Sub-Processors

: Our referral program is designed to help us reach more individuals who might benefit from our services. By inviting friends and colleagues, you play a role in connecting us with potential new customers.

: By providing contact details of another individual, you acknowledge that you have obtained that individual's consent to share their contact information for the purpose of this referral program.

: The contact information of referred individuals will solely be used to send an invitation to try our services. We will not use these details for unrelated marketing activities or data collection without further consent from the referred individuals.

: Referred individuals will be given the option to decline further communications from us and/or delete their information from our systems.

: This referral program is purely voluntary, and there is no financial or other compensation offered for providing referrals.

: You agree to indemnify and hold us harmless from any claims arising from your improper sharing of contact details without obtaining the necessary consent from the referred individuals.

: We reserve the right to modify or terminate the referral program and these terms at any time, with or without notice to participants. By participating in our referral program, you agree to these terms and conditions.

Referral Program

This Data Processing Addendum (“Addendum”) is entered into by and between Doppler Technologies, Inc., a California corporation with its primary place of business at 440 North Barranca Avenue #5880 Covina, CA 91723 (“Doppler”), and the legal entity using Doppler’s services (“Customer”) pursuant to the Doppler 

 or Doppler Software Subscription Agreement, as applicable, executed concurrently herewith, or any other agreement between Customer and Doppler governing Customer’s use of the Subscription Services (the “Agreement”). Doppler and Customer are hereinafter referred to from time to time individually as “party” and collectively as “parties.”

The parties acknowledge that the terms of this Addendum, including the Appendices, are incorporated into and form part of the Agreement. Capitalized terms have the meaning given to them in the Agreement unless defined elsewhere in this Addendum. Where this Addendum uses terms that are defined in Applicable Data Protection Law (defined below), those terms shall have the same meaning as given to those terms (or an equivalent term) in the applicable law.

In the event and to the extent of a conflict between the provisions of the Agreement and this Addendum, this Addendum will prevail. Except as expressly set forth in this Addendum, all other provisions of the Agreement will remain in full force and effect. To the extent that the EU SCCs (defined below) or the UK International Data Transfer Agreement (defined below) are incorporated herein, such terms shall take precedence over both this Addendum and the Agreement to the extent necessary to resolve the conflict or inconsistency. For the avoidance of doubt, execution of the Agreement shall be deemed to constitute signature and acceptance of this Addendum and any SCCs or UK International Data Transfer Agreement incorporated herein.


 means any business entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with a party to the Agreement. For purposes of this definition, “control” means an ownership, voting, or similar interest representing fifty percent (50%) or more of the total interests then outstanding of the entity in question.

 means all laws and regulations applicable to the processing of personal data under the Agreement. For the sake of clarity, Applicable Data Protection Law includes, without limitation (1) data protection laws and regulations of the European Union, the European Economic Area and their member states and Switzerland; (2) data protection laws and regulations of the United Kingdom; and (3) data protection laws and regulations of the United States and its individual states.

 means the standard contractual clauses between controllers and processors for Data Transfers (module 2), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means the Customer entities or Affiliates that are party to the Agreement. 

 means personal data that relates to Customer’s relationship with Doppler and for which Doppler determines the means and purposes of processing. 

 means any personal data that is (i) provided or made available or accessible to Doppler or its Sub-processors by or on behalf of Customer or a controller for whom Customer acts as a processor; and/or (ii) generated by Doppler or its Sub-processors in the performance of the Agreement. 

 means any data relating to Customer’s use, support, and/or operation of the Services which is used by Doppler in an aggregated and anonymous manner. 

“Data Protection Supervisory Authority”

 means a supervisory authority or other government body responsible for the administration, implementation, and/or enforcement of Applicable Data Protection Law and includes, without limitation, competent supervisory authorities of the European Union (“EU”) and its member states, the Swiss Federal Data Protection Authority, and the United Kingdom (“UK”) Information Commissioner’s Office. 

 means any situation in which Customer Data is transferred, either directly or via onward transfer to a Third Country. 

 means, with respect to the EU SCCs, (i) for purposes of clause 9(a), option 2 applies and the specified time period is the time period required under 

 of this Addendum for notice of change of a Sub-processor; (ii) for purposes of clause 11, the independent dispute resolution option does not apply; (iii) for purposes of clause 17, option 2 is selected, provided if the EU member state in which the data exporter is established does not allow for third-party beneficiary rights, then the law of Ireland shall govern; and (iv) as pertains to clause 18(b), the courts of the EU member state in which the data exporter is established shall be the choice of forum and jurisdiction. 

 means (i) the Controller-to-Processor Clauses, or (ii) the Processor-to-Processor Clauses, as applicable in accordance with Section 2.1 (Scope and Role of the Parties), including the Elections and on the basis that Appendix 1 of this Addendum operates as Annex I to the EU SCCs and Appendix 2 of this Addendum operates as Annex II to the EU SCCs. 

“European and UK Data Protection Law”

 means all data protection laws and regulations applicable to Europe, including (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, or “GDPR”); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (iii) applicable national implementations of (i) and (ii); and (iii) in respect of the United Kingdom (“UK”) any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the UK leaving the European Union.

 means, for the purposes of this Addendum, the European Union (“EU”), the European Economic Area (“EEA”), and/or their member states, and Switzerland.

 means the standard contractual clauses between processors for Data Transfers (module 3), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. 

 means any confirmed or reasonably suspected unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, or alteration of, or unauthorized disclosure of or access to, Customer Data on systems managed or otherwise controlled by Doppler.

 means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, data relating to criminal convictions or offenses, or other information that falls within the definition of “special categories of data” (or an equivalent term) under Applicable Data Protection Law. 

 means any person or entity engaged by Doppler or its Aﬃliates to perform Doppler’s obligations under the Agreement. 

 means a country outside of Europe or the UK not recognized by the European Commission or the competent UK regulatory authority as providing an adequate level of protection for personal data under European and UK Data Protection Law. 

