# Envoy Data Protection Addendum **Effective Date**: August 2, 2022 This Data Processing Addendum (“ **Addendum**” or “ **DPA**”) forms part of the Enterprise SaaS Agreement or the Terms of Service (“ **Principal Agreement**”) between: (i) Envoy, Inc. (“ **Vendor**” or “ **Envoy**”) acting on its own behalf and as agent for each Vendor Affiliate; and (ii) the Customer listed in the Principal Agreement (“ **Company**”) acting on its own behalf and as agent for each Company Affiliate, solely to the extent Vendor or any Vendor Affiliate processes Company Personal Data in the capacity as a Processor of Company or the Company Affiliate. In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Principal Agreement. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect. Except where the context requires otherwise, references in this Addendum to the Principal Agreement are to the Principal Agreement as amended by, and including, this Addendum. ## 1. Definitions and Interpretation 1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly: 1. " **Company Affiliate**" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Company; 2. " **Company Group Member**" means Company or any Company Affiliate; 3. " **Company Personal Data**" means any Personal Data Processed by Vendor or the relevant Vendor Affiliate on behalf of a Company Group Member; 4. " **Data Protection Laws**" means all laws and regulations applicable to the Processing of Personal Data under this Addendum; 5. " **EEA**" means the European Economic Area; 6. " **EU Standard Contractual Clauses**" means the clauses approved with Commission Implementing Decision (EU) 2021/914; 7. “ **GDPR**” means the General Data Protection Regulation 2016/679; 8. " **Services**" means the services and other activities supplied to Company Group Members; 9. " **Subprocessor**" means any person appointed by Vendor or any Vendor Affiliate to Process Company Personal Data; 10. " **Vendor Affiliate**" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Vendor. 1.2 The terms, “ **Controller**”, “ **Data Subject**”, “ **Personal Data**”, “ **Personal Data Breach**”, “ **Processing**”, “ **Processor**” and “ **Supervisory Authority**” shall have the same meaning as in the Data Protection Laws. 1.3. Capitalized terms used in this Addendum not otherwise defined herein shall have the meaning given to them in the Principal Agreement. 1.4. The word " **include**" shall be construed to mean include without limitation. ### 2. Authority 2.1. Vendor warrants and represents that, before any Vendor Affiliate Processes any Company Personal Data, Vendor's entry into this Addendum as agent for and on behalf of that Vendor Affiliate will have been duly authorized. ### 3. Controller’s Instructions 3.1. The parties acknowledge and agree that with regard to the Processing of Company Personal Data, Company is the Controller, Vendor is the Processor and that Vendor will engage Subprocessors pursuant to Section 7 below. 3.2. The Company: 3.2.1.instructs Vendor and each Vendor Affiliate to: 3.2.1.1. Process Company Personal Data; 3.2.1.2. transfer Company Personal Data to any country or territory; 3.2.2.warrants and represents that it is authorized to give the instruction set out in this Addendum; 3.2.3.warrants and represents that it will comply with its obligations under the Data Protection Laws. 3.3. Vendor and each Vendor Affiliate shall comply with all applicable Data Protection Laws. ### 4. Confidentiality 4.1. Vendor will require its employees who access Company Personal Data to commit to protect the confidentiality of the data. ### 5. Cross-Border Transfers of Personal Data 5.1. The parties agree to comply with the general clauses of the EU Standard Contractual Clauses. 5.1.8.For the purposes of Annex I, Section B, Schedule 1 to this Addendum is incorporated by reference and sets out a description of the Processing of Company Personal Data. ### 6. Security 6.1. Vendor will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. 6.2. Vendor shall notify Company of a Personal Data Breach affecting Company Personal Data. ### 7. Subprocessing 7.1. Each Company Group Member hereby authorizes Vendor to appoint Subprocessors in accordance with this Section. 7.2. The Subprocessors appointed by Vendor as of the date of this Addendum are set out at [Subprocessors List](https://envoy.com/subprocessors/). 7.4. Vendor will enter into an agreement with each Subprocessor that imposes substantial obligations on the Subprocessor. ### 8. Data Subject Rights 8.1. Vendor and each Vendor Affiliate shall assist each Company Group Member by implementing appropriate measures to respond to requests to exercise Data Subject rights. ### 9. Data Protection Impact Assessment and Prior Consultation 9.1. Upon Company’s request, Vendor and each Vendor Affiliate shall provide reasonable assistance with any data protection impact assessments. ### 10. Deletion or Return of Company Personal Data 10.1. Vendor and each Vendor Affiliate shall delete all Company Personal Data within thirty (30) days of the cessation of Services. ### 11. Audits 11.1. Vendor and each Vendor Affiliate shall make available to each Company Group Member on request all information necessary to demonstrate compliance with this Addendum. ### 12. General Terms 12.1. Nothing in this Addendum reduces Vendor's obligations under the Principal Agreement in relation to the protection of Company Personal Data. ### SCHEDULE 1 DETAILS OF PROCESSING OF COMPANY PERSONAL DATA 1. Subject matter and duration: The subject matter of the Processing is the provision of Services to the Company. Company Personal Data will be Processed for the duration of the Principal Agreement. 2. Nature and purpose: Vendor shall process Company Personal Data only in connection with the provision of Services. 3. Types: Personal Data input by Company into Vendor’s system such as name, contact information, and visitor information. 4. Categories of Data Subjects: Company’s employees and visitors. 5. Obligations and rights: The obligations and rights are set out in the Principal Agreement and this Addendum. **Contact Information** If you have any questions or comments you can contact us at [hi@envoy.com](mailto:hi@envoy.com). **Envoy, Inc.** 410 Townsend St, Suite 410 San Francisco, CA 94107 United States _Last updated on August 2, 2022_