Rapid7’s Data Processing Addendum

RAPID7 DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) applies to Rapid7’s Processing of Personal Data as a Processor on behalf of Customer as part of

Rapid7’s provision of Software, Services, or Software-as-a-Service (“Services”) to Customer. This DPA forms part of the Master Services

Agreement, Terms of Service, End User License Agreement, or other written or electronic agreement (“Agreement”) between Rapid7 and

Customer for the purchase of Services to reflect the parties’ agreement with regard to the Processing of Personal Data.

In the course of providing products and/or services to Customer pursuant to this DPA, Rapid7 may Process Personal Data on behalf of Customer

and the parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.

The terms of this DPA will be effective and replace any previously applicable data processing terms as of the date of execution.

Introduction

1. Customer is a Controller or Business, as applicable of certain Personal Data and wishes to appoint Rapid7 as a Processor or Service Provider, as applicable, to Process this Personal Data on its behalf.

2. The parties are entering into this DPA to ensure that Rapid7 conducts such data Processing in accordance with Customer's instructions and Applicable Data Protection Law requirements, and with full respect for the fundamental data protection rights of the Data Subjects or Consumers, as applicable, whose Personal Data will be Processed.

Definitions

In this DPA, the following terms shall have the following meanings: 

“Business”, "Controller", "Processor", “Business Purpose”, "Data Subject", “Consumer”, "Personal Data" “Service Provider”, “Sale”, “Share”, “Third Party” and "Processing" (and "Process") shall have the meanings given in Applicable Data Protection Law. The term "Personal Data" shall be deemed to include concepts of "Personal information" or "Personally Identifiable Information" if and as those terms may be defined under Applicable Data Protection Law.

"Applicable Data Protection Law" shall mean all worldwide data protection and privacy laws and regulations applicable to the personal datain question, including, where applicable, EU/UK Data Protection Law, Swiss Data Protection Law and US State Privacy Laws.

"Data Privacy Framework" or "DPF" shall mean the EU-U.S. Data Privacy Framework ("EU-US DPF"), the UK Extension to the EU-U.S. DPF ("UK-US Extension"), and the Swiss-U.S. Data Privacy Framework ("Swiss-US DPF") as set forth by the U.S. Department of Commerce.

"EU/UK Data Protection Law" shall mean: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii); in each case as may be amended or superseded from time to time.

“Restricted Transfer" shall mean: (i) where the EU GDPR applies, a transfer of personal data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; and (ii) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data from Switzerland to any other country which is not subject to an adequacy determination by the Swiss Federal Data Protection and Information Commissioner or Federal Council (as applicable). For the avoidance of doubt, a transfer of personal data to the United States pursuant to the Data Privacy Framework shall not be a Restricted Transfer. 

"Standard Contractual Clauses" means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").

"Swiss Data Protection Law" shall mean: (i) the Swiss Federal Act on Data Protection of 25 September 2020 and its corresponding ordinances ("Swiss DPA"); and (ii) any other national laws in Switzerland applicable (in whole or in part) to the processing of personal data; in each case, as amended or superseded from time to time. 

"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner's Office under s119A of the UK Data Protection Act 2018.

“US State Privacy Laws” mean all state laws relating to the protection and processing of personal data in effect in the United States of America, which may include, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and applicable security and data breach notification laws.

Data Processing

1. Relationship of the Parties. Customer (the Controller or Business, as applicable) appoints Rapid7 as a Processor or Service Provider, as applicable, to Process the Personal Data that is the subject matter of the Agreement. Each party shall comply with the obligations that apply to it under Applicable Data Protection Law.
2. Purpose Limitation. Rapid7 shall Process the Personal Data as a Processor only as necessary to perform its obligations under the Agreement, and strictly in accordance with the documented instructions of Customer (the "Permitted Purpose"), except where otherwise required or allowed by Applicable Data Protection Law applicable to Rapid7. In no event shall Rapid7 Process the Personal Data for its own purposes or those of any Third Party except as set forth in the Agreement. Other than as otherwise agreed upon by the parties in the Agreement or as otherwise permitted under Applicable Data Protection Law, Rapid7 shall not (i) Sell or Share the Personal Data;(ii) retain, use or disclose the Personal Data for any Business Purpose or Commercial Purpose outside of the direct business relationship between Customer and Rapid7, unless explicitly permitted by Applicable Data Protection Law; (iv) combine Personal Data that it receives from, or on behalf of Customer, with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, unless such combination is required to perform a Business Purpose. Finally Rapid7 will inform Customer if Rapid7 determines that it is no longer able to meet its obligations under Data Protection Laws.
3. Restricted Transfers. The parties agree that when the transfer of Personal Data from Customer to Rapid7 is a Restricted Transfer it shall be subject to the appropriate Standard Contractual Clauses as follows:

