Skip to content

Addendum X To Data Processing Addendum

This Addendum X to the Data Processing Addendum (the “Addendum”) forms part of the applicable Agreement between 6Sense Insights, Inc. or an Affiliate of 6Sense Insights, Inc. (collectively, “6sense”) and the other party identified in the Agreement (“Customer”), where 6sense is providing Contact Data (as defined in the Agreement) subject to European Data Protection Law (as defined in the DPA and restated below for ease of reference).

WHEREAS, 6sense provides certain services to Customer (“Services”) under the terms of an agreement (the “Agreement”) and in connection therewith 6sense and Customer may be parties to a Data Processing Addendum (the “DPA”);

WHEREAS, 6sense and Customer now wish to add certain terms to the DPA (or the Agreement, if there is no DPA in effect) to address requirements under the European Data Protection Law that may be applicable to EU Contact Data (defined below) under the Agreement, as more fully set forth in this Amendment;

NOW THEREFORE, in consideration of the terms and conditions stated herein, and without limiting any other obligations that apply to Contact Data under the Agreement, as applicable, with respect to any Contact Data that is subject to European Data Protection Law (“EU Contact Data”) provided by 6sense to Customer under the Agreement, the parties agree as follows:

1. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of personal data and on the free movement of such data (General Data Protection Regulation) (the “EU GDPR“); (ii) in respect of the United Kingdom the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the “UK GDPR“); and (iii) the Swiss Federal Data Protection Act (“Swiss GDPR“); and collectively the above are referred to hereunder as the “GDPR.”

2. Independent Controllers. Each Party is a Controller of the EU Contact Data it provides to the other Party under the Agreement and solely responsible for its own processing of the EU Contact Data.

3. International Transfers. To the extent that EU Contact Data is transferred under this Agreement from the European Economic Area, Switzerland, or the United Kingdom to a country that has not received an adequacy decision from the European Commission, and to the extent such transfers are subject to European Data Protection Law, the parties agree that the following transfer mechanism will apply to any transfers of EU Contact Data under this Agreement:

(1) In relation to transfers of EU Contact Data protected by the EU GDPR and transferred in accordance with this Agreement the EU SCCs shall apply, completed as follows:

i. Module One will apply;

ii. in Clause 7, the optional docking clause will apply;

iv. in Clause 11, the optional language will not apply;

v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;

vi. in Clause 18(b), disputes shall be resolved before the courts of Ireland;

vii. Annex I of the EU SCCs shall be deemed completed with the information set out in Annex 1 to this Addendum, as applicable; and

viii. Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this Addendum.

(2) In relation to transfers of EU Contact Data protected by the UK GDPR, the EU SCCs will also apply in accordance with paragraph (1) above, with the following modifications:

(i) any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” shall be interpreted as references to the UK GDPR; references to specific Articles of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK GDPR;

(ii) references to “EU”, “Union” and “Member State law” are all replaced with “UK”; Clause 13(a) and Part C of Annex I of the EU SCCs are not used; references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the Information Commissioner and the courts of England and Wales; and

(iii) Clause 17 of the EU SCCs is replaced to state that “The Clauses are governed by the laws of England and Wales” and Clause 18 of the EU SCCs is replaced to state “Any dispute arising from these Clauses shall be resolved by the courts in England. A data subject may bring legal proceeding against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts,” unless the EU SCCs, implemented as described above, cannot be used to lawfully transfer such EU Contact Data in compliance with the UK GDPR in which case the UK SCCs shall instead be incorporated by reference and form an integral part of this DPA and shall apply to such transfers. Where this is the case, the relevant Annexes or Appendices of the UK SCCs shall be populated using the information contained in Annexes I and II of this Addendum (as applicable); and if neither the EU SCCs nor the UK SCCs applies, then the parties shall cooperate in good faith to implement appropriate safeguards for transfers of such EU Contact Data as required to permitted by the UK Data Protection Laws without undue delay;

