Data Processing Agreement

Flexera is a software company which offers a range of IT management products and services, further detail of which can be found within the Master Agreement entered into, or to be entered into, between Flexera and Customer. This Data Processing Agreement supplements the Master Agreement to ensure that any Personal Information subject to the Master Agreement is transferred and processed in accordance with the Applicable Privacy Laws. This agreement is provided in both English and German language. The German language version is provided as a convenience translation only and the English version will control. The English version of this agreement shall prevail in case of any discrepancies between the English and German translations.

1. Definitions

   Unless otherwise defined, the following definitions shall apply:

   1.1. “Flexera” means the Flexera entity described in the Master Agreement.

   1.2. “Customer” means the Customer as described in the Master Agreement, which not only includes the contracting party, but may also encompass Customer affiliates (as defined in the Master Agreement) to the extent they are beneficiaries under the Master Agreement. Customer shall be the sole contact point for Flexera under this Data Processing Agreement and any communication shall take place with and claims must be asserted by the Customer only.

   1.3. “Master Agreement” means the agreement between Flexera and Customer which sets out the basis on which Flexera provides its products and/or services for the use of the Customer.

   1.4. “Applicable Privacy Laws” means any applicable laws and regulations relating to the processing, privacy, or security of Personal Information.

   1.5. “Personal Information” means any information relating to an identified or identifiable individual or device, or is otherwise “personal data,” “personal information,” “personally identifiable information” and similar terms, and such terms shall have the same meaning as defined by Applicable Privacy Laws.

   1.6. “Special Category or Criminal Offence Data” means any data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation as well as data relating to criminal convictions and offences or related security measures.

   1.7. “Processor” “Controller” and “Processing” shall have the meanings attributed to them in the Applicable Privacy Laws.

2. Commencement and Scope 

   This Data Processing Agreement shall commence on the earlier of either (a) Flexera and Customer entering into a Master Agreement, or if earlier, (b) when Flexera commences processing Personal Information provided by Customer to Flexera in the context of the Master Agreement on behalf of Customer in connection with the services as agreed under the Master Agreement (“Services”). This Data Processing Agreement shall remain in full force and effect as long as the Master Agreement (including any extension, renewal, or variation) remains effective and thereafter for as long as Flexera continues to process Personal Information on behalf of Customer.

3. Conflict and Order of Precedence

   In the event of any conflict or inconsistency between the Master Agreement, the main body of this Data Processing Agreement, or the Schedules to this Data Processing Agreement, the following order of precedence shall apply:

   3.1. Schedules of this Data Processing Agreement,

   3.2. Main body of this Data Processing Agreement, and

   3.3. Master Agreement.

4. Role of Parties

   4.1. The Parties acknowledge and agree that,

   • 4.1.1. for the purposes of the GDPR and other Applicable Privacy Laws in the United States, Flexera acts as "Processor" or "sub-processor". Flexera's function as Processor or sub-processor will be determined by the function of Customer: 
     (i) Where Customer acts as a Controller, Flexera acts as a Processor.
     (ii) Where Customer acts as a Processor (on behalf of its end-customers), Flexera acts as a sub-processor.

     4.1.2. for the purposes of the CCPA (as defined below), Customer acts as a "business" while Flexera acts as a "service provider" in its performance of its obligations pursuant to the Master Agreement and this Data Processing Agreement.

   4.2. The Parties each agree that they shall always remain responsible for compliance with their respective obligations under the Applicable Privacy Laws.

5. Processing of Personal Information

   5.1. Unless processing is required by Applicable Privacy Laws, including EU or EU member state law to which Flexera is subject, Flexera will process Personal Information under the Data Processing Agreement only as a Processor acting on Customer’s lawful and documented instructions as reasonably necessary to deliver the Services as set out within the Master Agreement, processing initiated by Customer’s end users in their use of the Services, and to comply with other reasonable instructions proved by Customer via support ticket, email, or otherwise where such instructions are consistent with the terms of the Data Processing Agreement. Customer may provide additional instructions in writing (email or other electronic means being sufficient) to Flexera regarding the processing of Personal Information to the extent technically feasible and provided that such instructions are still covered by the Services purchased or needed to comply with statutory rights from individuals.

   5.2. Customer warrants that:

   • 5.2.1. It has complied and will continue to comply with Applicable Privacy Laws;

     5.2.2. Its instructions shall at all times comply with, and be compatible with, Applicable Privacy Laws;

     5.2.3. All Personal Information has been and will continue to be collected and processed in accordance with the notice, consent, and all other requirements of the Applicable Privacy Laws; and

     5.2.4. It has, and will continue to have, the right to transfer or provide access to the Personal Information to Flexera, and that such processing by Flexera will not contravene Applicable Privacy Laws.