“UK International Data Transfer Addendum”

 means the UK International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner, Version B1.0, effective as of 21 March 2022, and on the following basis: (i) with respect to Table 1 of the UK International Data Transfer Addendum, the parties’ details and key contact information is located in Appendix 1 of this Addendum; (ii) with respect to Table 2, information about the version of the EU SCCs, modules, and selected clauses are located in the Elections, and (iii) with respect to Table 3, information about the parties and a description of the transfer is set forth in Appendix I to this Addendum, a description of Doppler’s technical and organizational security measures is located in Appendix II, and Doppler’s list of sub-processors is set forth in 

 means Customer Data, the processing of which is within the territorial scope of the data protection, privacy, or security laws of the UK.

. The parties acknowledge and agree that with regard to the processing of Customer Data, Doppler will act as processor to Customer, who may act as either a controller or a processor. Each party shall comply with its obligations under Applicable Data Protection Law, and this Addendum, when processing Customer Data. When Customer is acting as a controller, the Controller-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. When Customer is acting as a processor, the Processor-to-Processor Clauses will apply to any Data Transfer that occurs pursuant to the Agreement. Customer agrees that it is unlikely that Doppler will know the identity of Customer’s controllers, if any, because Doppler has no direct relationship with Customer’s controllers. Therefore, Customer agrees that it will fulfill Doppler’s obligations to Customer’s controllers under the Processor-to-Processor Clauses. For the avoidance of doubt, this Addendum does not apply to Customer Usage Data or Customer Account Data.

. Doppler shall process Customer Data only in accordance with Customer’s documented lawful instructions as set forth in (i) the Agreement, including this Addendum and any applicable order forms; (ii) as necessary to comply with applicable law; (iii) or as otherwise agreed in writing or as initiated by Authorized Users in their use of the Subscription Services (including via configuration tools and APIs made available through the Subscription Services (“Permitted Purposes”). Customer may give additional instructions throughout the term of the Agreement. Doppler shall immediately inform Customer if it is unable to follow those instructions.

 Except as expressly permitted by Applicable Data Protection Law, Doppler will not retain, use, disclose, or otherwise process Customer Data (i) for any purposes other than those specified in the Agreement and this Addendum, (ii) for any commercial purpose other than the specific business purposes specified in the Agreement and this Addendum, including to provide services to a different business; and (iii) outside the direct business relationship between Customer and Doppler, including to combine or update Customer Data with information received from or on behalf of another source or collected from Doppler’s own interactions with a data subject. Doppler will limit the collection, use, retention, and disclosure of Customer Data to activities reasonably necessary and proportionate to achieve the processing set out in this Addendum and the Agreement and will not process Customer Data in a manner incompatible with those purposes. 

 Customer represents and warrants that (i) it has complied, and will continue to comply, with all applicable laws, including Applicable Data Protection Law, in respect of its processing of Customer Data and any processing instructions it issues to Doppler; and (ii) it has, and will continue to have, the right to transfer, or provide access to, the personal data to Doppler for processing in accordance with the terms of the Agreement and this Addendum. Customer shall have the sole responsibility for the accuracy, quality, and legality of Customer Data and the means by which Customer acquired Customer Data. Without prejudice to the generality of the foregoing, Customer agrees that it shall be responsible for complying with all laws (including Applicable Data Protection Law) applicable to any content created, sent, or managed through the Subscription Services. Customer specifically acknowledges and agrees that its use of the Subscription Services will not violate the rights of any data subject that has opted-out from the sale or other disclosure of his or her personal data. 

 Customer acknowledges that Doppler is neither responsible for determining which laws or regulations are applicable to Customer’s business nor whether Doppler’s provision of the Subscription Services meets or will meet the requirements of such laws or regulations. Customer will ensure that its instructions comply with Applicable Data Protection Law and Doppler’s processing of the Customer Data in accordance with Customer’s instructions will not cause Doppler to violate any applicable law, regulation, or rule, including without limitation Applicable Data Protection Law. Doppler will inform Customer if it becomes aware or reasonably believes that Customer’s data processing instructions violate Applicable Data Protection Law.

 Doppler shall grant access to Customer Data to members of its personnel only to the extent strictly necessary for the implementation, management, and monitoring of the Agreement. It will further ensure that any person it authorizes to process the Customer Data shall be under an appropriate obligation of conﬁdentiality (whether a contractual or statutory duty).

 Customer agrees that it is unlikely that Doppler would become aware that Customer Data it has received is inaccurate or outdated. Nonetheless, if Doppler does become aware that Customer Data it has received is inaccurate, or has become outdated, it shall inform Customer without undue delay and shall cooperate with Customer to erase or rectify the data. 

 Doppler shall only process Customer Data for the duration specified in Appendix 1.B. Upon Customer's request or upon termination or expiration of the Agreement, Doppler agrees, at Customer’s option, exercised by delivery to Doppler in writing of its instruction, to either deliver to Customer or destroy in a manner that prevents Customer Data from being reconstructed any Customer Data and any copies thereof in Doppler's control or possession, except that this requirement shall not apply to the extent Doppler is required by applicable law to retain some or all of the Customer Data or to Customer Data it has archived on back-up systems, which Customer Data Doppler shall securely isolate, continue to protect using appropriate technical and organizational security measures until it may be disposed of, and eventually delete in accordance with Doppler’s deletion policies, except to the extent required by applicable law.


