Countly-hosted Data Processing Agreement

In providing the Data Processing Services to Customer pursuant to the agreement between Countly and Customer for Countly Enterprise with the "Countly Hosted" hosting arrangement, such as a Countly Enterprise Subscription Agreement or a Master Services Agreement, including its schedules and any Order Form (the "Agreement"), Countly may Process (as defined below) Personal Data (as defined below) on behalf of Customer. "Data Processing Services" means hosting, operating, monitoring, backing up and supporting the dedicated Countly server that Countly runs for Customer ("Customer's Countly server"). Countly will comply with the provisions in this Schedule C with respect to its processing of any Personal Data. Capitalized terms used but not defined in this Schedule C have the same meanings as set out in the Agreement. This published version does not apply to Processing that a data processing agreement signed as part of the Agreement covers, such as Schedule C of the Countly Enterprise Subscription Agreement or Schedule B of the Master Services Agreement.

For the purposes of this Schedule C:

(a) “Adequacy Regulation” means regulations made under section 17A of the Data Protection Act 2018 or Article 45A of the UK GDPR, and adequacy regulations having effect under sub-paragraph 4(1), Part 3, Schedule 21 of that Act, covering a transfer of Customer Data to a certain non-UK country or territory.

(b) “Adequacy Decision” means a positive finding of adequacy covering an international transfer by the European Commission in relation to the data protection regime of a certain non-EEA country or territory, pursuant to Article 45 of the GDPR.

(c) "Affiliate(s)" has the same meaning ascribed to it in the Agreement and, if not defined in the Agreement, the term means any legal entity directly or indirectly controlling, controlled by or under common control with a party, where control means the ownership of a majority share of the stock, equity or voting interests of such entity.

(d) "Applicable Data Protection Law" means any applicable legislation in force from time to time relating to the protection of personal data of individuals including, where applicable, Regulation (EU) 2016/679 (the "EU GDPR" or "GDPR"), the UK GDPR (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) (the “UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

(e) "Controller", “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process” and “Processing” shall each have the respective meanings given to them (and equivalent expressions) in Applicable Data Protection Law.

(f) "Customer Data" means any data, information or material originated by Customer that Customer or its authorised users submit to the Services, collects through its use of the Services or provides to Countly in the course of using the Services, and as set out in the Description of Processing. Customer Data excludes Account Data.

(g) "Account Data" means Personal Data relating to Customer's personnel and authorised users that Countly collects for its own purposes in connection with contracting, invoicing, support, communications and the use of the Countly websites, which Countly Processes as an independent Controller in accordance with its Enterprise Privacy Policy (countly.com/legal/enterprise-privacy) and Website Privacy Policy (countly.com/legal/privacy-policy).

(h) “Description of Processing” means the description of Processing set out in Appendix A.

(i) "EU Model Clauses" means the 2021 Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914; Module 4 (Processor-to-Controller) applies to Restricted Transfers from Countly to Customer and Module 3 (Processor-to-Processor) applies to Restricted Transfers from Countly to a Sub-processor.

(j) “Non-Adequate Country” means a country, territory or jurisdiction which: (i) in the case of a transfer concerning Customer Data regulated by the UK GDPR, is not subject to a valid Adequacy Regulation; and (ii) in the case of a transfer concerning Customer Data regulated by the EU GDPR, is not subject to an Adequacy Decision.

(k) “Restricted Transfer” means a transfer of Customer Data by Countly to a Non-Adequate Country.

(l) "Service Data" means technical information about the installation and operation of a Countly server that the Countly software sends to Countly: version and configuration information, aggregate usage counts, error reports about the Countly software itself and statistics on the use of the dashboard, as further described in Countly's Connected Services and Telemetry notice (countly.com/legal/connected-services). Countly Processes it as an independent Controller for licence management, security and support.

(m) "Subscription Services" means the hosted Countly services provided by Countly to Customer under the Agreement.

(n) "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 (version B1.0, in force 21 March 2022).

2.1 Parties' Roles. The parties agree that Customer is a Controller and Countly is a Processor for the purposes of Processing Customer Data pursuant to this Agreement. In some circumstances Customer may be a Processor, in which case Customer appoints Countly as Customer's sub-processor, which shall not change the obligations of either Customer or Countly under this Schedule C, as Countly will remain a Processor with respect to Customer in such event. Nothing in this Schedule C authorises Countly to Process Customer Data for its own advertising, marketing or analytics purposes.

