MATTR Data Processing Agreement

Definitions. The following terms have the meanings set out below.

Agreement means the agreement between you and us in respect of our provision of Services and/or Materials to you, including the Customer Agreement and all Order Forms, Service Terms and other documents incorporated into that agreement.

Applicable Data Protection Laws means any data protection or privacy laws and regulations anywhere in the world that apply to the Personal Data Processed under the Agreement including, as and where applicable, (i) the Privacy Act 2020 (NZ); (ii) the Privacy Act 1988 (Cth) (Australia); (iii) the EU GDPR; (iv) the UK GDPR; (v) the Swiss DPA; (vi) the EU e-Privacy Directive (Directive 2002/58/EC) and applicable national implementations; (vii) the CCPA and other comprehensive United States state privacy laws; and (viii) any consolidation, re-enactment or replacement of, or legislation of equivalent purpose or effect to, any of the above, together with any orders, guidelines, codes and guidance issued under any of them;

CCPA means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations. “Business”, “Consumer”, “Sell”, “Service Provider” and “Share” have the meanings given to them in the CCPA;

Controller means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data (and includes a “business” or “agency” or equivalent term under Applicable Data Protection Laws);

Customer Agreement means the master contract terms in place between us that form part of the Agreement (in most cases separately identified as the Customer Agreement), excluding Order Forms and Service Terms;

Customer Personal Data means Personal Data that we Process as a Processor in connection with the provision of Services and/or Materials to you under the Agreement;

Customer Representative Information has the meaning given to it in the Customer Agreement;

Data Privacy Framework means the EU–U.S. Data Privacy Framework, the UK Extension to the EU–U.S. Data Privacy Framework and the Swiss–U.S. Data Privacy Framework operated by the U.S. Department of Commerce, as may be amended, superseded or replaced;

Data Subject means an identified or identifiable individual to whom Personal Data relates, being (as applicable) an End User, a Customer Representative, or any employee, contractor or agent of yours;

End Users has the meaning given to it in the Customer Agreement;

European Data means Customer Personal Data that is subject to European Data Protection Laws;

European Data Protection Laws means the EU GDPR, the UK GDPR, the Swiss DPA, the EU e-Privacy Directive (and applicable national implementations of each), in each case as amended, superseded or replaced;

EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation);

Personal Data means any information relating to a Data Subject that is “personal data”, “personal information”, “personally identifiable information” or an equivalent term as defined under, and to the extent it is protected by, Applicable Data Protection Laws;

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by us or a Sub-processor. In respect of Customer Personal Data subject to the Privacy Act 2020 (NZ), a Personal Data Breach includes an action that prevents us or a Sub-processor from accessing the information on either a temporary or permanent basis. Except as specified above, a Personal Data Breach does not include an unsuccessful attempt or activity that does not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems;

Privacy Policy means the privacy policy located on the mattr.global or learn.mattr.global website (and/or any successor sites), as updated from time to time;

Process, Processed and Processing mean any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Processor means a natural or legal person which Processes Personal Data on behalf of a Controller (and includes a “processor”, “agent”, “service provider” or equivalent term under Applicable Data Protection Laws);

Regulator means a data protection supervisory or enforcement authority with jurisdiction over a party’s Processing of Personal Data;

Restricted Transfer means a transfer of European Data to a country or recipient that is not recognised under the applicable European Data Protection Laws as ensuring an adequate level of protection for Personal Data, where that transfer would be unlawful absent an appropriate safeguard or transfer mechanism;

Standard Contractual Clauses means the standard contractual clauses for the transfer of personal data to third countries under the EU GDPR and the UK GDPR set out in Annex 4 ;

Sub-processor means any Processor engaged by us or a MATTR Affiliate to Process Customer Personal Data in connection with the Agreement. For the purposes of this DPA, a Sub-processor does not include a third party that processes only Your Content excluding Customer Personal Data, an individual member of our Personnel or a third party engaged by us to Process Personal Data where we are acting as a Controller;

Sub-processor Page means the website specified in Annex 3 of this DPA;

Swiss DPA means the Switzerland Federal Act on Data Protection;

UK GDPR has the meaning given to it in section 3 of the Data Protection Act 2018 (UK).