3. Responding to Data Subjects and Other Requests:

 Doppler provides Customer with several self-help features and tools within the Subscription Services, including the ability to delete, obtain a copy of, or restrict use of Customer Data. Customer may use these self-help features and tools to honor requests from data subjects to exercise their rights under Applicable Data Protection Law. To the extent Customer, in its ordinary use of the Subscription Services, does not have the ability to address a data subject request to exercise their rights under Applicable Data Protection Law, Doppler shall, upon Customer’s written request, provide commercially reasonable assistance to Customer in responding to such data subject request. If complying with Customer’s request for assistance will require Doppler to expend significant resources, such assistance shall be at Customer’s expense (scoped in advance). 

Handling Requests Made Directly to Doppler

. In the event that any request, correspondence, enquiry or complaint from a data subject, regulator, or third party, including, but not limited to law enforcement, is made directly to Doppler in connection with Doppler’s processing of Customer Data, Doppler shall promptly inform Customer providing details of the same, to the extent legally permitted. Unless legally obligated to do so, Doppler shall not respond to any such request, inquiry, or complaint without Customer’s prior written consent. In the case of a legal demand for disclosure of Customer Data in the form of a subpoena, search warrant, court order or other compulsory disclosure request, Doppler shall attempt to redirect the requesting party or agency to request disclosure from Customer. Customer agrees that Doppler may provide Customer’s basic contact information for this purpose. If Doppler is unable to redirect the requesting party or agency, Doppler shall act in accordance with its obligations under the EU SCCs or UK International Data Transfer Agreement, as applicable, incorporated herein. For the avoidance of doubt, nothing in the Agreement, including this Addendum shall restrict or prevent Doppler from responding to any data subject requests or other requests in relation to personal data for which Doppler is a controller.

 If Doppler believes or becomes aware that its processing of Customer personal data is likely to result in a high risk to the data protection rights and freedoms of data subjects, Doppler shall inform Customer and (taking into account the nature of the processing and the information available to Doppler) provide commercially reasonable cooperation to Customer in connection with any data protection impact assessment or consultations with Data Protection Supervisory Authorities that may be required under Applicable Data Protection Law. Doppler shall comply with the foregoing by: (i) complying with 

 (ii) providing the information contained in the Agreement, including this Addendum; and (iii) if the foregoing sub-sections (i) and (ii) are insuﬃcient for Customer to comply with such obligations, upon request, providing additional reasonable assistance at Customer’s expense (scoped in advance).


. Doppler has implemented and will maintain appropriate technical and organizational security measures designed to preserve the security and conﬁdentiality of Customer Data in accordance with Doppler’s security standards described in 

. Customer is responsible for reviewing the information Doppler makes available regarding its data security and making an independent determination as to whether the Subscription Services meet Customer’s requirements and legal obligations, including its legal obligations under Applicable Data Protection Law. Customer acknowledges that the Security Measures are subject to technical progress and development and that Doppler may update or modify the Security Measures from time to time, provided that such updates and modiﬁcations do not materially decrease the overall security of the Subscription Services.

. Doppler shall, to the extent permitted by law, notify Customer without undue delay of any reasonably suspected or actual Security Incident which aﬀects Customer Data. Such notification will be delivered to one or more of Customer’s business or administrative contacts by any means Doppler selects, including via email. It is Customer’s sole responsibility to ensure it maintains accurate contact information in the Subscription Services and under the Agreement at all times. The notice shall summarize in reasonable detail the nature and scope of the Security Incident, to the extent known, and the corrective action already taken or to be taken by Doppler. Furthermore, Doppler shall provide timely information relating to the Security Incident as it becomes known or as reasonably requested by Customer and shall promptly take reasonable steps to remedy or mitigate the eﬀect of any Security Incident. Doppler’s notiﬁcation of or response to a Security Incident shall not be construed as an acknowledgement by Doppler of any fault or liability with respect to the Security Incident. The parties will collaborate on whether any notice of breach is required to be given to any person, and if so, the content of that notice. For clarity, Doppler will not publicly disclose any information regarding the Security Incident without Customer’s prior written consent, except (i) to its own employees, customers, advisors, agents, or contractors or (ii) where and to the extent explicitly compelled to do so by Applicable Data Protection Law, to Applicable Data Protection Supervisory Authorities and/or data subjects. Unless prohibited by an applicable statute or court order, Doppler shall also notify Customer of any third-party legal process relating to any Security Incident, including, but not limited to, any legal process initiated by any governmental entity.

 Customer agrees that an unsuccessful Security Incident will not be subject to 

Section 4.3 (Security Incident Response).

 An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of Doppler’s equipment or facilities used to store or process Customer Data and could include, without limitation, pings and other broadcast attacks on firewalls, port scans, unsuccessful log-in attempts or invalid URLs, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or headers) or similar incidents. 

 Notwithstanding the above, Customer agrees that except as provided in this Addendum or the Agreement, Customer is responsible for its secure use of the Subscription Services, including securing its account authentication credentials, using the Subscription Services strictly as permitted under the Agreement, and using features and functionalities made available by Doppler to maintain appropriate security in light of the nature of the data processed. 

