Hasura, Inc. Data Processing Addendum

• INTERPRETATION

  1. In this Data Processing Addendum, the following terms shall have the meanings set out in this Paragraph 1, unless expressly stated otherwise:
     1. “Addendum Effective Date” means the effective date of the Agreement.
     2. “Agreement” means the Hasura, Inc. Master Software and Services License Agreement available at https://hasura.io/legal/msa/ or other similar agreement entered into between Customer and Hasura governing Customer’s use of the Services.
     3. “Applicable Data Protection Laws” means data protection and privacy laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including but not limited to, where applicable, the GDPR, the Australian Privacy Act and the CCPA, in each case, to the extent applicable to the relevant Customer Personal Data or Processing thereof under the Agreement.
     4. “Australian Privacy Act” means the Australian Privacy Act 1988 (Cth), including the Australian Privacy Principles.
     5. “Customer Personal Data” means any Personal Data Processed by or on behalf of Hasura on behalf of Customer to perform the Services under the Agreement.
     6. “CCPA” means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder.
     7. “Data Subject Request” means the exercise by Data Subjects of their rights in accordance with Applicable Data Protection Laws in respect of Customer Personal Data.
     8. “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
     9. “Delete” means the effective date of the Agreement.
     10. “EEA” means the European Economic Area.
     11. “GDPR” means: (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“EU GDPR”); (ii) the EU GDPR as it forms part of United Kingdom (“UK”) law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (iii) any applicable implementing or supplementary legislation in any member state of the EEA or the UK (including the UK Data Protection Act 2018).
     12. “Personnel” means a person’s employees, agents, consultants or contractors.
     13. “Personal Data” means Customer Data that constitutes “personal data,” “personal information,” or similar information governed by Applicable Data Protection Laws, except that Personal Data does not include such information pertaining to Customer’s business contacts who are Customer Personnel where Hasura acts as a Controller of such information.
     14. “Personal Data Breach” means a breach of Hasura’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Hasura’s possession, custody or control. Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
     15. “Processing” means any operation or set of operations which is performed on Customer Personal Data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
     16. “Relevant Body” means:
         1. in the context of the UK and the UK GDPR, the UK Information Commissioner’s Office and/or UK Government (as and where applicable); and/or
         2. in the context of the EEA and the EU GDPR, the European Commission.
     17. “Restricted Country” means:
         1. in the context of the UK, a country or territory outside the UK; and
         2. in the context of the EEA, a country or territory outside the EEA,
         that the Relevant Body has not deemed to provide an adequate level of protection for Personal Data pursuant to a decision made in accordance with the GDPR.
     18. “Restricted Transfer” means the disclosure, grant of access or other transfer of Personal Data to any person which would be prohibited without a legal basis under the GDPR.
     19. “Services” means those services and activities to be supplied to or carried out by or on behalf of Hasura for Customer pursuant to the Agreement.
     20. “Standard Contractual Clauses” means the Standard Contractual Clauses for Processors as approved by the European Commission and available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en (as updated, amended or superseded from time to time).
     21. “Subprocessor” means any third party appointed by or on behalf of Hasura to Process Customer Personal Data.
     22. “Supervisory Authority”:
         1. in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office; and
         2. in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR.
     23. “UK Addendum” means the UK International Data Transfer Addendum to the Standard Contractual Clauses as approved by the UK Information Commissioner’s Office under section 119A(1) of the UK Data Protection Act 2018, or any set of clauses approved by a Supervisory Authority which subsequently amends, replaces or supersedes the same.
  2. In this Data Processing Addendum:
     1. the terms, “Controller” and “Processor” shall have the meaning ascribed to the corresponding terms in the GDPR, and “Controller” shall include a “business” as defined in the CCPA;
     2. the terms, “business,” “commercial purpose,” “sell” and “service provider” shall have the respective meanings given thereto in the CCPA; and “personal information” shall mean Customer Personal Data that constitutes personal information governed by the CCPA, or the Australian Privacy Act, whichever is applicable; and
     3. unless otherwise defined in this Data Processing Addendum, all capitalized terms in this Data Processing Addendum shall have the meaning given to them in the Agreement.

• DURATION AND SCOPE OF THIS DATA PROCESSING AGREEMENT

  1. This Data Processing Addendum will remain in effect so long as Hasura Processes Customer Personal Data, notwithstanding the expiration or termination of the Agreement.
  2. Schedule 1 (EU Annex) and Schedule 4 (UK Annex) to this Data Processing Addendum applies only to the Processing of Customer Personal Data subject to the GDPR. Schedule 2 (California Annex) to this Data Processing Addendum applies only to the Processing of Customer Personal Data subject to the CCPA with respect to which Customer is a “business” (as defined in the CCPA). Schedule 5 (Australia Annex) to this Data Processing Addendum applies only to the Processing of Customer Personal Data subject to the Australian Privacy Act.

