For the Subscription Period and any limited post-termination period required for return, export, backup expiration or legal retention.
Nature of Processing: Depending on Customer's deployment and configuration, e6data may access, transmit, retrieve, consult, use, organize, temporarily cache or otherwise Process Personal Data contained in Customer Data for query execution and support. The e6data control plane may Process operational metadata such as user/account identifiers, query text, notebook definitions, configurations, job status, usage metrics and error traces. The control plane does not persist the substantive contents of Customer Data. Transient processing and temporary display of query results do not result in persistent storage of the substantive contents of Customer Data in the Control Plane. Compute-plane processing may use memory, cache or ephemeral storage while workloads run; such data is not intended to persist beyond the applicable compute lifecycle, subject to Customer configuration and applicable infrastructure.
Categories of Data Subjects: Determined by Customer and may include Customer personnel and Users, and individuals whose Personal Data is contained in datasets submitted or made accessible by Customer.
Types of Personal Data: Determined by Customer and may include business contact information, user/account identifiers, device and usage information, query text and other Personal Data contained in Customer Data. Customer must not submit Prohibited Data or special-category/sensitive Personal Data unless expressly authorized under the Agreement.
Frequency: Continuous or as initiated by Customer and its Users during the Subscription Period.
Data exporter / importer: Data exporter: Customer and any Affiliate permitted to use the Services under the Agreement and that transfers Personal Data to e6data. Data importer: e6data, Inc.
Competent supervisory authority for the SCCs: The supervisory authority of the EU or EEA Member State in which the data exporter is established or, where the data exporter is not established in the EU or EEA, the supervisory authority of the Member State in which the data exporter's Article 27 representative is established, in each case as determined under Clause 13 of the SCCs.
Technical and Organizational Measures
e6data maintains administrative, physical and technical safeguards appropriate to the Services and risk, including access controls and least privilege, encryption in transit and at rest where applicable, network and environment segregation, logging and monitoring, vulnerability management, secure software-development practices, incident response, personnel confidentiality and security training, and business-continuity controls. The technical and organizational measures described in e6data's then-current security documentation made available at security.e6data.com are incorporated into this Schedule 3. e6data may update such measures from time to time, provided that the overall level of security is not materially decreased during the applicable Subscription Period.
Questions
e6data, Inc. — 355 Bryant Street, Suite 403, San Francisco, CA 94107 (USA). For any questions about this DPA, or to execute a countersigned copy, contact privacy@e6data.com.