“we”, “us”, “our” or “MATTR” means the applicable MATTR contracting entity as specified in the Agreement;

“you” or “your” means the entity entering into the Agreement with us, as specified in that Agreement.

Interpretation. The rules of interpretation in the Customer Agreement apply to this DPA. A reference to a clause or Annex is to a clause or Annex of this DPA unless otherwise stated. Any conflict or inconsistency between this DPA and the other terms of the Agreement will be resolved in accordance with the order of priority set out in the Customer Agreement. Capitalised terms used but not defined in this DPA have the meanings given to them in the Customer Agreement.

Roles of the parties. In respect of Customer Personal Data, you are the Controller (or a Processor acting on behalf of another Controller) and we are the Processor. Where you are a Processor acting on behalf of a third-party Controller, you warrant that you are authorised to give the instructions and grant the rights and authorisations set out in this DPA on that Controller’s behalf.

Scope. The Processor obligations in clauses 3 to 13 apply to all situations where we Process Customer Personal Data as a Processor anywhere in the world in connection with the provision of Services and/or Materials. They are intended to support compliance with all Applicable Data Protection Laws, including in respect of any cross border transfers that may be involved.

MATTR as Controller. This clause 2.3 applies (instead of clauses 3 to 13) where we Process Personal Data as a Controller rather than as a Processor. We act as a Controller when we use Personal Data: (1) to comply with our legal obligations; (2) to administer and manage our relationship with you, including customer relationship and opportunity management, communications with you, and operational administration and support, including most processing of Customer Representative Information; (3) for billing, invoicing and collecting payment; (4) providing access to licensed software (e.g. SDKs) via repositories or package managers; (5) to monitor, prevent, detect and mitigate fraud, security risks, violations of our policies and terms, financial loss and other harms; and (6) as otherwise set out in our Privacy Policy. We are responsible for Processing such Personal Data in accordance with Applicable Data Protection Laws and as set out in our Privacy Policy.

Processing on your instructions. The parties agree that this DPA and the Agreement (including you providing instructions via configuration tools, management consoles or APIs made available by us as part of the Services) constitute your documented instructions regarding our Processing of Customer Personal Data. Except where and to the extent otherwise required by a law to which we are subject, we will Process Customer Personal Data only in accordance with those documented instructions (which if you are acting as a Processor may be based on the instructions of your Controllers). Additional instructions outside the scope of, or inconsistent with, those documented instructions require prior written agreement between the parties, including on any additional Fees.

Conflict of laws. Taking into account the nature of the Processing, you agree that it is unlikely that we will be able to form an opinion on whether your documented instructions infringe applicable laws. If we do become aware that we cannot Process Customer Personal Data in accordance with your instructions due to a legal requirement to which we are subject, we will (i) promptly notify you of that legal requirement, to the extent permitted by law; and (ii) where necessary, cease all Processing (other than storing and maintaining the security of the affected Customer Personal Data) until you issue new instructions with which we are able to comply. We will not be liable for any failure to perform the affected Services during that period.

Restrictions on Processing. Except as set out in the Agreement, this DPA or as otherwise instructed by you, we will not Process Customer Personal Data for our own purposes.

Confidentiality of personnel. We will ensure that any of our Personnel authorised to Process Customer Personal Data are subject to appropriate obligations of confidentiality, whether a contractual or statutory duty, are made aware of the confidential nature of the Customer Personal Data and receive training on protecting Customer Personal Data.

Confidentiality and government demands. We will not access, use or disclose Customer Personal Data except as necessary to maintain or provide the Services and/or Materials, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a production order, subpoena or other court order). If a governmental body sends us a demand for Customer Personal Data, we will attempt to redirect the governmental body to request that data directly from you, and may provide your basic contact information for that purpose. If we are compelled to disclose Customer Personal Data to a governmental body, we will give you reasonable prior notice of the demand to allow you to seek a protective order or other remedy, unless we are legally prohibited from doing so.