   5.3. If Customer's instructions, in Flexera's opinion, violate applicable law, Flexera shall promptly inform Customer thereof.

   5.4. Where Customer submits additional instructions or wishes to vary the existing instructions in respect of processing of Personal Information and Flexera believes that adopting the new instructions would adversely impact upon the delivery of the Services, or would lead to Flexera incurring additional costs, Flexera and Customer shall negotiate in good faith to reach an agreement in respect of either (a) varying the amended instructions, or (b) proportioning the associated costs of implementing the amended instructions.

   5.5. Except with the express prior agreement of both Parties’ data protection officers (or other authorized representative) Customer shall not provide to Flexera any Special Category or Criminal Offence Data.

6. Sub-Processors

   6.1. Customer grants Flexera a general authorization to engage sub-processors subject to Section 6.3 of this Data Processing Agreement.

   6.2. Where Flexera engages any third parties, whether affiliated companies or not, Flexera shall ensure that there is in place an agreement between Flexera and such party that imposes the same data protection obligations as agreed in this Data Processing Agreement including any Schedules if applicable.

   6.3. The sub-processors engaged by Flexera as set out in Schedule 1 at the commencement of this Data Processing Agreement are approved by Customer. Should Flexera seek to engage a new sub-processor, it shall notify Customer of the same. In the absence of any objection from Customer within 28 days of notification, Customer shall be deemed to have consented to the engagement.

   6.4. In the case Customer objects to the sub- processing, Flexera can choose to either not engage the sub-processor or to terminate the portion of the Master Agreement relating to the affected Services with 28 days prior written notice. Until the termination of the Master Agreement, Flexera may suspend the portion of the Services which is affected by the objection of Customer. Customer shall not be entitled to a pro-rata refund of the remuneration for the Services, unless the objection is based on justified reasons of incompliance with Applicable Privacy Laws.

7. International Data Transfers

   7.1. Flexera may transfer Personal Information outside of the territory in which it originates; where this occurs any such transfer is executed in accordance with Applicable Privacy Laws.

   7.2. Where Flexera is located outside the European Economic Area, the United Kingdom or Switzerland, the terms of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 (“SCC”), as further specified in Schedule 2 of this Data Processing Agreement, are hereby incorporated by reference and shall be deemed to have been executed by the Parties and apply to any transfers of Personal Information falling within the scope of the European General Data Protection Regulation from Customer (as data exporter) to Flexera (as data importer). Schedule 2 will also specify the applicable module of the SCC.

   7.3. To the extent that the processing of Personal Information is subject to data protection laws in the United Kingdom, Schedule 3 shall apply in addition.

8. Security of Personal Information

   8.1. Flexera has in place a comprehensive data protection and information security program which consists of a range of technical and organisational measures designed to establish an appropriate level of security for all Personal Information processed by Flexera. The technical and organizational measures are specified in Annex 2 to Schedule 2.

   8.2. All personnel of Flexera undergo appropriate pre-employment screening and are subject to written obligations of confidentiality extending to the Personal Information processed on behalf of Customer. Sub-processors will be bound by appropriate confidentiality agreements as well.

   8.3. Flexera may alter the technical and organizational security measures provided that such alteration does not reduce the overall level of protection afforded to the Personal Information by Flexera under this Data Processing Agreement, it will inform Customer of any substantial changes.

   8.4. Flexera shall, taking into account the nature of the processing and the information available to it, assist Customer in ensuring compliance with Customer's obligation to implement appropriate technical and organisational measures to ensure to establish an appropriate level of security of the Customer's processing.

9. Requests for Information 

   9.1. Flexera has a policy in place for handling requests to access Personal Information it processes by third parties, including in respect of warrants, subpoenas, court orders, or requests from individuals or governmental departments (including law enforcement and intelligence agencies).

   9.2. Flexera will notify Customer of such request on receipt unless there is a restriction on such notification. Where Flexera is prohibited from notifying Customer it shall provide such notification as soon as such restriction is no longer in effect.

   9.3. Where Flexera receives such a request and is prohibited from notifying Customer, it shall use reasonable efforts to establish that the request is legitimate, is in accordance with applicable laws, and goes no further than is necessary to achieve the intended purpose.

   9.4. Flexera has not received a request for information in respect of Personal Information it processes on behalf of its customers from any government, law enforcement, or intelligence agency.