 The parties acknowledge that Customer must be able to assess Doppler’s compliance with its obligations under Applicable Data Protection Law and this Addendum. To facilitate such assessment, Doppler will keep appropriate documentation on the processing activities carried out on behalf of Customer under the Agreement, and upon written request, make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set out in this Addendum. 

 To the extent that Doppler is unable to demonstrate its compliance with Applicable Data Protection Law and this Addendum through appropriate documentation as described in 

Section 4.6 (Documentation and Compliance)

 above, then, upon Customer’s written request and subject to the confidentiality obligations set forth in the Agreement, Doppler shall allow for and contribute to audits and inspections conducted by Customer (or Customer’s independent, third-party auditor that is not a competitor of Doppler). Audits shall occur at most annually or more frequently (i) in response to a demand from a Data Protection Supervisory Authority, (ii) following notice of a Security Incident, or (iii) as a follow-up to a duly conducted annual audit. Audits must be preceded by thirty (30) days advance written notice, must be conducted during Doppler’s normal business hours, and must be limited to systems and procedures within Doppler’s control and relevant to Doppler’s processing of Customer Data. Doppler will make its personnel, records, and similar items available upon fewer than thirty (3) days advance notice, but no less than reasonable notice if (i) requested by a Data Protection Supervisory Authority pursuant to an audit of Customer or (ii) following notice of a Security Incident. In lieu of such an audit, in the event that Doppler independently obtains third-party annual audits of its privacy and security program, Customer agrees that Doppler may satisfy its obligations under this 

, by making available to Customer a copy of Doppler’s then most recent third-party audit report. Such audit reports will be made available to Customer upon Customer’s written request, at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement. If any audit reveals any material vulnerability, Doppler shall take commercially reasonable steps to correct such vulnerability.


 Doppler has Customer’s general authorization to engage third-party Sub-processors to fulfill its contractual obligations under this Addendum or to provide certain services on its behalf. The Sub-processors Doppler currently engages to carry out processing activities can be found 

. At least ten (10) business days prior to engaging or removing any Sub-processor, Doppler will update this list and provide Customer with a mechanism to obtain notice of that update. Customer may object to in writing to Doppler's appointment or replacement of a Sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss commercially reasonable alternative solutions in good faith. If the parties cannot reach resolution, Doppler will, in its sole discretion, either not appoint such Sub-processor, direct such Sub-processor to not process Customer Data, or permit Customer to suspend or terminate the Agreement without liability to either party, in which case, however, and notwithstanding anything to the contrary in this Addendum, the applicable SCCs or UK International Data Transfer Addendum (as applicable), or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing.

 Doppler shall: (i) conduct appropriate due diligence on each Sub-processor it engages to perform services on its behalf; (ii) enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Customer Data as those in this Addendum, to the extent applicable to the nature of the service provided by such Sub-processor; and (iii) remain responsible for such Sub-processor’s compliance with the obligations of this Addendum and for any acts or omissions of such Sub-processor that cause Doppler to breach any of its obligations under this Agreement.


 Customer understands and acknowledges that Customer Data may be transferred to and processed in the United States or in any country in which Doppler or its Sub-processors have operations. Doppler shall notify Customer at least ten (10) business days prior to adding or replacing a Sub-processor in the same manner provided for notification under 

 above. Customer may object in writing to Doppler’s changes as per the above, provided such objection is based on reasonable grounds relating to data protection (including, but not limited to, changes of location for processing (including access) from within Europe to the United States or another non-Europe country). In such event, the parties shall discuss commercially reasonable alternative solutions in good faith. If the parties cannot reach resolution, Doppler will, in its sole discretion, either not proceed with the change, or permit Customer to suspend or terminate the Agreement without liability to either party in which case, however, and notwithstanding anything to the contrary in this Addendum, the EU SCCs or UK International Data Transfer Addendum (as applicable), or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing. Doppler shall ensure that such transfers comply with the requirements of Applicable Data Protection Law. 

 To the extent that Doppler receives Customer Data protected by European and UK Data Protection Laws, Doppler agrees to abide by and process such data in compliance with the EU SCCs and UK International Date Transfer Addendum (as applicable), which are incorporated herein in full and form an integral part of this Addendum. For the purposes of the EU SCCS and UK International Data Transfer Addendum (as applicable): (i) Doppler is the “data importer” and Customer is the “data exporter” (notwithstanding that Customer may be an entity located outside of Europe or the UK); (ii) Appendixes 1 and 2 of this Addendum shall replace Annexes I and II of the EU SCCs and Tables 1 and 2 of the UK International Data Transfer Addendum (as applicable) and (iii) the EU SCCS shall be applied giving effect to the Elections. For the avoidance of doubt, the UK International Data Transfer Addendum shall apply to any Data Transfer pursuant to the Agreement that involves UK Personal Data.


 Each party and all of its Aﬃliates’ liability to the other party and its Affiliates, taken together arising out of or related this this Addendum, including the EU SCCs and UK International Data Transfer Addendum (as applicable) shall be subject to the exclusions and limitations of liability set forth in the Agreement. For the avoidance of doubt, Doppler and its Affiliates’ total liability for all claims from Customer arising out of or relating to the Agreement or this Addendum shall apply in aggregate. 

 shall alter the parties’ liability to data subjects as provided for in either the EU SCCs or UK International Data Transfer Addendum (as applicable). Each party agrees that it will be liable to data subjects for the entire damage resulting from a violation by it of Applicable Data Protection Law. If one party paid full compensation for the damage suﬀered, it is entitled to claim back from the other party that part of the compensation corresponding to the other party’s part of the responsibility for the damage. Notwithstanding the foregoing, with respect to processing of personal data subject to either the EU SCCs or UK International Data Transfer Addendum, as provided herein, the allocation of liability to data subjects as between the parties shall be governed by the data transfer mechanism taking into consideration that both parties agree that Customer will be liable to data subjects for the entire damage resulting from a violation of European and UK Data Protection Law with regard to processing of personal data for which it is a controller, and that Doppler will only be liable to data subjects for the damage resulting from a violation of the obligations of European and UK Data Protection Law directed to processors where it has acted outside of or contrary to Customer’s lawful instructions or violated this Addendum. Doppler will be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.