Assistance. Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance to you (chargeable at our standard rates, other than where the assistance arises from our breach) to enable you to comply with your obligations under Applicable Data Protection Laws in relation to security, Personal Data Breach notification, data protection impact assessments, prior consultation with a Regulator, and responding to Data Subject Requests, in each case to the extent you are unable to address the matter yourself through the Services.

Security measures. We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breaches, as described in Annex 2 and consistent with our information security obligations under the Customer Agreement. We may update those measures from time to time provided that the updates do not result in a material degradation of the protection they provide.

Your security responsibilities. You are responsible for independently determining whether the security of the Services and/or Materials meets your obligations under Applicable Data Protection Laws, and for your own secure configuration and use of the Services and/or Materials, including protecting Personal Data in transit to and from the Services and/or Materials and maintaining appropriate backups.

Notification. If we think there has been a Personal Data Breach, we will let you know promptly and in any event within 48 hours (provided that in respect of a Personal Data Breach involving a Sub-Processor, the 48 hours will only commence on notification to us by the Sub-Processor, rather than the time the Sub-Processor itself became aware of it) and endeavour to give you information about what happened. Depending on the nature of the unauthorised access or disclosure, and the location of those affected, you (or if you are a Processor, the applicable Controller) may be required to assess whether the unauthorised access or disclosure must be reported to the Data Subjects and/or any Regulators. We will rely on you to make this decision, because you will have the most knowledge about the Customer Personal Data that may be affected.

Information and assistance. We will provide you with such information about the Personal Data Breach as we are reasonably able to disclose (taking into account the nature of the Processing, the information available to us and any confidentiality or legal constraints), and reasonable assistance, to enable you (or the applicable Controller) to meet any obligation to notify a Regulator or affected Data Subjects. You are responsible for determining whether any such notification is required and for making it.

No admission. Our notification of, or response to, a Personal Data Breach is not an acknowledgement by us of any fault or liability.

Self-service. Our Services provide you with controls that you can use to retrieve, correct, delete, restrict or export Customer Personal Data, which you can use to assist you in responding to requests from Data Subjects seeking to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”).

Assistance. To the extent you are unable to address a Data Subject Request through the Services, we will, on your written request, provide reasonable assistance (at our standard rates) to enable you to respond. If a Data Subject Request is made directly to us, we will promptly inform you and will advise the Data Subject to submit the request to you. You are solely responsible for responding to Data Subject Requests.

General authorisation. You provide a general authorisation for us to engage Sub-processors to Process Customer Personal Data on your behalf. You can find more detail about our current Sub-processors on the Sub-processor Page, as updated from time to time. This clause 7 applies only to the third parties listed under the “Data Sub-processors” heading on the Sub-processor page. For clarity, this clause 7 and our related notification and flow-down commitments do not apply to third parties that process only other data that does not constitute Customer Personal Data (who may nevertheless be listed on the Sub-processor Page), or to the third parties listed as “MATTR Service Providers” (which are addressed in clause 7.4).

Notice and objection. Except where required to resolve an urgent security incident or to urgently ensure the continued availability of the Services and/or Materials, we will give you at least 30 days’ notice (by updating the Sub-processor Page and, where you have subscribed, by email) before a new Sub-processor that Processes Customer Personal Data begins that Processing. If, within 15 days of that notice, you object on reasonable grounds relating to the protection of Customer Personal Data, the parties will discuss your concerns in good faith and work to reach a commercially reasonable resolution.

Flow-down and responsibility. Where we engage a Sub-processor to Process Customer Personal Data, we will enter into a written agreement with the Sub-processor imposing obligations providing a broadly equivalent level of protection for Customer Personal Data as those in this DPA, to the extent applicable to the nature of the services provided by the Sub-processor. We will restrict each Sub-processor’s access to Customer Personal Data to what is necessary to provide the Services and/or Materials, and remain responsible for each Sub-processor’s compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause us to breach this DPA.

