This Data Processing Addendum (“Addendum”) is entered into by and between Doppler Technologies, Inc., a California corporation with its primary place of business at 340 S. Lemon Avenue #5880 Walnut, CA 91789 (“Doppler”), and the legal entity using Doppler’s services (“Customer”) pursuant to Software License Agreement executed concurrently herewith (the “Agreement”). Doppler and Customer are hereinafter referred to from time to time individually as “party” and collectively as “parties.”

The parties acknowledge that the terms of this Addendum, including the Appendices, are incorporated into and form part of the Agreement. Capitalized terms have the meaning given to them in the Agreement unless defined elsewhere in this Addendum. Where this Addendum uses terms that are defined in Applicable Data Protection Law (defined below), those terms shall have the same meaning as given to those terms (or an equivalent term) in the applicable law. 

In the event and to the extent of a conflict between the provisions of the Agreement and this Addendum, this Addendum will prevail. Except as expressly set forth in this Addendum, all other provisions of the Agreement will remain in full force and effect. To the extent that the EU SCCs (defined below) or the UK International Data Transfer Agreement  (defined below) are incorporated herein, such terms shall take precedence over both this Addendum and the Agreement to the extent necessary to resolve the conflict or inconsistency. For the avoidance of doubt, execution of the Agreement shall be deemed to constitute signature and acceptance of this Addendum and the EU SCCs and/or UK International Data Transfer Addendum (as applicable) incorporated herein. 

 means any business entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with a party to the Agreement. For purposes of this definition, “control” means an ownership, voting, or similar interest representing fifty percent (50%) or more of the total interests then outstanding of the entity in question.

 means all laws and regulations applicable to the processing of personal data under the Agreement. For the sake of clarity, Applicable Data Protection Law includes, without where applicable: (i) the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC (“e-Privacy Directive”), and any national implementations in the European Economic Area (“EEA”), (ii) the United Kingdom Data Protection Act of 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Privacy Act”); (iii) the Swiss Federal Act on Data Protection (revised 2023) (“Swiss FADP”); and (iv) US Privacy Laws (as defined below), as amended or replaced from time to time. 

 means the standard contractual clauses between controllers and processors for Data Transfers (module 2), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means the Customer entities or Affiliates that are party to the Agreement. 

 means personal data that relates to Customer’s relationship with Doppler and for which Doppler determines the means and purposes of processing. 

 means any personal data that is (i) provided or made available to Doppler or its Sub-processors by or on behalf of Customer or a controller for whom Customer acts as a processor in connection with support, implementation, or other professional services under the Agreement; and/or (ii) generated by Doppler or its Sub-processors in the performance of the Agreement. 

 means any data relating to Customer’s use, support, and/or operation of the Services which is used by Doppler in an aggregated and anonymous manner. 

“Data Protection Supervisory Authority”

 means a supervisory authority or other government body responsible for the administration, implementation, and/or enforcement of Applicable Data Protection Law and includes, without limitation, competent supervisory authorities of the European Union (“EU”) and its member states, the Swiss Federal Data Protection Authority, and the United Kingdom (“UK”) Information Commissioner’s Office. 

 means any situation in which Customer Data is provided or otherwise made available or accessible for processing, either directly or via onward transfer, from inside Europe to a Third Country. 

 means (i) the Controller-to-Processor Clauses, or (ii) the Processor-to-Processor Clauses, as applicable in accordance with Section 2.1 (Scope and Role of the Parties), including the Elections and on the basis that Appendix 1 of this Addendum operates as Annex I to the EU SCCs and Appendix 2 of this Addendum operates as Annex II to the EU SCCs. 

“European and UK Data Protection Law”

 means all data protection laws and regulations applicable to Europe, including (i) the GDPR; (ii)the e-Privacy Directive; (iii) applicable national implementations of (i) and (ii); and (iii) in respect of the UK, the UK Privacy Act. 

 means, for the purposes of this Addendum, the EEA, Switzerland, and the UK.

 means the standard contractual clauses between processors for Data Transfers (module 3), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means any confirmed or reasonably suspected unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, or alteration of, or unauthorized disclosure of or access to, Customer Data on systems managed or otherwise controlled by Doppler.

 means any type of personal data that is designated as “sensitive” or “special category of personal data” or is otherwise subject to additional restrictions under Applicable Data Protection Law. 

 means any person or entity engaged by Doppler or its Affiliates to perform Doppler’s obligations under the Agreement. 

 means a country outside of Europe not recognized by the European Commission or the competent UK regulatory authority as providing an adequate level of protection for personal data under European and UK Data Protection Law. 

“UK International Data Transfer Addendum”

 means the UK International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner, Version B1.0, effective as of 21 March 2022, and on the following basis: (i) with respect to Table 1 of the UK International Data Transfer Addendum, the parties’ details and key contact information is located in Appendix 1 of this Addendum; (ii) with respect to Table 2, information about the version of the EU SCCs, modules, and selected clauses are located in the Elections, and (iii) with respect to Table 3, information about the parties and a description of the transfer is set forth in Appendix I to this Addendum, a description of Doppler’s technical and organizational security measures is located in Appendix II, and Doppler’s list of sub-processors is set forth in Section 5.1 (Authorized Sub-processors). 

 means Customer Data, the processing of which is within the territorial scope of the UK Privacy Act. 

 means, collectively all US federal and state privacy laws and their implementing regulations that apply generally to the processing of individuals’ personal data, including, but not limited to the following: (i) California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “

”); (ii) Colorado Privacy Act; (iii) Connecticut Data Privacy Act; (iv) Delaware Personal Data Privacy Act; (v) Florida Digital Bill of Rights; (vi) Indiana Consumer Data Protection Act; (vii) Iowa Act Relating to Consumer Data Protection; (viii) Kentucky Consumer Data Protection Act; (ix) Maryland Online Data Privacy Act; (x) Minnesota Consumer Data Privacy Act; (xi) Montana Consumer Data Privacy Act; (xii)  Nebraska Data Privacy Act; (xiii) New Hampshire Senate Bill 255; (xiv) New Jersey Senate Bill 332; (xv) Oregon Consumer Privacy Act; (xvi) Rhode Island Data Transparency and Privacy Protection Act; (xvii) Tennessee Information Privacy Act; (xviii) Texas Data Privacy and Security Act; (xix) Utah Consumer Privacy Act; and (xx) Virginia Consumer Data Protection Act; as each become effective and may be amended or replaced. In the event of a conflict in the meanings of defined terms in the US Privacy Laws, the most restrictive law applicable will apply.