8. Modiﬁcation and Termination of this Addendum:

 This Addendum shall remain in eﬀect until the later of (i) termination of the Agreement or (ii) such time as Doppler no longer processes any Customer Data on behalf of Customer. Failure to comply with any of the material provisions of this Addendum is considered a material breach of the Agreement. In the event of termination, Doppler will return or destroy data pursuant to 

Section 2.8 (Return or Deletion of Customer Data).

 Doppler may update the terms of this Addendum from time to time. The then-current terms of this Addendum are available 

 This Addendum supersedes and replaces all prior and contemporaneous agreements, oral and written, with regard to the subject matter of this Addendum, including any prior data processing addenda entered into between Customer and Doppler. If there is any conﬂict between this Addendum and any agreement, including the Agreement, the provisions of the following documents (in order of precedence) shall prevail: (a) the EU SCCs and their Annexes and/or the UK International Data Transfer Addendum and its Tables (as applicable); then (b) this Addendum and its Appendices; then (c) the Agreement.

 If any provision of this Addendum is found by any court or administrative body of competent jurisdiction to be invalid and unenforceable, the invalidity or unenforceability of such provision shall not aﬀect any other provision of this Addendum and all provisions not aﬀected by such invalidity or unenforceability will remain in full force and eﬀect.

10.2 Invalidity of EU SCCs and/or UK International Data Transfer Addendum

. If the EU SCCs and/or UK International Data Transfer Addendum (as applicable) cease to or do not (including due to insufficient supplementary measures) meet the requirements under European and UK Data Protection Law or otherwise cease to or do not provide a valid legal basis to transfer personal data outside the EEA, EU, UK, or Switzerland, Doppler shall (i) promptly notify Customer using the email address on file; (ii) upon request (whether or not Doppler has provided notice to Customer) immediately stop and, as applicable procure the cessation of the processing by its Sub-processors of the affected personal data promptly after the occurrence of any such notifiable event outside the relevant countries (except to the extent directed otherwise by Customer), and as soon as possible put in place commercially reasonable measures to mitigate the impact of such; and (iii) discuss with Customer commercially reasonable alternative measures in order to ensure an adequate level of protection with respect to the privacy rights of individuals and the lawful transfer of, or access to, personal data outside the relevant countries whilst continuing the provision of the Subscription Services with minimum disruption to Customer. If the parties cannot reach resolution, Customer may suspend or terminate the Agreement without liability to either party, in which case, notwithstanding anything to the contrary in this Addendum or the Agreement, Doppler shall refund Customer any prepaid fees covering the remainder of the term of the Agreement from the date of suspension/termination of the Agreement as per the foregoing.

The data exporter is the legal entity identified as “Customer” in the Agreement. Customer may be a controller or a processor with respect to Customer Data.

The data importer is Doppler Technologies, Inc. located at 440 North Barranca Avenue #5880 Covina, CA 91723.

Joel Watson is Doppler’s contact person with responsibility for data protection. He can be reached at 

Doppler Technologies, Inc. provides a platform for engineering teams to manage their digital authentication credentials, including passwords, API keys, certificates, tokens, and encryption keys across all of their environments, tools, and processes. Doppler is either a processor or a sub-processor with respect to Customer Data processed pursuant to the Agreement.

Categories of data subjects whose personal data is transferred

Customer upload, submit, or otherwise provide personal data concerning the following categories of data subjects:

Customer and Customer’s Authorized Users

Customer may upload, submit, or otherwise provider certain personal data to Doppler, the extent of which is typically determined and controlled by Customer in its sole discretion, and may include the following types of personal data:

Any other personal data uploaded, submitted, or otherwise provided to Doppler by Customer in its sole discretion.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance, strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Doppler does not want to, nor does it intentionally, collect or process any Sensitive Data in connection with the provision of the Subscription Services. To the extent that Sensitive Data is nevertheless introduced into Customer Data, Customer agrees that it is solely responsible for ensuring that sufficient safeguards are in place to protect such Sensitive Data and Doppler shall have no liability whatsoever in relation to such data.

The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis)

Customer Data will be transferred on a continuous basis for the duration of the Agreement.

Customer Data will be processed in accordance with the Agreement (including this Addendum) and may be subject to the following processing activities:

Computing, storage and other processing necessary to provide, maintain, and improve the service provided to Customer pursuant to the Agreement; and/or

Disclosures in accordance with the Agreement, Customer’s instructions, and/or as compelled by applicable law.

Purpose(s) of the data transfer and further processing

Doppler shall only process Customer Data as described in 

The period for which the personal data will be retained, or if that is not possible, the criteria used to determine that period

Customer Data will be retained for the duration of the Agreement plus thirty (30) days after expiration or termination unless expressly instructed by Customer to delete or destroy Customer Data sooner or as otherwise required or permitted by law.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

For all transfers to Sub-processors the subject matter, nature, and duration of the processing are as follows:

Subject matter: The subject matter of the transfer and processing is the Customer Data.

