Data Protection Agreement (DPA)

The purpose of this Vates Data Processing Agreement (the "DPA") is to define the conditions under which VATES undertakes, in its capacity as Processor, to carry out Personal Data processing operations on behalf of the Customer in connection with the Subscription Services governed by the Vates VMS Subscription Terms (the "Terms"). This DPA is incorporated by reference into the Terms. It applies only to Processing for which VATES acts as Processor on behalf of Customer. It does not apply to Processing for which VATES acts as an independent Controller, as identified in Section 10 of the Terms.

1. Definitions

For the purposes of this DPA and notwithstanding any other definition provided for in the Terms, the following capitalised terms, whether used in the singular or plural, shall have the following meaning:

“Personal Data Protection Regulations”: the laws and regulations in force within the European Union, the European Economic Area and their Member States relating to the processing of Personal Data, including French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended from time to time (the “French Data Protection Act”), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or the “GDPR”).

“Personal Data”: any information relating to an identified or identifiable natural person, i.e. a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Terms relating to the protection of Personal Data that are not defined in this DPA or the Terms, including “Data Subject”, “Controller”, “Processor”, “Processing” and “Personal Data Breach”, shall have the meaning given to them by the GDPR, in particular Article 4 thereof.

2. Description of the Processing

In connection with the performance of the Terms and the applicable Order, VATES processes, as Processor, the Personal Data transmitted or otherwise made accessible by the Customer strictly for the purposes of providing Support Services and Maintenance Services in connection with a Support ticket ("Customer Personal Data").

Such Personal Data may include:

• Personal Data transmitted by the Customer’s Support Contacts when opening or managing a Ticket via the Support System, including through a dedicated support email address, including surname, first name, professional e-mail address and Ticket content; and

• where the Customer expressly requests and enables remote access through the Xen Orchestra support tunnel or another access method agreed for the relevant Ticket, Personal Data which may be contained in or accessible through the infrastructure components to which the Customer grants VATES access, including hosts, virtual machines, system logs, metadata, backups or other infrastructure components.

Any remote access by VATES shall be initiated, enabled or expressly authorized by the Customer for the relevant Ticket and shall be limited to the systems, resources and scope of access made available by the Customer. VATES shall access and process Personal Data made available through such remote access only to the extent necessary for the diagnosis, investigation and resolution of the relevant support or maintenance request and in accordance with the Customer’s documented instructions. Customer may refuse or withdraw remote access in accordance with the Terms and Support Policy.

Depending on the systems and resources made accessible by the Customer, the Personal Data concerned may relate to the Customer’s personnel, users, customers or other Data Subjects whose Personal Data are processed within the Customer’s infrastructure.

Such Personal Data are processed solely for the purposes of managing, investigating and resolving support and maintenance requests, for the duration necessary for the relevant support operations and otherwise in accordance with the retention periods provided for in the Terms and this DPA. Personal Data contained in Support Tickets are retained for the duration of the commercial relationship between VATES and Customer, and are then deleted or anonymized within twelve (12) months after the end of that relationship, except to the extent continued retention is necessary for security, compliance with a legal obligation, or the establishment, exercise or defense of legal claims. Where technically feasible, VATES will also delete or anonymize such Personal Data upon Customer’s documented request, subject to the same exceptions.

The performance of the Terms and the applicable Order, together with the Customer’s instructions provided in connection with a Ticket or the activation and configuration of the Xen Orchestra support tunnel or another authorized access method, constitutes the documented instructions of the Customer for the purposes of this Processing.