. The parties acknowledge and agree that to the extent Doppler processes Customer Data in connection with providing support, implementation, or other services under the Agreement, Doppler will act as processor to Customer, who may act as either a controller or a processor (or equivalent terms under Applicable Data Protection Law). For clarity, the parties acknowledge that the Software is deployed in Customer-controlled environments and that Doppler does nto host or otherwise routinely process Customer Data as part of the core functionality of the Software. Each party shall comply with its obligations under Applicable Data Protection Law, and this Addendum, when processing Customer Data. When Customer is acting as a controller, the Controller-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. When Customer is acting as a processor, the Processor-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. Customer agrees that it is unlikely that Doppler will know the identity of Customer’s controllers, if any, because Doppler has no direct relationship with Customer’s controllers. Therefore, Customer agrees that it will fulfill Doppler’s obligations to Customer’s controllers under the Processor-to-Processor Clauses. For the avoidance of doubt, this Addendum does not apply to Customer Usage Data or Customer Account Data. 

. Doppler shall process Customer Data only in accordance with Customer’s documented lawful instructions as set forth in (i) the Agreement, including this Addendum and any applicable order forms; (ii) as necessary to comply with applicable law; (iii) or as otherwise agreed in writing or as initiated by Authorized Users in their use of the Software and requires for support, implementation, or other professional services (“Permitted Purposes”). Customer may give additional instructions throughout the term of the Agreement. Doppler shall immediately inform Customer if it is unable to follow those instructions. 

 Except as expressly permitted by Applicable Data Protection Law, Doppler will not sell or share Customer Data (as those terms are defined in applicable US Privacy Laws) to any third party, nor retain, use, or disclose such data (i) for any purposes other than those specified in this Agreement and this Addendum; (ii) for any commercial purpose other than the specific business purposes specified in the Agreement and this Addendum, including to provide services to a different business; and (iii) outside the direct business relationship between Customer and Doppler, including to combine or update Customer Data with information received from or on behalf of another source or collected from Doppler’s own interactions with a data subject. Doppler will limit the collection, use, retention, and disclosure of such data to activities reasonably necessary and proportionate to achieve the purposes set out in this Addendum and the Agreement and will not process such data in a manner incompatible with those purposes. Doppler will not attempt to re-identify any pseudonymized, anonymized, aggregated, or de-identified personal data without Customer’s express written permission. 

 Customer represents and warrants that (i) it has complied, and will continue to comply, with all applicable laws, including Applicable Data Protection Law, in respect of its processing of Customer Data and any processing instructions it issues to Doppler; and (ii) it has, and will continue to have, the right to transfer, or provide access to, the personal data to Doppler for processing in accordance with the terms of the Agreement and this Addendum. Customer shall have the sole responsibility for the accuracy, quality, and legality of Customer Data and the means by which Customer acquired Customer Data. Without prejudice to the generality of the foregoing, Customer agrees that it shall be responsible for complying with all laws (including Applicable Data Protection Law) applicable to any content created, sent, or managed through the Software and related support/professional services. Customer specifically acknowledges and agrees that its use of the Software and related support/professional services will not violate the rights of any data subject that has opted-out from the sale or other disclosure of his or her personal data. 

 Customer acknowledges that Doppler is neither responsible for determining which laws or regulations are applicable to Customer’s business nor whether Doppler’s provision of the Software and related support/professional services meets or will meet the requirements of such laws or regulations. Customer will ensure that its instructions comply with Applicable Data Protection Law and Doppler’s processing of the Customer Data in accordance with Customer’s instructions will not cause Doppler to violate any applicable law, regulation, or rule, including without limitation Applicable Data Protection Law. Doppler will inform Customer if it becomes aware or reasonably believes that Customer’s data processing instructions violate Applicable Data Protection Law.

 Doppler shall grant access to Customer Data to members of its personnel only to the extent strictly necessary for the implementation, management, and monitoring of the Agreement. It will further ensure that any person it authorizes to process the Customer Data shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

 Customer agrees that it is unlikely that Doppler would become aware that Customer Data it has received is inaccurate or outdated. Nonetheless, if Doppler does become aware that Customer Data it has received is inaccurate, or has become outdated, it shall inform Customer without undue delay and shall cooperate with Customer to erase or rectify the data. 

 Doppler shall only process Customer Data for the duration specified in Appendix 1.B. Upon Customer's request or upon termination or expiration of the Agreement, Doppler agrees, at Customer’s option, exercised by delivery to Doppler in writing of its instruction, to either deliver to Customer or destroy in a manner that prevents Customer Data from being reconstructed any Customer Data and any copies thereof in Doppler's control or possession, except that this requirement shall not apply to the extent Doppler is required by applicable law to retain some or all of the Customer Data or to Customer Data it has archived on back-up systems, which Customer Data Doppler shall securely isolate, protect from any further processing, and eventually delete in accordance with Doppler’s deletion policies, except to the extent required by applicable law.

Responding to Data Subjects and Other Requests

 To the extent applicable, Customer may use features of the Software  to respond to requests from data subjects to exercise their rights under Applicable Data Protection Law. To the extent Customer, in its ordinary use of the Software and related support/professional services, does not have the ability to address a data subject request to exercise their rights under Applicable Data Protection Law, Doppler shall, upon Customer’s written request, provide commercially reasonable assistance to Customer in responding to such data subject request. If complying with Customer’s request for assistance will require Doppler to expend significant resources, such assistance shall be at Customer’s expense (scoped in advance). 

Handling Requests Made Directly to Doppler

. In the event that any request, correspondence, enquiry or complaint from a data subject, regulator, or third party, including, but not limited to law enforcement, is made directly to Doppler in connection with Doppler’s processing of Customer Data, Doppler shall promptly inform Customer providing details of the same, to the extent legally permitted. Unless legally obligated to do so, Doppler shall not respond to any such request, inquiry, or complaint without Customer’s prior written consent. In the case of a legal demand for disclosure of Customer Data in the form of a subpoena, search warrant, court order or other compulsory disclosure request, Doppler shall attempt to redirect the requesting party or agency to request disclosure from Customer. Customer agrees that Doppler may provide Customer’s basic contact information for this purpose. If Doppler is unable to redirect the requesting party or agency, Doppler shall act in accordance with its obligations under the EU SCCs or UK International Data Transfer Addendum, as applicable, incorporated herein. For the avoidance of doubt, nothing in the Agreement, including this Addendum shall restrict or prevent Doppler from responding to any data subject or other requests in relation to personal data for which Doppler is a controller.