2.2 Purpose Limitation. Countly shall process Personal Data for the purposes set forth in the Agreement and only in accordance with the lawful, documented instructions of Customer, except where otherwise required by applicable law. The Agreement and this Schedule C set out Customer's complete instructions to Countly in relation to the processing of Personal Data and any processing required outside of the scope of these instructions (inclusive of the rights and obligations set forth under the Agreement) will require prior written agreement of the parties. Notwithstanding the preceding sentences, Countly shall have no obligation to comply (nor any liability for non-compliance) with any of Customer instructions which will or are likely to (in Countly’s opinion): (i) vary the provisions of this Agreement; (ii) be inconsistent with the Description of Processing; and (iii) breach any Applicable Data Protection Laws, and shall notify Customer in writing of the same.

2.3 Compliance. Customer, as Controller, shall (in connection with Customer Data and the Services):

(a) ensure it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Law;

(b) ensure it has, and will continue to have, the right to transfer, or provide access to, the Customer Data to Countly for processing in accordance with the terms of the Agreement and this Schedule C;

(c) ensure that the Description of Processing at all times accurately reflects Countly’s Processing of Customer Data as a Processor for Customer in relation to the Data Processing Services. If Customer requires changes to the Description of Processing it shall provide an amended version (a “Revised Description”) to Countly. Such Revised Description shall be deemed to have replaced the Description of Processing within five (5) days of Countly’s written confirmation and this Agreement shall be deemed amended accordingly on that date. If the nature of the Processing under this Agreement changes in such a way as to change the scope of the Data Processing Services, Countly shall be entitled to amend the charges for the Data Processing Services accordingly;

(d) ensure that all instructions it issues to Countly comply with Applicable Data Protection Laws; and

(e) be and remain solely responsible for determining the legal basis and conditions for the Processing of all Customer Data under this Agreement.

3.1 Security. Countly shall implement appropriate technical and organizational measures designed to protect against accidental, unauthorized or unlawful destruction, loss, alteration, or disclosure of, or access to Customer Data (each a "Security Incident"). Countly maintains an information security management system certified to ISO/IEC 27001, implementing the controls of ISO/IEC 27017 and ISO/IEC 27018, and is audited against SOC 2.

3.2 Confidentiality of Processing. Countly shall ensure that any person that it authorizes to Process the Customer Data (including its and its Affiliates’ staff, agents, and subcontractors) shall be subject to a duty of confidentiality (whether a contractual or a statutory duty).

3.3 Security Incidents. Upon becoming aware of a Security Incident, Countly shall notify Customer without undue delay and pursuant to the terms of the Agreement and shall provide such timely information as Customer may reasonably require to enable Customer to fulfill any data breach reporting obligations under Applicable Data Protection Law.

4.1 Sub-processors. Customer agrees that Countly may engage Countly Affiliates and is generally authorized to engage any third party Processor to process Customer Data on Countly’s behalf (collectively, "Sub-processors"). The Sub-processors currently engaged by Countly and authorized by Customer are those published on the page at countly.com/legal/enterprise-hosted-subprocessors (the "Sub-processor List"), which forms part of this Schedule C and is updated in accordance with Sections 4.2 and 4.3. Countly shall impose on such Sub-processors data protection terms that protect the Personal Data to the same standard provided for by this Schedule C and shall remain liable for any breach of this Schedule C caused by a Sub-processor.

4.2 Changes to Sub-processors. Countly may, by giving no less than thirty (30) days' notice to Customer, add or make changes to the Sub-processors. Customer may object to the appointment of an additional Sub-processor within fourteen (14) calendar days of such notice on reasonable grounds relating to the protection of the Personal Data, in which case Countly shall have the right to cure the objection through one of the following options (to be selected at Countly's sole discretion): (a) Countly will cancel its plans to use the Sub-processor with regard to Personal Data or will offer an alternative to provide the Subscription Services without such Sub-processor; or (b) Countly will take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the Sub-processor with regard to Personal Data; or (c) Countly may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Subscription Services that would involve the use of such Sub-processor with regard to Personal Data, subject to a mutual agreement of the parties to adjust the remuneration for the Subscription Services considering the reduced scope of the Subscription Services. If none of the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Countly's receipt of Customer's objection, either party may terminate the Agreement and Customer will be entitled to a pro-rata refund for prepaid fees for Subscription Services not performed as of the date of termination.

4.3 Emergency Replacement. Countly may replace a Sub-processor if the reason for the change is beyond Countly's reasonable control. In such instance, Countly shall notify Customer of the replacement as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-processor pursuant to Section 4.2 above.

5.1 Data Subjects' Rights. Countly shall provide commercially reasonable assistance, including by appropriate technical and organizational measures as reasonably practicable, to enable Customer to respond to any inquiry, communication or request from a Data Subject seeking to exercise his or her rights under Applicable Data Protection Law, including rights of access, correction, restriction, objection, erasure or data portability, as applicable. In the event such inquiry, communication or request is made directly to Countly, Countly shall promptly inform Customer by providing the full details of the request. For the avoidance of doubt, Customer is responsible for responding to Data Subject requests for access, correction, restriction, objection, erasure or data portability of that Data Subject's Personal Data.