10. Audit

    10.1. Customer is entitled to audit Flexera’s compliance with the obligations set out in this Data Processing Agreement including any Schedules were applicable once in any 12 months period, unless where an audit is recommended, or required by a regulator of Customer, following an Incident (as defined in Section 11.1 of this Data Processing Agreement), or where Customer has justifiable reason to believe that Flexera is not complying with the terms and conditions under this Data Processing Agreement.

    10.2. Customer may conduct any audit itself or appoint a suitably qualified third party to conduct the audit on its behalf. Where Customer appoints a third party it agrees that it will not appoint any third party who provides comparable Services as Flexera, and that the third party must enter a written obligation of confidentiality approved by Flexera.

    10.3. Any audit must be completed during Flexera’s normal business hours and be conducted in such a manner as to prevent any unreasonable disruption or interference with Flexera’s operations.

    10.4. To initiate an audit Customer shall submit a comprehensive audit plan to Flexera no less than two weeks prior to the intended commencement date. Flexera will consider the request and shall work collaboratively with Customer to finalise the scope of the audit and seek to have the relevant resources available. Flexera shall use its reasonable endeavours to ensure that any third-party Sub-processors assist to the extent necessary with any such audit.

    10.5. Where the intended scope of an audit is covered in an approved industry standard, scheme, or certification, Customer agrees to accept a certification of said standard issued by a third-party auditor or certification body within the preceding twelve months as confirmation of adherence to said standard, scheme, or certification.

    10.6. Flexera and Customer shall each be responsible for their own costs in relation to, or arising from, the audit. In the event the Flexera is required to incur additional costs it shall notify Customer of the same prior to the audit commencing and both Flexera and Customer will negotiate in good faith with respect to any such costs.

11. Security Incident

    11.1. Flexera has implemented and deployed a range of technical and organisational measures to minimise the risk of any unauthorised disclosure of or access to, and accidental or unlawful destruction, loss, alteration, or extraction of Personal Information (an “Incident”). The measures in question are intended to prevent an Incident occurring, identify if an Incident occurs, and minimise the impact if an Incident occurs.

    11.2. Flexera will notify Customer without undue delay after becoming aware of an Incident. Flexera will provide the following information as it becomes available either at the time of notification or as soon as possible thereafter:

    • 11.2.2. A description of the Incident,

      11.2.3. Details of what Personal Information is affected,

      11.2.4. What measures have been taken to mitigate the impact of the Incident,

      11.2.5. If applicable, when access to the Personal Information will be restored.

    11.3. Flexera will not make any public statement, notify any regulator, or notify the affected individuals without first notifying Customer. Customer agrees that it will coordinate with Flexera on the content and timing of any public statements or regulatory notifications that Customer intends to make in relation to the Incident.

    11.4. Flexera shall, taking into account the nature of the processing and the information available to it, assist Customer in ensuring compliance with obligations under Applicable Privacy Laws regarding the notification of Incidents to individuals and supervisory authorities.

12. Rights of Individuals 

    12.1. Flexera recognises there may be rights afforded to individuals under the Applicable Privacy Laws and has appropriate systems in place to enable such rights to be fulfilled within the stipulated timeframes. Where Flexera receives a request for Personal Information and Flexera is processing such Personal Information at the direction of Customer, Flexera will forward the request on to Customer and may refer the individual making the request to Customer. If Customer receives a request and requires Flexera’s assistance to fulfil the request it shall forward the same to DataProtectionTeam@Flexera.com.

    12.2. Flexera will provide Customer reasonable assistance as necessary for Customer to fulfil its obligation under the Applicable Privacy Laws to respond to data subject requests, including if applicable, Customer's obligation to respond to requests for exercising the rights set out in the GDPR or CCPA.

13. Further Assistance and Provision of Information

    13.1. Taking into account the nature of processing and the information available to it, Flexera assists Customer in ensuring compliance with Customer's obligations under Applicable Privacy Laws with regard to conducting data protection impact assessments or prior consultations with supervisory authorities.

    13.1. Flexera makes available to the Customer all information necessary to demonstrate compliance with the obligations under this Data Processing Agreement.

14. Data Erasure and Retention

    In the absence of (i) any provision within the Master Agreement to the contrary; (ii) a request from the Customer in writing, or (iii) Applicable Privacy Laws or other applicable laws require continued storage of the Personal Information, within sixty days of Flexera ceasing to provide the Services to Customer, Flexera shall erase any Personal Information remaining on any of its systems

15. Personal Information Subject to the CCPA

    To the extent that the processing of Personal Information is subject to the California Consumer Privacy Act of 2018 (“CCPA”), Schedule 4 shall apply.