 If Doppler believes or becomes aware that its processing of Customer personal data is likely to result in a high risk to the data protection rights and freedoms of data subjects, Doppler shall inform Customer and (taking into account the nature of the processing and the information available to Doppler) provide commercially reasonable cooperation to Customer in connection with any data protection impact assessment or consultations with Data Protection Supervisory Authorities that may be required under Applicable Data Protection Law. Doppler shall comply with the foregoing by: (i) complying with 

 (ii) providing the information contained in the Agreement, including this Addendum; and (iii) if the foregoing sub-sections (i) and (ii) are insufficient for Customer to comply with such obligations, upon request, providing additional reasonable assistance at Customer’s expense (scoped in advance).

. Doppler has implemented and will maintain appropriate  technical  and  organizational  security  measures designed  to  preserve  the  security  and confidentiality of Customer Data in accordance with Doppler’s security standards described in 

. Customer is responsible for reviewing the information Doppler makes available regarding its data security and making an independent determination as to whether the Software and related support/professional services meet Customer’s requirements and legal obligations, including its legal obligations under Applicable Data Protection Law. Customer acknowledges that the Security Measures are subject to technical progress and development and that Doppler may update or modify the Security Measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the Software and related support/professional services.

. Doppler shall, to the extent permitted by law, notify Customer without undue delay of any reasonably suspected or actual Security Incident which affects Customer Data processed by Doppler in connection with the provision of support, implementation, or other professional services under the Agreement. Such notification will be delivered to one or more of Customer’s business or administrative contacts by any means Doppler selects, including via email. It is Customer’s sole responsibility to ensure it maintains accurate contact information in the Software and related support/professional services and under the Agreement at all times. The notice shall summarize in reasonable detail the nature and scope of the Security Incident, to the extent known, and the corrective action already taken or to be taken by Doppler. Furthermore, Doppler shall provide timely information relating to the Security Incident as it becomes known or as reasonably requested by Customer and shall promptly take reasonable steps to remedy or mitigate the effect of any Security Incident. Doppler’s notification of or response to a Security Incident shall not be construed as an acknowledgement by Doppler of any fault or liability with respect to the Security Incident. The parties will collaborate on whether any notice of breach is required to be given to any person, and if so, the content of that notice. For clarity, Doppler will not publicly disclose any information regarding the Security Incident without Customer’s prior written consent, except (i) to its own employees, customers, advisors, agents, or contractors or (ii) where and to the extent explicitly compelled to do so by Applicable Data Protection Law, to Applicable Data Protection Supervisory Authorities and/or data subjects. Unless prohibited by an applicable statute or court order, Doppler shall also notify Customer of any third-party legal process relating to any Security Incident, including, but not limited to, any legal process initiated by any governmental entity. 

 Customer agrees that an unsuccessful Security Incident will not be subject to 

Section 4.3 (Security Incident Response).

 An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of Doppler’s equipment or facilities used to store or process Customer Data and could include, without limitation, pings and other broadcast attacks on firewalls, port scans, unsuccessful log-in attempts or invalid URLs, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or headers) or similar incidents. 

 Notwithstanding the above, Customer agrees that except as provided in this Addendum or the Agreement, Customer is responsible for its secure use of the Software and related support/professional services, including securing its account authentication credentials, using the Software and related support/professional services strictly as permitted under the Agreement, and using features and functionalities made available by Doppler to maintain appropriate security in light of the nature of the data processed. 

 The parties acknowledge that Customer must be able to assess Doppler’s compliance with its obligations under Applicable Data Protection Law and this Addendum. To facilitate such assessment, Doppler will keep appropriate documentation on the processing activities carried out on behalf of Customer under the Agreement, and upon written request, make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set out in this Addendum. 

 To the extent that Doppler is unable to demonstrate its compliance with Applicable Data Protection Law and this Addendum through appropriate documentation as described in 

Section 4.6 (Documentation and Compliance)

 above, then, upon Customer’s written request and subject to the confidentiality obligations set forth in the Agreement, Doppler shall allow for and contribute to audits and inspections conducted by Customer (or Customer’s independent, third-party auditor that is not a competitor of Doppler). Audits shall occur at most annually or more frequently (i) in response to a demand from a Data Protection Supervisory Authority, (ii) following notice of a Security Incident, or (iii) as a follow-up to a duly conducted annual audit. Audits must be preceded by thirty (30) days advance written notice, must be conducted during Doppler’s normal business hours, and must be limited to systems and procedures within Doppler’s control and relevant to Doppler’s processing of Customer Data, taking into account the limited nature of processing under the Agreement. Doppler will make its personnel, records, and similar items available upon fewer than thirty (3) days advance notice, but no less than reasonable notice if (i) requested by a Data Protection Supervisory Authority pursuant to an audit of Customer or (ii) following notice of a Security Incident. In lieu of such an audit, in the event that Doppler independently obtains third-party annual audits of its privacy and security program, Customer agrees that Doppler may satisfy its obligations under this 

, by making available to Customer a copy of Doppler’s then most recent third-party audit report. Such audit reports will be made available to Customer upon Customer’s written request, at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement. If any audit reveals any material vulnerability, Doppler shall take commercially reasonable steps to correct such vulnerability. 

 Doppler has Customer’s general authorization to engage third-party Sub-processors to fulfill its contractual obligations under this Addendum or to provide certain services on its behalf (including third-party support and implementation services). A list of the Sub-processors Doppler currently engages can be found 

 At least thirty (30) days prior to adding or replacing any Sub-processor, Doppler will update this list and provide Customer with a mechanism to obtain notice of that update. Customer may object to in writing to Doppler's appointment or replacement of a Sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss commercially reasonable alternative solutions in good faith. If the parties cannot reach resolution, Doppler will, in its sole discretion, either not appoint such Sub-processor, direct such Sub-processor to not process Customer Data, or permit Customer to suspend or terminate the Agreement without liability to either party, in which case, however, and notwithstanding anything to the contrary in this Addendum, the applicable EU SCCs or UK International Data Transfer Addendum (as applicable), or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing. 

 Doppler shall: (i) conduct appropriate due diligence on each Sub-processor it engages to perform services on its behalf; (ii) enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Customer Data as those in this Addendum, to the extent applicable to the nature of the service provided by such Sub-processor; and (iii) remain responsible for such Sub-processor’s compliance with the obligations of this Addendum and for any acts or omissions of such Sub-processor that cause Doppler to breach any of its obligations under this Agreement.