• PROCESSING OF CUSTOMER PERSONAL DATA

  1. Hasura shall not Process Customer Personal Data other than on Customer’s instructions or as required by Applicable Data Protection Laws.
  2. Customer instructs Hasura to Process Customer Personal Data as necessary:
     1. to provide the Services to Customer; and
     2. to perform Hasura’s obligations and exercise Hasura’s rights under the Agreement, including to maintain records relating to the Service and comply with any legal or self-regulatory obligations relating to the Service.
  3. If applicable law requires Hasura to conduct Processing that is inconsistent with the Customer’s instructions, then Hasura will immediately notify Customer in writing prior to commencing the Processing, unless applicable law prohibits such notification. Hasura also will immediately notify Customer if Hasura believes that Customer’s instructions violate, or result in Processing in violation of Applicable Data Protection Laws.
  4. Customer acknowledges and agrees that Hasura may create and derive from Processing related to the Agreement, deidentified, anonymized and/or aggregated data that does not identify any natural person and use, publicize, or share with third parties such data to improve Hasura’s products and services and for its other legitimate business purposes.

• HASURA PERSONNEL

  Hasura shall:

  1. limit access to Hasura Personnel who need to access the relevant Customer Personal Data for the purposes described in this Data Processing Addendum; and
  2. subject Hasura Personnel to confidentiality undertakings or professional or statutory obligations of confidentiality.

• SECURITY

  Hasura shall implement and maintain technical and organizational measures in relation to Customer Personal Data designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access as described in Schedule 3 (Security Measures). Hasura may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

• DATA SUBJECT RIGHTS

  1. Hasura, taking into the account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligation to respond to Data Subject Requests. If Hasura receives a Data Subject Request, Hasura will advise the Data Subject to submit the request to Customer and Customer will be responsible for responding to any such request.
  2. Hasura shall:
     1. promptly notify Customer if it receives a Data Subject Request; and
     2. not respond to any Data Subject Request except on the written instructions of Customer (and in such circumstances, at Customer’s cost) or as required by Applicable Data Protection Laws.

• PERSONAL DATA BREACH

  1. Hasura shall notify Customer without undue delay upon Hasura’s discovering a Personal Data Breach affecting Customer Personal Data. Hasura shall provide Customer with information (insofar as such information is within Hasura’s possession and knowledge) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. Hasura’s notification of or response to a Personal Data Breach will not be construed as Hasura’s acknowledgement of any fault or liability with respect to the Personal Data Breach.
  2. Hasura shall, at Customer’s cost, co-operate with Customer and take such commercially reasonable steps as may be directed by Customer to assist in the investigation of any such Personal Data Breach.
  3. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breaches.

• CUSTOMERS’S RESPONSIBILITIES

  1. Customer agrees that, without limitation of Hasura’s obligations under Section 5 (Security), Customer is solely responsible for its use of the Service, including (a) making appropriate use of the Service to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Service; (c) securing Customer’s systems and devices that Hasura uses to provide the Service; (d) providing all appropriate notices and obtaining any necessary consents for Hasura to Process Customer Personal Data as set forth in the Agreement; and (e) backing up Customer Personal Data.
  2. Customer Personal Data provided or otherwise made available to Hasura shall not contain any (a) Social Security numbers or other government-issued identification numbers; (b) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (c) health insurance information; (d) biometric information; (e) passwords to any online accounts; (f) credentials to any financial accounts; (g) tax return data; (h) any payment card information subject to the Payment Card Industry Data Security Standard; (i) Personal Data of children under 13 years of age; or (j) any other information that falls within any special categories of data (as defined in GDPR).

• LIABILITY CAP

  1. The total combined liability of either party towards the other party, whether in contract, tort or any other theory of liability, under or in connection with Agreement, or this Data Processing Addendum combined, will be limited to the limitations on liability or other liability caps agreed to by the parties in the Agreement. Despite the foregoing, in no event will any party limit its liability with respect to any individual’s data protection rights, whether under this Data Processing Addendum or otherwise.

• GENERAL

  1. This Data Processing Addendum shall be incorporated into and form part of the Agreement with effect from the Addendum Effective Date.
  2. In the event of any conflict or inconsistency between:
     1. this Data Processing Addendum and the Agreement, this Data Processing Addendum shall prevail; or
     2. any Standard Contractual Clauses entered into pursuant to Section 2(b) of this Data Processing Addendum, Schedule 1 and/or the Agreement, the Standard Contractual Clauses shall prevail.
     3. any UK Addendum entered into pursuant to Section 2(b) of this Data Processing Addendum, Schedule 4 and/or the Agreement, the Standard Contractual Clauses shall prevail.