3. Obligations of Vates towards the Customer

VATES undertakes to:

• process Personal Data only for the purpose covered by the processing subcontracted to it;

• process Personal Data in accordance with the documented instructions of the Customer as defined in this DPA. If VATES considers that an instruction constitutes a breach of the GDPR or of any other provision of Union or Member State law relating to the protection of Personal Data, it shall immediately inform the Customer. If VATES is required, by Union law or the law of the Member State to which it is subject to Process Personal Data otherwise than on Customer’s documented instructions, VATES undertakes to inform the Customer thereof before the Processing, unless such law prohibits such information on important grounds of public interest;**

• guarantee the confidentiality of Personal Data processed under the Terms;

• ensure that persons authorized to process Personal Data under the Terms (i) undertake to respect the confidentiality of Personal Data or are subject to an appropriate statutory obligation of confidentiality, and (ii) receive the necessary training in Personal Data management;

• take into account, as regards its tools, products, applications or services, the principles of data protection by design and by default;

• keep the register required under Article 30 of the GDPR where applicable.

4. Subsequent subprocessing

The Customer authorises VATES to engage another processor (hereinafter, the “subprocessor”) to carry out specific Processing activities. The list of VATES’ subprocessors shall be provided to Customer upon request. VATES undertakes to inform the Customer of any intended change concerning the addition or replacement of subprocessors at least thirty (30) calendar days before the change takes effect, where reasonably possible. Customer shall have that notice period to submit its reasonable and legitimate objections in writing. The Customer acknowledges and accepts that the absence of objection within this period shall be deemed acceptance by the Customer of the subprocessor. In the event of an objection, VATES may respond to the Customer by providing information likely to address such objections. If the Customer maintains its objections, the Parties undertake to meet and discuss in good faith a reasonable solution. If no reasonable solution is available, Customer may terminate the affected Subscription Services before the subprocessor begins the relevant Processing, and VATES will provide the Purchasing Party with any prorated refund due under Section 14 of the Terms.

VATES shall impose on each subprocessor, by written agreement, data-protection obligations no less protective than the obligations applicable to VATES under this DPA, to the extent relevant to the Processing entrusted to that subprocessor.

In any event, VATES shall remain liable to the Customer for the proper performance of the applicable data-protection obligations by its subprocessors.

5. Notification of Personal Data breaches

VATES undertakes to notify the Customer of any Personal Data Breach under the Terms without undue delay after becoming aware of it, by e-mail to the Customer’s DPO or privacy contact identified in an Order or, failing that, to the main contractual contact designated in the applicable Order.

Such notification shall be accompanied by any useful documentation and information reasonably available to VATES to enable the Customer, where necessary, to notify such Personal Data Breach to the competent supervisory authority and to the Data Subjects. Where all information cannot be provided at the same time, it shall be provided to the Customer in phases, as and when it becomes reasonably available.

6. Exercise of Data Subjects’ rights

As far as possible and taking into account the nature of the Processing, VATES undertakes to assist the Customer in fulfilling its obligations to provide Data Subjects with the information required by the GDPR when they exercise their rights.

In the event that Data Subjects submit requests to exercise their rights to VATES, VATES shall forward such requests without undue delay by e-mail to the Customer’s DPO or privacy contact identified in an Order or, failing that, to the main contractual contact designated in the applicable Order. Customer remains responsible for responding to the request.

Reasonable assistance customarily required for the Subscription Services is included. Where a request requires exceptional work outside that scope, VATES may propose Professional Services, but will not charge Customer without Customer’s prior written agreement.

7. Security measures

VATES undertakes to implement and maintain technical and organizational measures taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, as well as the risks, the likelihood and severity of which vary, for the rights and freedoms of natural persons. Those measures include, as appropriate to the relevant Processing, access restricted to authorized personnel, appropriate authentication controls, protection of data in transit and relevant access or security logging. The measures may evolve over time, provided that the overall level of protection is not materially reduced.

Where remote access to the Customer’s infrastructure is provided through the Xen Orchestra support tunnel or another method authorized for a Ticket, VATES shall implement appropriate technical and organizational measures designed to ensure that such access is restricted to authorized personnel and used only for the purposes and within the scope authorized by the Customer.