Doppler will not engage in any Data Transfers or transmit, directly or indirectly any Customer Data to any country outside the country from which such data was collected, without complying with Applicable Data Protection Law. Where Doppler engages in an onward transfer of Customer Data, Doppler will ensure that a lawful data transfer mechanism is in place prior to transferring such data from one country to another. 

 To the extent that Doppler receives Customer Data protected by European and UK Data Protection Laws, Doppler agrees to abide by and process such data in compliance with the EU SCCs and UK International Data Transfer Addendum, as applicable, which are incorporated herein in full and form an integral part of this Addendum. 

The EU SCCs shall be completed as follows: 

The “data exporter” and the “data importer” are set forth in 

Where Customer acts as a controller, the Controller-to-Processor Clauses shall apply to Data Transfers from Customer (as a controller) to Doppler (as a processor). Where Customer acts as a processor, the Processor-to-Processor Clauses shall apply to Data Transfers from Customer (as a processor) to Doppler (as a sub-processor). 

Clause 7 (the optional docking clause is not included. 

For purposes of Clause 11 (regarding redress), the optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included. 

For purposes of Clause 17 (regarding governing law), Option 1 is selected and the law of Ireland shall govern. 

For purposes of Clause 18(b) (Disputes), the courts of Dublin, Ireland are selected. 

of this Addendum shall replace Annexes I and II of the EU SCCs. 

Annex III of the EU SCCs (list of sub-processors) is not applicable as the parties have chosen general authorization under Clause 9). 

The Tables within the UK International Data Transfer Addendum shall be deemed completed as follows: 

 of this Addendum shall replace Tables 1 and 2 of the UK International Data Transfer Addendum. 

The Approved EU SCCs referenced in Table 2 shall be the applicable Controller-to-Processor Clauses or Processor-to-Processor Clauses, as completed in accordance with the elections in 

In Table 3, Annexes 1 (A and B), II, and III to the “Approved EU SCCs” are 

In Table 4, both the “importer” and the “exporter” can terminate the UK International Data Transfer Addendum. 

For the avoidance of doubt, the UK International Data Transfer Addendum shall apply to any Data Transfer pursuant to the Agreement that involves UK Personal Data. 

For Data Transfers that are subject to the FADP, the EU SCCs form part of this Addendum, with the following differences to the extent required by the FADP: 

References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the Data Transfers are subject exclusively to the FADP and not to the GDPR. 

The term “member state” in the EU SCCs shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs. 

The relevant Data Protection Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the Data Protection Supervisory Authority identified in the EU SCCs (where the FADP and GDPR apply, respectively). 

Additional Safeguards for data Transfers from Europe.

 Doppler agrees to apply the following safeguards (“

”) to protect Customer Data to an equivalent level as Applicable Data Protection Law. 

Doppler shall use encryption for data both in transit, and where possible, at rest; 

Doppler shall use available legal mechanisms to challenge demands for access to Customer Data by public authorities (as such is understood under the GDPR and EU SCCs) that it receives, and for which there is no clear and lawful basis, as well as any non-disclosure provisions attached thereto; 

Doppler will notify Customer if Doppler can no longer comply with the EU SCCs, UK International Data Transfer Addendum, or these Additional Safeguards without being required to identify the specific provision with which it can no longer comply. 

 Each party and all of its Affiliates’ liability to the other party and its Affiliates, taken together arising out of or related this this Addendum, including the EU SCCs or UK International Data Transfer Addendum, as applicable, shall be subject to the exclusions and limitations of liability set forth in the Agreement. For the avoidance of doubt, Doppler and its Affiliates’ total liability for all claims from Customer arising out of or relating to the Agreement or this Addendum shall apply in aggregate. 

 shall alter the parties’ liability to data subjects as provided for in either the EU SCCs or UK International Data Transfer Addendum, as applicable. Each party agrees that it will be liable to data subjects for the entire damage resulting from a violation by it of Applicable Data Protection Law. If one party paid full compensation for the damage suffered, it is entitled to claim back from the other party that part of the compensation corresponding to the other party’s part of the responsibility for the damage. Notwithstanding the foregoing, with respect to processing of personal data subject to either the EU SCCs or UK International Data Transfer Addendum, as provided herein, the allocation of liability to data subjects as between the parties shall be governed by the applicable terms therein taking into consideration that both parties agree that Customer will be liable to data subjects for the entire damage resulting from a violation of European and UK Data Protection Law with regard to processing of personal data for which it is a controller, and that Doppler will only be liable to data subjects for the damage resulting from a violation of the obligations of European and UK Data Protection Law directed to processors where it has acted outside of or contrary to Customer’s lawful instructions or violated this Addendum. Doppler will be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

8. Modification and Termination of this Addendum:

 This Addendum shall remain in effect until the later of (i) termination of the Agreement or (ii) such time as Doppler no longer processes any Customer Data on behalf of Customer. Failure to comply with any of the material provisions of this Addendum is considered a material breach of the Agreement. In the event of termination, Doppler will return or destroy data pursuant to 

Section 2.8 (Return or Deletion of Customer Data).

 This Addendum may be amended only by a written agreement executed by authorized representatives of both parties; provided that Doppler may update this Addendum to the extent necessary to reflect changes in Applicable Data Protection Law, upon written notice to Customer. 

 This Addendum supersedes and replaces all prior and contemporaneous agreements, oral and written, with regard to the subject matter of this Addendum, including any prior data processing addenda entered into between Customer and Doppler. If there is any conflict between this Addendum and any agreement, including the Agreement, the provisions of the following documents (in order of precedence) shall prevail: (a) the EU SCCs and their Annexes and/or the UK International Data Transfer Addendum and its Tables (as applicable); then (b) this Addendum and its Appendices; then (c) the Agreement.

 If any provision of this Addendum is found by any court or administrative body of competent jurisdiction to be invalid and unenforceable, the invalidity or unenforceability of such provision shall not affect any other provision of this Addendum and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.

10.2 Invalidity of the EU SCCs and/or UK International Data Transfer Addendum

. If the EU SCCs and/or UK International Data Transfer Addendum (as applicable) cease to or do not (including due to insufficient supplementary measures) meet the requirements under European and UK Data Protection Law or otherwise cease to or do not provide a valid legal basis to transfer personal data outside the EEA, EU, UK, or Switzerland, Doppler shall (i) promptly notify Customer using the email address on file; (ii) upon request (whether or not Doppler has provided notice to Customer) immediately stop and, as applicable procure the cessation of the processing by its Sub-processors of the affected personal data promptly after the occurrence of any such notifiable event outside the relevant countries (except to the extent directed otherwise by Customer), and as soon as possible put in place commercially reasonable measures to mitigate the impact of such; and (iii) discuss with Customer commercially reasonable alternative measures in order to ensure an adequate level of protection with respect to the privacy rights of individuals and the lawful transfer of, or access to, personal data outside the relevant countries whilst continuing the provision of the Software and related support/professional services with minimum disruption to Customer. If the parties cannot reach resolution, Customer may suspend or terminate the Agreement without liability to either party, in which case, notwithstanding anything to the contrary in this Addendum or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing. 

