Data Processing Addendum

DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) is understood with the context of customers, which are a corporation/organization organized independant of the jurisdiction that they may reside (“Customer” or “Controller”); and

SWIFT SMS GATEWAY, a corporation organized under the laws of Canada, with its principal jurisdiction in the province of Ontario, Canada (“Swift”, “Aggregator”, “Processor” or “Service Provider”), of which customers agree to. 

Customer and Swift are each a “Party” and together the “Parties.”

This DPA forms part of and is incorporated into the customer’s Master Services Agreement (“MSA”) between Swift and you the customer.

1. PURPOSE AND SCOPE

1.1 This DPA establishes the privacy, confidentiality, security and data-processing obligations of the Parties in connection with Swift’s provision of SMS aggregation, messaging, API, routing, delivery, reporting, monitoring, support and related telecommunications services under the MSA.

1.2 This DPA applies to Personal Information and Personal Data processed by Swift on behalf of Customer in connection with the Services.

1.3 This DPA is intended to establish contractual safeguards appropriate to the nature of an SMS aggregation service and to support compliance, where applicable, with:

(a) the Personal Information Protection and Electronic Documents Act (“PIPEDA”);

(b) applicable substantially similar provincial private-sector privacy legislation, including legislation applicable in Alberta, British Columbia and Quebec;

(c) applicable Canadian telecommunications, electronic messaging and privacy requirements;

(d) applicable U.S. federal and state privacy laws;

(e) the EU General Data Protection Regulation (“EU GDPR”);

(f) the UK General Data Protection Regulation (“UK GDPR”) and applicable UK data-protection legislation; and

(g) any successor or replacement privacy legislation applicable to the Processing.

1.4 This DPA does not impose an obligation on either Party to comply with a law that is not applicable to that Party or the relevant Processing activity.

2. INDUSTRY AND TELECOMMUNICATIONS DEFINITIONS

For purposes of this DPA:

“Aggregator” means a telecommunications or messaging service provider that receives electronic messages from a customer, application, platform or API and transmits, routes, processes, stores temporarily, monitors or otherwise facilitates delivery of those messages through telecommunications carriers, mobile network operators, messaging providers or other telecommunications infrastructure.

“Applicable Privacy Law” means any privacy, data-protection or information-security law applicable to the Processing, including PIPEDA, substantially similar provincial privacy legislation, the EU GDPR, UK GDPR, applicable U.S. privacy laws and regulations, and amendments or successor legislation.

“Controller” means the entity that determines the purposes and means of Processing Personal Information or Personal Data, as that concept is defined under Applicable Privacy Law.

“Customer Data” means information submitted, transmitted or otherwise provided by Customer to Swift through the Services.

“Data Subject” means an identified or identifiable natural person whose Personal Information or Personal Data is Processed.

“Personal Information” shall have the meaning given under PIPEDA or the applicable Canadian privacy legislation.

“Personal Data” shall have the meaning given under the EU GDPR or UK GDPR, as applicable.

“Processing” means any operation or set of operations performed on Personal Information or Personal Data, including collection, receipt, recording, organization, structuring, storage, retrieval, consultation, transmission, routing, disclosure, alteration, use, restriction, deletion or destruction.

“Processor” means an entity that Processes Personal Information or Personal Data on behalf of and pursuant to the instructions of a Controller.

“Sub-Processor” means any third party appointed by Swift to Process Customer Data on behalf of Customer in connection with the Services.

“Security Incident” means an actual or reasonably suspected unauthorized access to, acquisition, use, disclosure, alteration, loss, destruction or compromise of Customer Data, or a material compromise of systems used to Process Customer Data.

“Services” means the SMS aggregation, API, telecommunications, messaging, routing, delivery, reporting, monitoring, support, storage and related services supplied by Swift under the MSA.

3. PARTY ROLES

3.1 Customer as Controller. Customer is responsible for determining the purposes for which Customer Data is collected and Processed and the lawful basis, consent requirements, notices and other legal requirements applicable to Customer’s collection and use of such information.