5.2 Data Protection Impact Assessments and Prior Consultation. Countly shall, to the extent required by Applicable Data Protection Law, provide Customer with reasonable assistance with data protection impact assessments, security, breach notifications or prior consultations with data protection authorities that Customer is required to carry out under Applicable Data Protection Law.

Any provision of security attestation reports (such as SOC 2, Type II or equivalent report) or audits shall take place in accordance with Customer's rights under the Agreement. If the Agreement does not include a provision regarding security attestation reports, Countly shall provide a copy of its most current security attestation report, together with its current ISO/IEC 27001 certificate and, where applicable, its TISAX assessment result, upon Customer's written request no more than once annually. If the Agreement does not include audit rights, Countly and Customer will discuss and agree in advance on the reasonable start date, scope and duration of and security and confidentiality controls applicable to any audit; and Countly reserves the right to charge a fee (based on Countly’s reasonable costs) for any such audit. Countly will provide further details of any applicable fee and the basis of its calculation to Customer in advance of such audit.

Upon termination or expiration of the Agreement, Countly shall in accordance with the terms of the Agreement delete or make available to Customer for retrieval all relevant Personal Data (including copies) in Countly's possession, save to the extent that Countly is required by any applicable law to retain some or all of the Personal Data. In such event, Countly shall extend the protections of the Agreement and this Schedule C to such Personal Data and limit any further processing of such Personal Data to only those limited purposes that require the retention, for so long as Countly maintains the Personal Data.

8.1 Where Customer Data processed subject to the UK GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer the EU Model Clauses (Module 4) as amended by the UK Addendum shall be deemed signed by Customer and incorporated into this Agreement. Table 3 of the UK Addendum shall be deemed populated in accordance with the information set out in Appendix A of this Schedule C; and

(b) to the extent a conflict exists between the terms of this Schedule C and the terms of the EU Model Clauses or the UK Addendum, the terms of the EU Model Clauses and/or UK Addendum shall take precedence.

8.2 Where Customer Data processed subject to the EU GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer, the EU Model Clauses shall be deemed signed by Customer and incorporated into this Agreement. The relevant Annexes of the EU Model Clauses shall be deemed populated in accordance with the information set out in Appendix A of this Schedule C; and

(b) to the extent a conflict exists between the terms of this Schedule C and the terms of the EU Model Clauses, the terms of the EU Model Clauses shall take precedence.

8.3 Where Countly makes a Restricted Transfer to a Sub-processor, Countly shall ensure that the transfer is covered by the EU Model Clauses (Module 3) and, for Customer Data subject to the UK GDPR, the UK Addendum, or by another valid transfer mechanism under Applicable Data Protection Law, and shall provide details of the mechanism relied upon to Customer on request.

Processing of Personal Data

Nature and Subject Matter: The Data Processing Services, including access to Customer's Countly server by Countly's operations staff where needed, and operational logs and metrics kept in Countly's monitoring stack.

Duration: The Processing begins when the Agreement takes effect and continues until the Agreement ends.

Location: Customer's Countly server runs in the Google Cloud region set in the Order Form.

Data Subjects

The Personal Data concerns the following categories of Data Subjects:

• Customer's employees
• End users of Customer’s websites and applications that send data to Customer's Countly server
• Customer's dashboard users

Purposes of the Processing

The Processing is necessary for the following purposes:

• Countly shall Process Personal Data as necessary to perform its obligations as set out in the Agreement and any written instructions provided by the Customer to Countly in accordance with this Schedule C.

Categories of Personal Data

The Personal Data that can be processed fall within the following categories:

• Randomly generated/pseudo anonymized/advertising ID
• Name
• Username
• Organization/Company
• Address
• Phone number
• Email
• Location data (country code, region, city, coordinates)
• Birth year
• Gender
• Events
• Time zone
• Time processed
• Device information (OS, OS version, screen size and density, browser, browser version, device model, device type, device manufacturer, locale, screen orientation)

Special Categories of Personal Data and/or Article 10 GDPR Personal Data (if applicable)

The Personal Data Processed falls within the following special categories of Personal Data/Article 10 data:

• N/A

Rights and Obligations of Customer

The rights and obligations of the customer where it is a controller shall be as set out in this Agreement and Applicable Data Protection Law.

Sub-Processors

Those on the Sub-processor List (Section 4.1) on the date the Agreement takes effect, as updated in accordance with Sections 4.2 and 4.3.

Restricted Transfers