   1. in relation to Personal Data that is protected by the EU GDPR, the EU SCCs will apply completed as follows: (i) Module Two will apply; (ii) in Clause 7 of the EU SCCs, the optional docking clause will apply; (iii) in Clause 9 of the EU SCCs, Option 2 will apply, and the time period for prior notice of subprocessor changes shall be as set out in Clause 7 of this DPA; (iv) in Clause 11 of the EU SCCs, the optional language will not apply; (v) in Clause 17 of the EU SCCs, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi) in Clause 18(b) of the EU SCCs, disputes shall be resolved before the courts of the Republic of Ireland; (vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I in the Appendix to this DPA; (viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II in the Appendix to this DPA;

   2. in relation to Personal Data that is protected by the UK GDPR, the UK SCCs will apply completed as follows: (i) the EU SCCs, completed as set out in clause 3(a) above, shall between the Customer as Data Exporter and Rapid7 as Data Importer, and shall be modified by the UK Addendum (completed as set out in clause 3(b)(ii)    ); and (ii) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out in clause 3(a)   , and the options "Exporter" and "Importer" shall be deemed checked in Table 4. The start date of the UK Addendum (as set out in Table 1) shall be the effective date of this DPA; and

   3. in relation to Personal Data that is protected by the Swiss DPA, the EU SCCs will apply as set out in Clause 3(a) with the
      following modifications: (i) references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA;
      (ii) references to specific Articles of "Regulation (EU) 2016/679" shall be replaced with the equivalent article or section of
      the Swiss DPA; (iii) references to "EU", "Union", "Member State" and "Member State law" shall be replaced with
      references to "Switzerland" or "Swiss law" (as applicable); (iv) the term "member state" shall not be interpreted in such a
      way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual
      residence (i.e., Switzerland); (v) Clause 13(a) and Part C of Annex I are not used and the "competent supervisory
      authority" is the Swiss Federal Data Protection and Information Commissioner; (vi) references to the "competent
      supervisory authority" and "competent courts" shall be replaced with references to the "Swiss Federal Data Protection
      and Information Commissioner" and "applicable courts of Switzerland"; and (vii) in Clause 17 of the EU SCCs, the EU SCCs
      shall be governed by the laws of Switzerland.