(3) In relation to transfers of EU Contact Data protected by the Swiss DPA, the EU SCCs will also apply in accordance with paragraph (1) above, with the following modifications:

(i) any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA;

(ii) references to “EU,” “Union,” “Member State,” and “Member State law,” shall be interpreted as references to Switzerland and Swiss law, as the case may be; and

(iii) references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner and competent courts in Switzerland, unless the EU SCCs, implemented as described above, cannot be used to lawfully transfer such EU Contact Data in compliance with the Swiss DPA in which case the Swiss SCCs shall instead be incorporated by reference and form an integral part of this DPA and shall apply to such transfers. Where this is the case, the relevant Annexes or Appendices of the Swiss SCCs shall be populated using the information contained in Annexes I and II to this Amendment (as applicable);

(4) It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Addendum, the Standard Contractual Clauses shall prevail to the extent of such conflict;

(5) If 6sense adopts an alternative data export mechanism (including any new version of or successor to the Standard Contractual Clauses or other applicable standard adopted pursuant to European Data Protection Law) for the transfer of EU Contact Data not described in this Agreement (“Alternative Transfer Mechanism”), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this Addendum (but only to the extent such Alternative Transfer Mechanism complies with applicable data protection law and extends to the territories to which EU Contact Data is transferred).

4. Nothing herein reduces either party’s obligations under the Agreement or DPA. This Addendum is incorporated into and forms part of the Agreement. For matters not addressed in this Addendum, the terms of the Agreement apply. With respect to the rights and obligations of the parties vis-à-vis each other, in the event of a conflict between the terms of the Agreement and this Addendum, the terms of this Addendum will control. In the event of a conflict between the terms of the Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.

Annex I

LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

1. Name: 6Sense Insights, Inc., or its applicable Affiliate

Address: 450 Mission Street, Suite 201, San Francisco, CA 94105

Contact details: [email protected]

Activities relevant to the data transferred under these Clauses: As described in the Agreement.

Role (controller/processor): Controller

Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

1. Name: Customer

Address: Provided in the Order Form Signature Block

Contact details: Provided in the Order Form Signature Block

Activities relevant to the data transferred under these Clauses: As described in the Agreement.

Role (controller/processor): Controller

Description of transfer

Categories of data subjects whose personal data is transferred

Business contacts

Categories of personal data transferred

Categories of personal data transferred may include:

  • Name
  • Email
  • Company Name
  • Company Business Address(es)
  • Business Phone Numbers (corporate, direct dial, mobile)
  • Job Title/Job Role
  • Education
  • Employment-Related Information
  • Social Media Profile(s)

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous

Nature of the processing

As set out in the Agreement.

Purpose(s) of the data transfer and further processing

As set out in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

During the term of the Agreement and as specified in the Agreement.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

N/A

Competent supervisory authority

Identify the competent supervisory authority/ies in accordance with Clause 13

The competent supervisory authority in accordance with the Clause 13 of the 2021 Standard Contractual Clauses is the Republic of Ireland unless Customer is established in the European Union or has appointed a representative pursuant to Article 27(1) of the GDPR; with respect to the processing of Personal Data to which the UK GDPR applies, the competent supervisory authority is the Information Commissioners Office (the “ICO”).

Annex II – technical and organisational measures including technical and organisational measures to ensure the security of the data

Each party will implement and maintain a comprehensive written information security program designed to protect EU Contact Data from unauthorized access, use, modification, disclosure or destruction. Without limiting the generality of the foregoing, as part of its information security program, each party will:

  • limit access to EU Contact Data to the minimum number of its personnel who require such access in order to perform its obligations under the Agreement;
  • provide appropriate training to its personnel who process EU Contact Data;
  • use multi-factor authentication for access to any systems storing EU Contact Data; and
  • use reputable services and/or tools to continuously monitor for malicious or unauthorized behavior.