Nature of processing: The nature of the processing varies by Sub-processor. Detailed information for each Sub-processor can be found 

Duration of the processing: The duration of the processing is for so long as is necessary for the purpose for which the information was transferred to the Sub-processor and in any event, for no longer than the duration of the agreement between Doppler and the relevant Sub-processor.

The competent authority for the processing of personal data relating to data subjects located in the EEA is the Supervisory Authority of Ireland.

Data Protection

Doppler Technologies, Inc. provides a platform for engineering teams to manage their authentication credentials (“secrets”), including passwords API keys, certificates, tokens and encryption keys across all of their environments, tools, and processes. This Privacy Notice is designed to help you understand how we collect, use, and share your personal information and to help you understand and exercise your privacy rights.

ADDITIONAL DISCLOSURES FOR RESIDENTS OF THE EEA, UK, AND SWITZERLAND

ADDITIONAL DISCLOSURES FOR U.S. RESIDENTS

This Privacy Notice applies to personal information processed by us, including on our websites, applications, and other online or offline offerings. To make this Privacy Notice easier to read, our websites, applications, and other offerings are collectively called “Services.”

This Privacy Notice applies to information we collect and use for our own purposes, including information we collect from and about visitors to the website, customers when they register for or access the Services, and individuals in relation to our marketing activities. In these situations, Doppler is considered the “data controller” for purposes of the General Data Protection Regulation (GDPR) and similar data protection laws.

This Privacy Notice does not apply to data Doppler processes on behalf of our customers in our capacity as a processor, including data collected from and about members that customers add to their Doppler workplaces. Doppler has no direct control or ownership of the personal information we process on behalf of our customers, and we process that data solely in accordance with our customers’ instructions. In addition, this Privacy Notice does not apply to any third-party applications or software that integrate with the Services. For information on how to contact us, please refer to “

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect information that you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below.

A.     Information You Provide to Us Directly

We may collect the following personal information that you provide to us.

 We may collect information when you create an account, such as name, email address, a password which we ask you to create and an optional profile photo which you can elect to provide to us through Gravatar, a third-party provider. Please note that your profile information may be visible to other Doppler users.

 When you purchase a plan for our Services, we require that you provide us or our third-party payment processor with certain information in order to facilitate billing. This can include your name and billing address, credit or other payment card details, and/or banking information. We do not directly collect or store any payment card information entered through our Services, but we may receive limited information associated with your payment card information (e.g., the last four digits of your payment card, zip code, or your card expiration date).

 When you contact us by email; through our branded social media accounts; through our integrated chat providers; or by phone, SMS, or physical mail, we may collect personal information, such as name, username, email address, phone number, mailing address, and the contents of your communication which can include any information you choose to provide. We may also record voice or video calls we have with you as part of the sales process. We use this call data to improve our services. If we intend to record a sales call, we will indicate to you at the outset that the call will be recorded, and unless we are required to record the call, you have the option to not proceed.

 We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include personal information. Providing this information is voluntary and will be used for the purposes described to you in this Privacy Notice or for any other purpose that is clearly disclosed to you in connection with the survey.

 We and others who use our Services may collect personal information that you submit or make available through our interactive features (e.g., messaging and chat features, commenting functionalities, forums, blogs, and social media pages). Any information you provide using the public sharing features of the Services (referred to herein as “User Content”) will be considered “public,” unless otherwise required by applicable law, and is not subject to the privacy protections referenced herein. Please exercise caution before revealing any information that may identify you in the real world to other users.

 We may collect personal information you provide for any sweepstakes or contests that we offer. In some jurisdictions, we are required to publicly share information of sweepstakes and contest winners.

Conferences, Trade Shows, and Other In-Person Events

. We may collect personal information from individuals when individuals swipe their badge or provide information to us at conferences, trade shows, and other events we may host or sponsor. This information may include your name, job title, company name, address, phone number, and email address. Occasionally, we may record events and make those recordings accessible to other Doppler users or the general public. If we do so, we will indicate that the event will be recorded.

. From time to time, we may offer online events. To enable these events, we stream video and audio feed of interactions between participants as well as the contents of any communications enabled by integrated chat functions within any third-party services that we use to provide the events. This includes collecting your image, voice, movements, physical environment, and any other information provided during the event. Occasionally, we may record events and make those recordings accessible to other Doppler users or the general public. If we do so, we will indicate that the event will be recorded.

Business Development and Strategic Partnerships.

 We may collect personal information from individuals and third parties to assess and pursue potential business opportunities.

B.     Information We Collect Automatically

We also collect certain information about you automatically as you navigate our Services or interact with our emails.

To collect his information, we, or our third-party advertising or analytics partners, may use cookies or similar technologies. A “cookie” is a small text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. We, and our third-party advertising and analytics providers, use cookies in order to provide the Services, including recognizing you when you return to our website, saving your preferences (including your preferences regarding cookie handling), understanding which sections and features of our Services you find most interesting, ensure our Services are working properly, and preventing fraud.We use both session cookies (which expire when you close your browser) and persistent cookies (which stay on your computer until you delete them or until they expire).

Certain pages on the Services may contain “web beacons” (also known as Internet tags, pixel tags, tracking beacons and clear GIFs). A web beacon is a transparent graphic image placed on a web page or in an email, which indicates that a page or email has been viewed or that an email has been forwarded. In addition, a web beacon allows third parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of the page on which the beacon appears, the time the page containing the beacon was viewed, the type of browser used to view the page, and the information in cookies set by the third party. A web beacon may also tell your browser to get content from another server.