DPA - On-prem

Sub-Processors

This Cookie Notice (“Notice”) explains how Doppler Technologies, Inc. (“Doppler”, "we", "us", and "our") uses cookies, web beacons, session replay tools, pixels, tags, local storage, and similar technologies (collectively, “Tracking Technologies”) in connection with your use of our Services. For purposes of this Notice, the term “Services” refers collectively to our marketing website, currently available at 

; our cloud-based application, currently available at 

; as well as all other websites that Doppler operates or manages and which link to this Notice.

Tracking Technologies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as provide reporting information

. Types of Tracking Technologies include the following:

 Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie, to develop a record of the user’s online activity. Cookies set by the website owner (in this case, Doppler) are called "first-party cookies". Cookies set by parties other than the website owner are called "third-party cookies". Third-party cookies enable third-party features or functionality to be provided on or through the website (e.g., advertising, interactive content, and analytics). The parties that set these third-party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites.

 Pixels, web beacons, and tags are pieces of code or transparent graphics embedded in web pages or emails that collect information about your engagement on our Services and provide analytical information to the website owner. For example, a pixel tag allows a website owner to record that a user has visited a particular web page and web beacons in an email help a website owner understand whether messages have been opened, acted on, or forwarded.

 Session replay tools capture and play back your interactions with our Services, including clicks, scrolls, dwell time, mouse movements, keystrokes, and webform data in real-time.

 Chatbot and live chat tools, which may be powered by artificial intelligence, enable real-time communication with users. These technologies may capture and store the content of your messages, along with related information such as timestamps and session data, to facilitate conversations, improve functionality, and support analytics and quality assurance efforts.

Yes. We, as well, as third parties we have partnered with to provide analytics services and to serve advertisements on our behalf across the internet and in mobile applications may use all of the Tracking Technologies described above to automatically collect information about your use of our Services.

By interacting with our Services, or consenting via our cookie banner, you expressly agree to this type of monitoring and recording for the purposes described below.

In some cases, we may use Tracking Technologies to collect personal information, or information that becomes personal information if we combine it with other information. If a combination of information that we collect identifies you as an individual, we will treat the combined information as personal information. For more information about how we handle personal information we collect from and about you in the course of providing our Services, please see our 

How Does Doppler Use the Information Gathered Through Tracking Technologies?

Doppler uses the information gathered through Tracking Technologies for a variety of purposes including the following:

 We use user session data, to remember whether you are logged in, hold your preferences, ensure that the Services are working properly, and generally track and analyze usage, navigational, and other statistical information.

 We gather analytics information through Tracking Technologies in order to track and analyze usage, navigational, and other statistical information. For instance, we may track how many users visit a particular page, measure the performance of our off-site advertisement or email campaigns, or analyze the popularity of particular content or features. This information helps us improve navigation across our Services, identify functionality issues, and informs development of future products and features. 

 We partner with third-party marketing and advertising providers in order to manage our advertising on other websites. These third-party service providers may use cookies and similar technologies to track your engagement with our Services as well as our online advertising and email marketing campaigns. This includes remarketing, which shows relevant ads to an audience based on prior browsing patterns on our Services, and attribution tracking, which estimates which advertising or marketing source brought someone to our Services and which marketing sources, including affiliate links, led to actions like a visit or a conversion to an active user. 

 Tracking Technologies also help us ensure the safety and security of your websites and online platforms and those who engage with this. This includes detecting, preventing, and responding to security incidents and other fraudulent or illegal behavior.

What Tracking Technologies Does Doppler Use?

The Tracking Technologies we use can be divided into the general categories described below. However, some of the Tracking Technologies listed below will only be used if you use certain products, features, or if you select certain preferences. Other Tracking Technologies will always be used.

 These Tracking Technologies are essential for our Services to function and they cannot be switched off or disabled. They allow you to access our Services, applications and tools and help Doppler identify irregular website behavior, prevent fraudulent activity, and improve security.

 These Tracking Technologies allow us to offer you enhanced functionality and make our website easier to use (e.g., by remembering your log-in details, accelerating display of our Website through load balancing, and enabling you to communicate with us via live chat).

These Tracking Technologies allow us to assess the performance of our Services, including as part of our analytic practices to help us understand how individuals use our Services and help us tailor our Services (for example, by placing the most sought-after pages where they can be most easily found).

We may use first-party or third-party Tracking Technologies to collect information on user behavior and demographics in order to deliver personalized advertising to you on our Services or on third-party websites.

How Can I Control Which Tracking Technologies Are Placed When I Use Doppler’s Services?

Many jurisdictions require or recommend that businesses inform users/visitors about what types of Tracking Technologies they use, and in certain circumstances, obtain their consent before placing certain types of Tracking Technologies.

 Doppler displays a cookie banner to visitors the first time they land on our website, which links to this Notice and allows you to choose whether to accept or reject optional cookies. Please note that you cannot reject Strictly Necessary cookies as these are essential to provide you with the Services.

 In addition, you can configure most browsers to notify you when you receive a new cookie, to reject new cookies, and to disable existing cookies. You can learn how to do this by following the instructions here:

https://support.google.com/chrome/answer/95647?hl=en

https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

https://help.opera.com/en/latest/web-preferences/#cookies

 You can also withdraw your consent to optional cookies (those that are not strictly necessary) at any time by enabling 

. We do not currently change our website behavior in response to “Do Not Track” browser signals.

 For more information about third-party cookies and how to opt-out, you can visit the Network Advertising Initiatives opt-out page (available at 

https://optout.networkadvertising.org/?c=1

) or the Digital Advertising Alliance's opt-out page (available at 

https://optout.aboutads.info/?c=2&lang=EN

). If you reside in the EEA, Switzerland, or UK, please visit 

Please be aware that if you choose to stop accepting cookies, you may not be able to use all of the features of our Service.