Third parties engaged where we are a Controller. The third parties listed under the heading “MATTR Service Providers” on the Sub-processor Page support our own Processing of Personal Data as a Controller under clause 2.3 (for example, our customer relationship and opportunity management, communications with you, and billing and invoicing). They are not Sub-processors for the purposes of this clause 7, and our engagement of them is governed by clause 2.3 and our Privacy Policy rather than by the notification, objection and flow-down provisions of this clause 7.

Information and certifications. We will make available to you, on written request and subject to appropriate confidentiality obligations, the information reasonably necessary to demonstrate our compliance with this DPA, including summaries of relevant independent certifications, audit reports (such as SOC 2 or ISO 27001, or substantially equivalent reports) and the results of third party security testing.

Our Audits. We will carry out external audits of our security measures used to protect Personal Data at least annually by independent third party security professionals. We will carry out these audits at our cost and generate an audit report in respect of the findings.

Your Audit rights. You choose to conduct any audit, including any inspection, you have the right to request or mandate on your own behalf and on behalf of your Controllers when you are acting as a Processor, under Applicable Data Protection Laws or the Standard Contractual Clauses, by instructing us to carry out the audit described in this clause 8. If you wish to change this instruction regarding the audit, then you have the right to request this by notifying us in writing and we will agree with you any alternative audit arrangements.

Compliance. As between the parties, the way you collect Customer Personal Data prior to disclosing it to us and the way you choose to configure and use our Services and/or Materials in respect of Customer Personal Data is your responsibility. You are responsible for complying with all requirements that apply to you under Applicable Data Protection Laws in respect of your Processing of Personal Data and your instructions to us. You are solely responsible for: (i) the accuracy, quality and legality of Customer Personal Data and the means by which you acquired that data; (ii) complying with all transparency, lawful basis and consent requirements under Applicable Data Protection Laws for the collection and use of Customer Personal Data, including providing all required notices to, obtaining all required consents from and providing opt-outs to, Data Subjects; and (iii) ensuring you have the right to disclose, transfer, or provide access to, Customer Personal Data to us for Processing under the Agreement. You must ensure you comply with these responsibilities in respect of all End Users.

Process for compliance to specific laws. We will expressly agree with you in an Order Form under the Agreement if you or any of your End Users may provide to us: (i) European Data; (ii) “protected health information” pursuant to HIPAA; or (iii) credit card information or other data which requires PCI DSS compliance. Any such Order Form will include a privacy impact assessment in respect of the proposed Processing and detail any additional compliance steps to be taken to provide the Services and/or Materials pursuant to such laws or standards. Except to the extent agreed in an Order Form, you will not provide any such information to us for Processing in connection with the Agreement.

Warranties. You warrant that (i) the law applicable to you does not prevent us from fulfilling your instructions or performing our obligations under this DPA or the Agreement; and (ii) you have complied and will continue to comply with Applicable Data Protection Laws, including that you have obtained all necessary consents, given all necessary notices and provided all required opt-outs, and otherwise have a lawful basis, to disclose Personal Data to us and to enable the Processing described in this DPA and the Agreement.

Lawfulness of your instructions. You will not, by instruction or otherwise, require us to Process Personal Data in a manner that breaches Applicable Data Protection Laws, and will inform us without undue delay if you are unable to comply with your obligations under this clause 10 or under Applicable Data Protection Laws.

Global Processing. You acknowledge and agree that we may access and Process Customer Personal Data in the Region and other locations specified in the Agreement, including access by our Personnel in New Zealand and Australia, and other locations where MATTR Affiliates and Sub-processors operate.

Adequate safeguards. Wherever Customer Personal Data is transferred outside the Region specified in the Agreement, we will put in place appropriate safeguards in respect of that transfer, including by applying the security measures in Annex 2, complying with clause 7 in respect of Sub-processors, and adhering to the data minimisation obligations under the Customer Agreement. This clause 11 states the baseline that applies to all transfers; clause 12 applies additionally to Restricted Transfers of European Data.