The information we collect automatically can include the following:

 We may collect information about the device you use to access our Services, including the internet protocol (IP) address, hardware model, operating system and version, unique device identifiers and network information.

 We may collect information such as the date, time, length of stay, search terms used to reach our website, and specific pages or features accessed during your visit to our website or the Doppler application. We use this information to determine the popularity of certain content, to save your preferences, and to improve the Services.

 This includes the number and frequency of visitors to our website and actions taken within the Doppler application.

We may collect general location information inferred from your IP address.

For more information on our use of cookies and similar technologies, please see our 

C.     Information Collected from Other Sources

We may obtain information about you from other sources, including the following:

, on our Services. For instance, users can connect their accounts GitHub, Heroku, and Datadog to their Doppler workplace. Once enabled, the provider of a Third-Party Service may share certain information with Doppler such as the username and email address associated with that user on the Third-Party Service as well as additional information that the provider has chosen to make available to Doppler to facilitate the integration. You should check the privacy settings and privacy policies of these Third-Party Services to understand what information may be shared with Doppler.

 Doppler allows you to sign up and log in to our platform using third-party authentication providers, such as Google and GitHub. If you choose to sign up and log in in this manner, the third-party authentication service will ask your permission to share certain information with us, including your name and email address. You can control the information that we receive from third-party authentication providers using the privacy settings in your accounts with those services.

 We may also receive information about you from our event partners. For instance, if you attend a trade show or an event which we sponsor, the organizer may provide us with your name and contact information in accordance with the disclosure they made to you so that we can reach out to you to discuss our products and services.

. We may collect your personal information from another individual at your organization who may provide us with your business contact information in order to invite you to join a team workplace.

Publicly Available Sources and Other Third Parties.

 We may obtain personal information about you from other sources, including public records, publicly available information online, and third parties that help us update, expand, and analyze our records and inform our marketing and recruitment efforts. For instance, we may use information from LinkedIn or from a third-party data provider, like Crunchbase to update information about you in our contact database.

We use your information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

We use your information to fulfill our contract with you and provide you with our Services, such as:

Deciding whether to enter into a business relationship with you;

Providing access to certain areas, functionalities, and features of our Services;

Answering requests for customer or technical support;

Communicating with you about your account, activities on our Services, and policy changes;

Processing your financial information and other payment methods for products or Services purchased;

Processing applications if you apply for a job we post on our Services; and

We use your information for various administrative purposes, such as:

Pursuing our legitimate interests such as direct marketing, research and development (including marketing research), network and information security, and fraud prevention;

Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;

Measuring interest and engagement in our Services;

Short-term, transient use, such as contextual customization of ads;

Improving, upgrading or enhancing our Services;

Ensuring internal quality control and safety;

Authenticating and verifying individual identities, including requests to exercise your rights under this notice;

Debugging to identify and repair errors with our Services;

Auditing relating to interactions, transactions and other compliance activities;

Enforcing our agreements and policies; and

C.     Marketing and Advertising our Products and Services

We may use personal information to tailor and provide you with content and advertisements. We may provide you with these materials as permitted by applicable law. Some of the ways we market to you include email campaigns, contextual advertising, and “interest-based” or “personalized advertising,” including through re-marketing.

If you have any questions about our marketing practices or if you would like to opt out of our email campaigns or interest-based advertising, you may contact us at any time at 

We also use your information for other purposes as requested by you or as permitted by applicable law.

 We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or with your consent.

. We may use personal information and other information about you to create de-identified and/or aggregated information, such as de-identified demographic information, de-identified location information, information about the device from which you access our Services, or other analyses we create.

Share Content with Friends or Colleagues.

 Our Services may offer various tools and functionalities. For example, we may allow you to provide information about your friends through our referral services. Our referral services may allow you to forward or share certain content with a friend or colleague, such as an email inviting your friend to use our Services. Please only share with us contact information of people with whom you have a relationship (e.g., relative, friend, neighbor, or co-worker).

We disclose your information to third parties for a variety of business purposes, including to provide our Services, to protect us or others, or in the event of a major business transaction such as a merger, sale, or asset transfer, as described below.

A.     Disclosures to Provide our Services

The categories of third parties with whom we may share your information are described below.

 We may share your personal information with our third-party service providers who use that information to help us provide our Services. This includes service providers that provide us with IT support, hosting, payment processing, customer service, and related services.

 We may share your personal information with business partners to provide you with a product or service you have requested. We may also share your personal information to business partners with whom we jointly offer products or services.

 We may share your personal information with our company affiliates for our administrative purposes, including activities such as IT management, for them to provide services to you or support and supplement the Services we provide.

 As described above in “Personal Information We Collect,” our Services allow you to share your profile and/or User Content with other Users/publicly, including to those who do not use our Services.