Cookie Notice

This Data Processing Addendum (“Addendum”) is entered into by and between Doppler Technologies, Inc., a California corporation with its primary place of business at 440 North Barranca Avenue #5880 Covina, CA 91723 (“Doppler”), and the legal entity using Doppler’s services (“Customer”) pursuant to the Doppler 

 or Doppler Software Subscription Agreement, as applicable, executed concurrently herewith, or any other agreement between Customer and Doppler governing Customer’s use of the Subscription Services (the “Agreement”). Doppler and Customer are hereinafter referred to from time to time individually as “party” and collectively as “parties.”

The parties acknowledge that the terms of this Addendum, including the Appendices, are incorporated into and form part of the Agreement. Capitalized terms have the meaning given to them in the Agreement unless defined elsewhere in this Addendum. Where this Addendum uses terms that are defined in Applicable Data Protection Law (defined below), those terms shall have the same meaning as given to those terms (or an equivalent term) in the applicable law.

In the event and to the extent of a conflict between the provisions of the Agreement and this Addendum, this Addendum will prevail. Except as expressly set forth in this Addendum, all other provisions of the Agreement will remain in full force and effect. To the extent that the EU SCCs (defined below) or the UK International Data Transfer Agreement (defined below) are incorporated herein, such terms shall take precedence over both this Addendum and the Agreement to the extent necessary to resolve the conflict or inconsistency. For the avoidance of doubt, execution of the Agreement shall be deemed to constitute signature and acceptance of this Addendum and the EU SCCs and/or UK International Data Transfer Addendum (as applicable) incorporated herein.


 means all laws and regulations applicable to the processing of personal data under the Agreement. For the sake of clarity, Applicable Data Protection Law includes, without where applicable: (i) the General Data Protection Regulation (EU) 2016/679 (“

”) and the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC (“

”), and any national implementations in the European Economic Area (“

”), (ii) the United Kingdom Data Protection Act of 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“

”); (iii) the Swiss Federal Act on Data Protection (revised 2023) (“

”); and (iv) US Privacy Laws (as defined below), as amended or replaced from time to time.

 means the standard contractual clauses between controllers and processors for Data Transfers (module 2), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means the Customer entities or Affiliates that are party to the Agreement. 

 means personal data that relates to Customer’s relationship with Doppler and for which Doppler determines the means and purposes of processing. 

 means any personal data that is (i) provided or made available or accessible to Doppler or its Sub-processors by or on behalf of Customer or a controller for whom Customer acts as a processor; and/or (ii) generated by Doppler or its Sub-processors in the performance of the Agreement. 

 means any data relating to Customer’s use, support, and/or operation of the Services which is used by Doppler in an aggregated and anonymous manner. 

“Data Protection Supervisory Authority” 

means a supervisory authority or other government body responsible for the administration, implementation, and/or enforcement of Applicable Data Protection Law and includes, without limitation, competent supervisory authorities of the European Union (“EU”) and its member states, the Swiss Federal Data Protection Authority, and the United Kingdom (“UK”) Information Commissioner’s Office. 

means any situation in which Customer Data is provided or otherwise made available or accessible for processing, either directly or via onward transfer, from inside Europe to a Third Country. 

 means (i) the Controller-to-Processor Clauses, or (ii) the Processor-to-Processor Clauses, as applicable in accordance with Section 2.1 (Scope and Role of the Parties), including the Elections and on the basis that Appendix 1 of this Addendum operates as Annex I to the EU SCCs and Appendix 2 of this Addendum operates as Annex II to the EU SCCs.

 means all data protection laws and regulations applicable to Europe, including (i) the GDPR; (ii)the e-Privacy Directive; (iii) applicable national implementations of (i) and (ii); and (iii) in respect of the UK, the UK Privacy Act.

 means the standard contractual clauses between processors for Data Transfers (module 3), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means any type of personal data that is designated as “sensitive” or “special category of personal data” or is otherwise subject to additional restrictions under Applicable Data Protection Law. 

 means any person or entity engaged by Doppler or its Aﬃliates to perform Doppler’s obligations under the Agreement. 

 means a country outside of Europe not recognized by the European Commission or the competent UK regulatory authority as providing an adequate level of protection for personal data under European and UK Data Protection Law. 

 means the UK International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner, Version B1.0, effective as of 21 March 2022, and on the following basis: (i) with respect to Table 1 of the UK International Data Transfer Addendum, the parties’ details and key contact information is located in Appendix 1 of this Addendum; (ii) with respect to Table 2, information about the version of the EU SCCs, modules, and selected clauses are located in the Elections, and (iii) with respect to Table 3, information about the parties and a description of the transfer is set forth in Appendix I to this Addendum, a description of Doppler’s technical and organizational security measures is located in Appendix II, and Doppler’s list of sub-processors is set forth in 

 means Customer Data, the processing of which is within the territorial scope of the UK Privacy Act.

means, collectively all US federal and state privacy laws and their implementing regulations that apply generally to the processing of individuals’ personal data, including, but not limited to the following: (i) California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “

”); (ii) Colorado Privacy Act; (iii) Connecticut Data Privacy Act; (iv) Delaware Personal Data Privacy Act; (v) Florida Digital Bill of Rights; (vi) Indiana Consumer Data Protection Act; (vii) Iowa Act Relating to Consumer Data Protection; (viii) Kentucky Consumer Data Protection Act; (ix) Maryland Online Data Privacy Act; (x) Minnesota Consumer Data Privacy Act; (xi) Montana Consumer Data Privacy Act; (xii)Nebraska Data Privacy Act; (xiii) New Hampshire Senate Bill 255; (xiv) New Jersey Senate Bill 332; (xv) Oregon Consumer Privacy Act; (xvi) Rhode Island Data Transparency and Privacy Protection Act; (xvii) Tennessee Information Privacy Act; (xviii) Texas Data Privacy and Security Act; (xix) Utah Consumer Privacy Act; and (xx) Virginia Consumer Data Protection Act; as each become effective and may be amended or replaced. In the event of a conflict in the meanings of defined terms in the US Privacy Laws, the most restrictive law applicable will apply.

. The parties acknowledge and agree that with regard to the processing of Customer Data, Doppler will act as processor to Customer, who may act as either a controller or a processor (or equivalent terms under Applicable Data Protection Law). Each party shall comply with its obligations under Applicable Data Protection Law, and this Addendum, when processing Customer Data. When Customer is acting as a controller, the Controller-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. When Customer is acting as a processor, the Processor-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. Customer agrees that it is unlikely that Doppler will know the identity of Customer’s controllers, if any, because Doppler has no direct relationship with Customer’s controllers. Therefore, Customer agrees that it will fulfill Doppler’s obligations to Customer’s controllers under the Processor-to-Processor Clauses. For the avoidance of doubt, this Addendum does not apply to Customer Usage Data or Customer Account Data.