   4. in the eent that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail; and 

   5. in the event the EU SCCs or the UK SCCs are replaced by new standard contractual clauses approved by the European
      Commission and/or the Information Commissioner's Office as applicable, the Parties agree that such new standard
      contractual clauses shall automatically apply to the relevant Restricted Transfer from the date that such new standard
      contractual clauses become applicable and shall be deemed completed on a mutatis mutandis basis to the completion of
      the EU SCC and the UK SCCs as described in Clause 3(a) and (b) ;
4. Data Privacy Framework. Notwithstanding Clause 3, Customer acknowledges that Rapid7 complies with the DPF and that transfers of Personal Data to Rapid7 made under the DPF shall not be a Restricted Transfer. Rapid7 will promptly notify Customer if it fails to comply with its DPF certification or its DPF certification lapses or is otherwise invalidated, in which instance any transfers of Personal Data from Customer to Rapid7 shall immediately be deemed a Restricted Transfer and the provisions of Clause 3 shall apply. 
5. Confidentiality of Processing. Rapid7 shall ensure that any person that it authorizes to Process the Personal Data (including Rapid7's staff, agents and subcontractors) (an "Authorized Person") shall be subject to a strict duty of confidentiality (whether a contractual duty or a statutory duty) and shall not permit any person to Process the Personal Data who is not under such a duty of confidentiality. Rapid7 shall ensure that all Authorized Persons Process the Personal Data only as necessary for the Permitted Purpose.
6. Security. Rapid7 shall implement appropriate technical and organizational measures to protect the Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Personal Data (a "Security Incident"). Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Such measures may include, as appropriate:
   1. the pseudonymization and encryption of Personal Data;
   2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services; 
   3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; or
   4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.
7. Subprocessing. Customer specifically authorizes the engagement of Rapid7’s affiliates as subprocessors. Customer consents to Rapid7 engaging third party subprocessors to Process the Personal Data provided that: (i) Rapid7 maintains an up-to-date list of its subprocessors at https://www.rapid7.com/legal/subprocessors, which it shall update with details of any change in subprocessors at least 30 days' prior to any such change; (ii) Rapid7 imposes data protection terms on any subprocessor it appoints that protect the Personal Data to substantially similar terms to the terms of this DPA; and (iii) Rapid7 remains fully liable for any breach of this DPA that is caused by an act, error or omission of its subprocessor. Customer may object to Rapid7's appointment or replacement of a third party subprocessor at any time prior to their appointment, provided such objection is on reasonable grounds relating to the protection of the Personal Data. In such event, Rapid7 will either not appoint or replace the subprocessor or, if this is not possible, Customer may suspend or terminate this DPA.
8. Cooperation and Data Subjects' Rights. Rapid7 shall provide all reasonable and timely assistance (including by appropriate technical and organizational measures) to Customer to enable Customer to respond to: (i) any request from a Data Subject or Consumer, as applicable, to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, enquiry or complaint received from a Data Subject or Consumer, as applicable, regulator or other third party in connection with the Processing of the Personal Data. In the event that any such request, correspondence, enquiry or complaint is made directly to Rapid7, Rapid7 shall promptly inform Customer providing details of the same.
9. Data Protection Impact Assessment. Rapid7 shall provide Customer with all such reasonable and timely assistance as Customer may require in order to conduct a data protection impact assessment and, if necessary, consult with its relevant data protection authority.
10. Security Incidents. Upon becoming aware of a Security Incident, Rapid7 shall inform Customer without undue delay and shall provide all such timely information and cooperation as Customer may require in order for Customer to fulfil its data breach reporting obligations under (and in accordance with the timescales required by) Applicable Data Protection Law. Rapid7 shall further take all such measures and actions as are necessary to remedy or mitigate the effects of the Security Incident and shall keep Customer apprised of all developments in connection with the Security Incident.
11. Deletion or Return of Data. After termination or expiration of the Agreement, or upon Customer’s request, Rapid7 shall destroy or return to Customer all Personal Data (including all copies of the Personal Data) in its possession or control (including any Personal Data subcontracted to a third party for Processing). This requirement shall not apply to the extent that Rapid7 is required by any EU (or any EU Member State) law to retain some or all of the Personal Data, in which event Rapid7 shall isolate and protect the Personal Data from any further Processing except to the extent required by such law.
12. Audit. Customer reserves the right to take reasonable and appropriate steps to ensure Rapid7’s Processing of Personal Data is consistent with Customer’s obligations under Applicable Data Protection Law and discontinue and remediate unauthorized use of Personal Data. Rapid7 shall permit upon Customer’s written request, when Customer has reasonable cause to believe Rapid7 is in non-compliance with its obligations under this DPA, a mutually agreed-upon third party auditor (the “Auditor”) to audit Rapid7's compliance with this DPA and shall make available to such third-party auditor all information, systems and staff necessary for the Auditor to conduct such audit. Rapid7 acknowledges that the Auditor may enter its premises for the purposes of conducting this audit, provided that Customer gives it reasonable prior notice of its intention to audit, conducts its audit during normal business hours, and takes all reasonable measures to prevent unnecessary disruption to Rapid7's operations. Customer will not exercise its audit rights more than once in any twelve (12) calendar month period, except (i) if and when required by instruction of a competent data protection authority; or (ii) Customer reasonably believes a further audit is necessary due to a Security Incident suffered by Rapid7.

Annex I

Data Processing Description

Terms used but not defined in this Appendix shall have the meanings given to them in the Rapid7 Data Processing Addendum and any Master Services Agreement, Terms of Service, End User License Agreement, or other written or electronic agreement between Rapid7 and Customer for the purchase of Services.

A. LIST OF PARTIES

Controller(s) / Data exporter(s): 

Processor(s) / Data importer(s): 

В. DESCRIPTION OF PROCESSING AND TRANSFER 

C. COMPETENT SUPERVISORY AUTHORITY

Annex II

Technical and Organisational Security Measures

Description of the technical and organisational measures implemented by Rapid7 to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller (and, for transfers from a processor to a sub-processor, to the data exporter).