 We allow certain third-party advertising and analytics partners to collect information regarding your activities on our Services and your device (e.g., your IP address, cookie identifiers, page(s) visited, location, time of day). These advertising and analytics partners help us measure traffic and usage trends on our Services and serve advertisements on our behalf across the internet. However, these third-party providers may combine the data they collect across multiple sites to improve analytics for their own purposes and others. If you live in certain U.S. states, you can opt out of this processing by clicking 

 We may use third-party Application Program Interfaces (“APIs”) and Software Development Kits (“SDKs”) as part of the functionality of our Services. For example, we use Algolia to enhance the quality of the search function on our site. For more information about our use of APIs and SDKs, please contact us as set forth in “

 We may share your personal information with our event partners who may contact you for their own direct advertising and marketing purposes. For instance, if you consent to have your attendee badge scanned by an exhibitor at an event we host, we may, on occasion provide your data to that exhibitor so that they may follow up with you. We may also share lists of attendees at our events with exhibitors. In that case, the exhibitors’ use of your information would be subject to the exhibitors’ privacy policies. If you prefer that we not share your information with such third parties, you may opt out by emailing us at 

B.     Disclosures to Protect Us or Others

We may access, preserve, and disclose any information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to: comply with law enforcement or national security requests and legal process, such as a court order or subpoena; protect your, our, or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.

C.     Disclosure in the Event of Merger, Sale, or Other Asset Transfers

If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

Privacy Notice

Welcome to Doppler™. Doppler is a platform for engineering teams to manage their digital authentication credentials, including passwords, API keys, certificates, tokens, and encryption keys across all of their environments, tools, and processes.

These Terms of Service (“Terms”) define your rights and our rights in relation to the use of the services provided by Doppler Technologies, Inc. (“Doppler”, “we”, “us”, “the Company”) through the website at 

 (the “Doppler Website”), through any applications and/or through any Command Line Interfaces (the “Doppler CLI”). The Doppler Website and applications, the Doppler CLI and the services provided by or through the Doppler Website and applications and the Doppler CLI are collectively known in these Terms as the “Services”.

By accessing or using the Services or any part thereof, you, the user (“you”, “user”) agree to be bound by, and access the Services in accordance with, these Terms and all terms, guidelines and policies incorporated by reference in these Terms, including but not limited to our standard documentation for the Services currently located 

 (collectively, the “Agreement”). If you do not agree to this Agreement, you may not use, access, or submit information to the Services. (collectively, the “Agreement”). If you do not agree to this Agreement, you may not use, access, or submit information to the Services. 

Doppler is constantly modifying and improving the Services. We may introduce new products and features, change existing products and features, or discontinue products and features from the Services at any time. Currently we offer the following products:

1.1 Secrets Manager. Secrets Manager vaults and manages your secrets and configurations (“Secrets”). It includes access controls, logs, versioning and can also be installed for use in a local development environment using the Doppler CLI.

: You can create projects on Secrets Manager to manage your Secrets. Each project holds a list of configurations that live in an environment and support user access control and versioning of changes. The environments currently supported in a project are development, staging and production.

: Doppler currently offer 3 levels of user access for Secrets Manager – owner, admin and member. Owners have access to everything in the Doppler workplace. Admins have access to the entire Doppler workplace except the Team, Settings, and Billing dashboards. Members are individual contributors. They do not have access to Secrets Manager projects initially and must be added by an owner or admin. You can add users to your workplace through manual invites, email Single-Sign-On, and SAML Single-Sign-On. Note that Doppler may continue to modify/add access controls.

: Secrets Manager supports combining Secrets with a straightforward pattern and has a few special secrets you can use which make it easier to track where you are in your CI/CD pipeline. A logging and versioning system is also built into Secrets Manager. Every action within a configuration, like adding a Secret, is logged.

1.2 Radar. Radar is a continuous monitoring tool that connects to GitHub and scans your repositories in real-time for accidentally committed Secrets, including API keys, database connection strings, credentials, certificates, and other sensitive data. This is intended to curb Secrets sprawl, fraudulent use of and unauthorized access to Secrets. Some of the use cases that Radar is designed to tackle with continuous usage are: (i) preventing new Secrets from entering your codebase, (ii) detecting attempts to bypass policies, (iii) tracking migration Secrets from codebase to Secrets manager over time, (iv) educating engineers on next steps and best security practices, and (v) detailing a disaster relief plan for rotation.

1.3 Doppler CLI. The Doppler Command Line Interface (CLI) provides a consistent experience when developing locally to production. It is a lightweight binary that comes provided in a number of package managers and Docker images.

2.1 If you sign up for an account on the Services, you agree to (a) provide accurate, current and complete information as may be prompted by account setup forms on the Services (“Registration Data”); (b) maintain the security of your password and account information; (c) maintain and promptly update the Registration Data, and any other information you provide to Doppler, and keep it accurate, current and complete. You are responsible for all activity on your Doppler account, and for all charges related to your Doppler account. Note that the Services are not intended for, and should not be used by, anyone under the age of 16.

2.2 Logging In. You can login to your Doppler account using (i) your Doppler credentials, (ii) your Google account or (iii) Single Sign-On (SSO) authentication (provided through third parties such as 

2.3 Two-factor Authentication. We offer two-factor authentication which adds another layer of security to your account. For example, if you choose two factor authentication via 

Sub-Processor	Purpose	Entity Country
Smartbear Insight Hub (formerly Bugsnag)	Error Reporting	United States
Supernova (formerly Canvas)	Analytics	United States
Breeze Intelligence for HubSpot (formerly Clearbit)	Data Enrichment	United States
Cloudflare, Inc	Hosting	United States
Crunchbase	Data Enrichment	United States
Google LLC	Hosting	United States
Marketo, Inc.	Customer and Sales Lead Management	United States
Posthog, Inc.	Analytics	United States
Twilio SendGrid (formerly Sendgrid, Inc.)	Customer Communication	United States
Stripe, Inc.	Payment Processing	United States
Zendesk	Customer Support	United States

Sub-Processors

Enter the new era of secrets management