. Doppler shall process Customer Data only in accordance with Customer’s documented lawful instructions as set forth in (i) the Agreement, including this Addendum and any applicable order forms; (ii) as necessary to comply with applicable law; (iii) or as otherwise agreed in writing or as initiated by Authorized Users in their use of the Subscription Services (including via any configuration tools and APIs made available through the Subscription Services (“Permitted Purposes”). Customer may give additional instructions throughout the term of the Agreement. Doppler shall immediately inform Customer if it is unable to follow those instructions.

 Except as expressly permitted by Applicable Data Protection Law, Doppler will not sell or share Customer Data (as those terms are defined in applicable US Privacy Laws) to any third party, nor retain, use, or disclose such data (i) for any purposes other than those specified in this Agreement and this Addendum; (ii) for any commercial purpose other than the specific business purposes specified in the Agreement and this Addendum, including to provide services to a different business; and (iii) outside the direct business relationship between Customer and Doppler, including to combine or update Customer Data with information received from or on behalf of another source or collected from Doppler’s own interactions with a data subject. Doppler will limit the collection, use, retention, and disclosure of such data to activities reasonably necessary and proportionate to achieve the purposes set out in this Addendum and the Agreement and will not process such data in a manner incompatible with those purposes. Doppler will not attempt to re-identify any pseudonymized, anonymized, aggregated, or de-identified personal data without Customer’s express written permission. 

 Customer represents and warrants that (i) it has complied, and will continue to comply, with all applicable laws, including Applicable Data Protection Law, in respect of its processing of Customer Data and any processing instructions it issues to Doppler; and (ii) it has, and will continue to have, the right to transfer, or provide access to, the personal data to Doppler for processing in accordance with the terms of the Agreement and this Addendum. Customer shall have the sole responsibility for the accuracy, quality, and legality of Customer Data and the means by which Customer acquired Customer Data. Without prejudice to the generality of the foregoing, Customer agrees that it shall be responsible for complying with all laws (including Applicable Data Protection Law) applicable to any content created, sent, or managed through the Subscription Services. Customer specifically acknowledges and agrees that its use of the Subscription Services will not violate the rights of any data subject that has opted-out from the sale or other disclosure of his or her personal data. 

 Customer acknowledges that Doppler is neither responsible for determining which laws or regulations are applicable to Customer’s business nor whether Doppler’s provision of the Subscription Services meets or will meet the requirements of such laws or regulations. Customer will ensure that its instructions comply with Applicable Data Protection Law and Doppler’s processing of the Customer Data in accordance with Customer’s instructions will not cause Doppler to violate any applicable law, regulation, or rule, including without limitation Applicable Data Protection Law. Doppler will inform Customer if it becomes aware or reasonably believes that Customer’s data processing instructions violate Applicable Data Protection Law.

 Doppler shall grant access to Customer Data to members of its personnel only to the extent strictly necessary for the implementation, management, and monitoring of the Agreement. It will further ensure that any person it authorizes to process the Customer Data shall be under an appropriate obligation of conﬁdentiality (whether a contractual or statutory duty).

 Customer agrees that it is unlikely that Doppler would become aware that Customer Data it has received is inaccurate or outdated. Nonetheless, if Doppler does become aware that Customer Data it has received is inaccurate, or has become outdated, it shall inform Customer without undue delay and shall cooperate with Customer to erase or rectify the data. 

 Doppler shall only process Customer Data for the duration specified in Appendix 1.B. Upon Customer's request or upon termination or expiration of the Agreement, Doppler agrees, at Customer’s option, exercised by delivery to Doppler in writing of its instruction, to either deliver to Customer or destroy in a manner that prevents Customer Data from being reconstructed any Customer Data and any copies thereof in Doppler's control or possession, except that this requirement shall not apply to the extent Doppler is required by applicable law to retain some or all of the Customer Data or to Customer Data it has archived on back-up systems, which Customer Data Doppler shall securely isolate, protect from any further processing, and eventually delete in accordance with Doppler’s deletion policies, except to the extent required by applicable law.


3. Responding to Data Subjects and Other Requests:

 Doppler provides Customer with several self-help features and tools within the Subscription Services, including the ability to delete, obtain a copy of, or restrict use of Customer Data. Customer may use these self-help features and tools to honor requests from data subjects to exercise their rights under Applicable Data Protection Law. To the extent Customer, in its ordinary use of the Subscription Services, does not have the ability to address a data subject request to exercise their rights under Applicable Data Protection Law, Doppler shall, upon Customer’s written request, provide commercially reasonable assistance to Customer in responding to such data subject request. If complying with Customer’s request for assistance will require Doppler to expend significant resources, such assistance shall be at Customer’s expense (scoped in advance). 

. In the event that any request, correspondence, enquiry or complaint from a data subject, regulator, or third party, including, but not limited to law enforcement, is made directly to Doppler in connection with Doppler’s processing of Customer Data, Doppler shall promptly inform Customer providing details of the same, to the extent legally permitted. Unless legally obligated to do so, Doppler shall not respond to any such request, inquiry, or complaint without Customer’s prior written consent. In the case of a legal demand for disclosure of Customer Data in the form of a subpoena, search warrant, court order or other compulsory disclosure request, Doppler shall attempt to redirect the requesting party or agency to request disclosure from Customer. Customer agrees that Doppler may provide Customer’s basic contact information for this purpose. If Doppler is unable to redirect the requesting party or agency, Doppler shall act in accordance with its obligations under the EU SCCs or UK International Data Transfer Addendum, as applicable, incorporated herein. For the avoidance of doubt, nothing in the Agreement, including this Addendum shall restrict or prevent Doppler from responding to any data requests or other requests in relation to personal data for which Doppler is a controller.

 (ii) providing the information contained in the Agreement, including this Addendum; and (iii) if the foregoing sub-sections (i) and (ii) are insuﬃcient for Customer to comply with such obligations, upon request, providing additional reasonable assistance at Customer’s expense (scoped in advance).


. Doppler has implemented and will maintain appropriate technical and organizational security measures designed to preserve the security and conﬁdentiality of Customer Data in accordance with Doppler’s security standards described in 

. Customer is responsible for reviewing the information Doppler makes available regarding its data security and making an independent determination as to whether the Subscription Services meet Customer’s requirements and legal obligations, including its legal obligations under Applicable Data Protection Law. Customer acknowledges that the Security Measures are subject to technical progress and development and that Doppler may update or modify the Security Measures from time to time, provided that such updates and modiﬁcations do not materially decrease the overall security of the Subscription Services.