Scope. This clause 12 applies only to European Data that we Process on your behalf where we have expressly agreed with you in an Order Form that we will accept such European Data for Processing.

Roles. When Processing European Data in accordance with your instructions, you are the Controller (or a Processor acting on behalf of another Controller) and we are the Processor. If we believe that an instruction infringes European Data Protection Laws, we will inform you without undue delay.

Transfer of European Data. We will not carry out a Restricted Transfer of European Data unless we have first ensured that the transfer is subject to an appropriate safeguard or transfer mechanism recognised under European Data Protection Laws. The parties will rely on the following mechanisms, in the following order of preference:

1. Adequacy. where the recipient is located in a country or territory recognised by the relevant authority as ensuring an adequate level of protection (for example, access by our Personnel from New Zealand, which benefits from a European Commission adequacy decision), the transfer will be made in reliance on that adequacy recognition;

2. Data Privacy Framework. where the recipient (for example, a US-based Sub-processor) is certified under, and the transfer is within the scope of, the Data Privacy Framework, the transfer will be made in reliance on that certification for so long as it remains valid; and

3. Standard Contractual Clauses. where neither paragraph (a) nor paragraph (b) applies to a Restricted Transfer, the parties will put in place the Standard Contractual Clauses in accordance with clause 12.4.

Standard Contractual Clauses. The Standard Contractual Clauses only apply to the extent separately signed by both parties using the form at Annex 4. The Standard Contractual Clauses may be signed by both parties to apply to a Restricted Transfer at any point after the date of this DPA.

Operation of the Standard Contractual Clauses. When executed under clause 12.4, the Standard Contractual Clauses will apply as follows: (i) Module Two (Controller to Processor) applies where you are a Controller, and Module Three (Processor to Processor) applies where you are a Processor; (ii) in Clause 7, the optional docking clause applies; (iii) in Clause 9, Option 2 (general written authorisation) applies, and changes to Sub-processors will be notified in accordance with clause 7 of this DPA with a time period of “at least 30 days”; (iv) in Clause 11, the optional independent dispute-resolution language does not apply; (v) in Clauses 17 and 18, the governing law and forum will be those of the Republic of Ireland unless the parties agree otherwise or European Data Protection Laws require another EU/EEA jurisdiction; (vi) the Annexes to the Standard Contractual Clauses are completed with the information in Annexes 1 to 3; and (vii) in relation to European Data subject to the UK GDPR or the Swiss DPA, the Standard Contractual Clauses apply as modified by the UK Addendum or for Switzerland (as applicable).

Scope and roles. This clause 13 applies only to Customer Personal Data that is subject to the CCPA. For that data, you are a Business and we are a Service Provider.

Service Provider commitments. We will Process such Customer Personal Data only to provide the Services and/or Materials under the Agreement (the “business purpose”) or as otherwise permitted by the CCPA. We will not (i) Sell or Share the Personal Data; (ii) retain, use or disclose it for any purpose other than the business purpose, or outside the direct business relationship between the parties, unless permitted by the CCPA; or (iii) combine it with Personal Data received from another source, except as permitted by the CCPA. We will comply with the obligations applicable to us as a Service Provider under the CCPA and provide the same level of protection for the Personal Data as the CCPA requires.

Changes. We may update this DPA from time to time in accordance with the process for changes to the DPA in the Agreement.

Liability. Each party’s liability arising out of or in connection with this DPA (including the Standard Contractual Clauses) is subject to, and counts towards, the limitations and exclusions of liability under the Agreement.

Governing law. This DPA is governed by the laws of New Zealand and the dispute resolution provisions of the Agreement apply to it, except where Applicable Data Protection Laws require otherwise, or where the Standard Contractual Clauses (once executed) specify a different governing law and forum for the Restricted Transfer to which they apply.

Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions will continue in full force and effect.