8. Impact assessments

As far as possible and taking into account the nature of the Processing, VATES undertakes to assist the Customer in carrying out data protection impact assessments relating to the Processing carried out under the Terms and, where required by Article 36 of the GDPR, in prior consultations with the competent supervisory authority. For the avoidance of any doubt, it is recalled that VATES is not responsible for carrying out and/or updating the Customer’s impact assessment. Reasonable assistance customarily required for the Subscription Services is included. Exceptional work may be proposed as Professional Services, but will not be charged without Customer’s prior written agreement.

9. Transfer of Personal Data outside the European Economic Area subject to appropriate safeguards

Customer authorizes VATES to Process Customer Personal Data from countries in which VATES, its Affiliates or its authorized subprocessors provide Support Services, subject to this Section. Customer may give a documented contrary instruction where it is reasonable and technically feasible. If such an instruction restricts VATES’ ability to provide Support, the consequences stated in the Terms and Support Policy for Customer dependencies apply.

In the event of a transfer of Personal Data outside the EEA that is not covered by an adequacy decision of the European Commission pursuant to Article 45 of the GDPR, VATES undertakes to govern such transfer by means of appropriate safeguards within the meaning of Article 46 of the GDPR, including by entering into standard contractual clauses adopted by the European Commission, and to ensure a level of protection equivalent to European requirements.

10. Compliance; audit

The Customer shall first request in writing the information reasonably necessary to verify VATES' compliance with its obligations under this DPA. An audit may be requested only where the information provided by VATES is reasonably insufficient, and the Customer has identified in writing the specific concerns justifying further verification.

Except in the event of a documented material compliance concern, an imminent risk to the security of Personal Data, or a binding requirement of a competent supervisory authority, no more than one audit may be conducted in any rolling twelve (12) months period. The Customer shall give VATES at least thirty (30) Business Days' prior written notice, specifying the purpose, scope, methodology, proposed date and identity of the auditor. This notice period may be shortened where reasonably justified by urgency.

Audits shall primarily be conducted remotely and through documentary review. On-site inspections shall be permitted only where reasonably necessary and shall normally be limited to one (1) Business Day. All audits shall be strictly limited to VATES' Processing activities under this DPA, conducted during normal business hours without undue disruption, and subject to appropriate security and confidentiality safeguards. The auditor shall be suitably qualified, subject to a written confidentiality undertaking, and, if appointed externally, independent and neither a competitor of VATES nor subject to a conflict of interest. Penetration testing, vulnerability scanning and direct access to production systems shall require VATES' prior approval of appropriate security arrangements, without prejudice to any necessary alternative verification measures.

The Customer shall bear its own audit costs, including the auditor's fees. VATES shall provide reasonable assistance up to one (1) man-day without charge per ordinary audit. Additional assistance may be invoiced at VATES' standard professional services rates, provided such charges remain reasonable and proportionate and do not prevent the exercise of statutory audit rights. Assistance required to verify remediation of a material breach attributable to VATES shall not be charged.

All audit findings and related information shall remain confidential, subject to legally required disclosures, and shall be communicated to VATES. Nothing herein shall restrict the Customer's rights under Article 28(3)(h) GDPR or the powers of competent supervisory authorities.

11. Return and deletion at the end of the Services

Upon expiry or termination of the Subscription Services involving the Processing, VATES will, at Customer’s choice and where technically feasible, return Customer Personal Data then held by VATES in a commonly usable form or delete or anonymise it, and will delete existing copies, unless Union or Member State law requires continued storage. Customer must communicate any request for return before the applicable deletion occurs. The specific retention period and exceptions applicable to Personal Data contained in Support Tickets remain governed by Section 2 of this DPA.

12. Priority and duration

This DPA remains in effect for as long as VATES Processes Customer Personal Data on Customer’s behalf. If this DPA conflicts with the Terms, an Order or other Applicable Documentation regarding the Processing of Customer Personal Data, this DPA prevails to the extent of that conflict.