. Doppler shall, to the extent permitted by law, notify Customer without undue delay of any reasonably suspected or actual Security Incident which aﬀects Customer Data. Such notification will be delivered to one or more of Customer’s business or administrative contacts by any means Doppler selects, including via email. It is Customer’s sole responsibility to ensure it maintains accurate contact information in the Subscription Services and under the Agreement at all times. The notice shall summarize in reasonable detail the nature and scope of the Security Incident, to the extent known, and the corrective action already taken or to be taken by Doppler. Furthermore, Doppler shall provide timely information relating to the Security Incident as it becomes known or as reasonably requested by Customer and shall promptly take reasonable steps to remedy or mitigate the eﬀect of any Security Incident. Doppler’s notiﬁcation of or response to a Security Incident shall not be construed as an acknowledgement by Doppler of any fault or liability with respect to the Security Incident. The parties will collaborate on whether any notice of breach is required to be given to any person, and if so, the content of that notice. For clarity, Doppler will not publicly disclose any information regarding the Security Incident without Customer’s prior written consent, except (i) to its own employees, customers, advisors, agents, or contractors or (ii) where and to the extent explicitly compelled to do so by Applicable Data Protection Law, to Applicable Data Protection Supervisory Authorities and/or data subjects. Unless prohibited by an applicable statute or court order, Doppler shall also notify Customer of any third-party legal process relating to any Security Incident, including, but not limited to, any legal process initiated by any governmental entity.

 An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of Doppler’s equipment or facilities used to store or process Customer Data and could include, without limitation, pings and other broadcast attacks on firewalls, port scans, unsuccessful log-in attempts or invalid URLs, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or headers) or similar incidents. 

 Notwithstanding the above, Customer agrees that except as provided in this Addendum or the Agreement, Customer is responsible for its secure use of the Subscription Services, including securing its account authentication credentials, using the Subscription Services strictly as permitted under the Agreement, and using features and functionalities made available by Doppler to maintain appropriate security in light of the nature of the data processed. 

 The parties acknowledge that Customer must be able to assess Doppler’s compliance with its obligations under Applicable Data Protection Law and this Addendum. To facilitate such assessment, Doppler will keep appropriate documentation on the processing activities carried out on behalf of Customer under the Agreement, and upon written request, make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set out in this Addendum. 

 above, then, upon Customer’s written request and subject to the confidentiality obligations set forth in the Agreement, Doppler shall allow for and contribute to audits and inspections conducted by Customer (or Customer’s independent, third-party auditor that is not a competitor of Doppler). Audits shall occur at most annually or more frequently (i) in response to a demand from a Data Protection Supervisory Authority, (ii) following notice of a Security Incident, or (iii) as a follow-up to a duly conducted annual audit. Audits must be preceded by thirty (30) days advance written notice, must be conducted during Doppler’s normal business hours, and must be limited to systems and procedures within Doppler’s control and relevant to Doppler’s processing of Customer Data. Doppler will make its personnel, records, and similar items available upon fewer than thirty (3) days advance notice, but no less than reasonable notice if (i) requested by a Data Protection Supervisory Authority pursuant to an audit of Customer or (ii) following notice of a Security Incident. In lieu of such an audit, in the event that Doppler independently obtains third-party annual audits of its privacy and security program, Customer agrees that Doppler may satisfy its obligations under this 

, by making available to Customer a copy of Doppler’s then most recent third-party audit report. Such audit reports will be made available to Customer upon Customer’s written request, at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement. If any audit reveals any material vulnerability, Doppler shall take commercially reasonable steps to correct such vulnerability.


 Doppler has Customer’s general authorization to engage third-party Sub-processors to fulfill its contractual obligations under this Addendum or to provide certain services on its behalf. A list of the Sub-processors Doppler currently engages can be found 

. At least thirty (30) days prior to adding or replacing any Sub-processor, Doppler will update this list and provide Customer with a mechanism to obtain notice of that update. Customer may object to in writing to Doppler's appointment or replacement of a Sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss commercially reasonable alternative solutions in good faith. If the parties cannot reach resolution, Doppler will, in its sole discretion, either not appoint such Sub-processor, direct such Sub-processor to not process Customer Data, or permit Customer to suspend or terminate the Agreement without liability to either party, in which case, however, and notwithstanding anything to the contrary in this Addendum, the applicable EU SCCs or UK International Data Transfer Addendum (as applicable), or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing.

 Doppler shall: (i) conduct appropriate due diligence on each Sub-processor it engages to perform services on its behalf; (ii) enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Customer Data as those in this Addendum, to the extent applicable to the nature of the service provided by such Sub-processor; and (iii) remain responsible for such Sub-processor’s compliance with the obligations of this Addendum and for any acts or omissions of such Sub-processor that cause Doppler to breach any of its obligations under this Agreement.


Doppler will not engage in any Data Transfers or transmit, directly or indirectly any Customer Data to any country outside the country from which such data was collected, without complying with Applicable Data Protection Law. Where Doppler engages in an onward transfer of Customer Data, Doppler will ensure that a lawful data transfer mechanism is in place prior to transferring such data from one country to another. 

 To the extent that Doppler receives Customer Data protected by European and UK Data Protection Laws, Doppler agrees to abide by and process such data in compliance with the EU SCCs and UK International Data Transfer Addendum, as applicable, which are incorporated herein in full and form an integral part of this Addendum.

The EU SCCs shall be completed as follows:

Where Customer acts as a controller, the Controller-to-Processor Clauses shall apply to Data Transfers from Customer (as a controller) to Doppler (as a processor). Where Customer acts as a processor, the Processor-to-Processor Clauses shall apply to Data Transfers from Customer (as a processor) to Doppler (as a sub-processor).

Clause 7 (the optional docking clause is not included.

For purposes of Clause 11 (regarding redress), the optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included.

For purposes of Clause 17 (regarding governing law), Option 1 is selected and the law of Ireland shall govern.

For purposes of Clause 18(b) (Disputes), the courts of Dublin, Ireland are selected.

of this Addendum shall replace Annexes I and II of the EU SCCs.

Annex III of the EU SCCs (list of sub-processors) is not applicable as the parties have chosen general authorization under Clause 9).

The Tables within the UK International Data Transfer Addendum shall be deemed completed as follows:

 of this Addendum shall replace Tables 1 and 2 of the UK International Data Transfer Addendum.

In Table 4, both the “importer” and the “exporter” can terminate the UK International Data Transfer Addendum.

The secrets manager built for the agentic age