3.2 Swift as Processor. Except as expressly provided in Section 4, Swift shall Process Customer Data solely for the purpose of providing the Services and in accordance with:

(a) the MSA;

(b) this DPA;

(c) Customer’s documented instructions; and

(d) Applicable Privacy Law.

3.3 Swift shall not sell Customer Data, rent Customer Data, or use Customer Data for advertising or marketing purposes unrelated to the Services.

3.4 Swift shall not combine Customer Data with personal information obtained from another customer for the purpose of creating customer profiles, data products or marketing databases.

3.5 Customer remains responsible for determining whether its intended messaging activity is lawful, including whether required consent has been obtained and whether its messages comply with CASL and other applicable electronic-messaging laws.

3.6 Nothing in this DPA transfers Customer’s legal responsibilities as Controller to Swift.

4. INDEPENDENT CONTROLLERS

4.1 Notwithstanding Section 3, Swift may act as an independent Controller where Swift Processes information for its own lawful purposes that are independent of Customer’s instructions.

4.2 Such purposes may include:

(a) account administration;

(b) billing and payment administration;

(c) fraud, abuse and security monitoring;

(d) prevention and detection of malicious or unlawful activity;

(e) network security;

(f) service reliability and operational monitoring;

(g) compliance with telecommunications, regulatory, legal or law-enforcement requirements;

(h) maintaining business and transaction records required by law;

(i) responding to lawful requests from governmental authorities;

(j) defending legal claims; and

(k) maintaining aggregated or anonymized operational statistics that do not identify Customer or individual Data Subjects.

4.3 Where Swift determines the purposes and means of such Processing independently, Swift shall comply with the Applicable Privacy Law applicable to that Processing in its capacity as Controller.

4.4 Swift shall not use Customer Data for an independent commercial purpose where such use would be inconsistent with the purpose for which Customer provided the information or with Applicable Privacy Law.

5. CUSTOMER RESPONSIBILITIES

5.1 Customer shall ensure that its collection, use, disclosure and submission of Customer Data to Swift are lawful.

5.2 Customer shall provide all notices and obtain all consents required under Applicable Privacy Law.

5.3 Customer shall comply with applicable telecommunications and electronic-messaging requirements, including CASL where applicable.

5.4 Customer shall not transmit through the Services information that Swift is prohibited by law from Processing.

5.5 Customer shall provide Swift with lawful and documented instructions concerning the Processing of Customer Data.

5.6 Customer shall maintain appropriate procedures for responding to Data Subject requests and regulatory inquiries.

5.7 Customer shall notify Swift promptly if it becomes aware that an instruction provided to Swift may violate Applicable Privacy Law.

6. PROCESSOR OBLIGATIONS

6.1 Swift shall Process Customer Data only:

(a) to provide the Services;

(b) to prevent fraud, abuse and security incidents;

(c) as reasonably necessary to maintain and improve the reliability and security of the Services, provided such activity does not constitute an unauthorized commercial use of Customer Data;

(d) in accordance with documented Customer instructions; or

(e) as required by Applicable Law.

6.2 If Swift is required by law to Process Customer Data other than pursuant to Customer’s instructions, Swift shall, where legally permitted, notify Customer before undertaking such Processing.

6.3 Swift shall immediately notify Customer if Swift reasonably believes that a Customer instruction violates Applicable Privacy Law.

6.4 Swift shall maintain appropriate technical and organizational safeguards designed to protect Customer Data against unauthorized or unlawful Processing, accidental loss, destruction, alteration, disclosure or access.

6.5 Swift shall ensure that personnel authorized to access Customer Data are subject to confidentiality obligations.

6.6 Access to Customer Data shall be restricted to personnel and service providers with a legitimate business need.

7. SUB-PROCESSORS

7.1 Customer provides Swift with general authorization to engage Sub-Processors for the provision of the Services.

7.2 Swift shall maintain a current list of material Sub-Processors and, where reasonably practicable, identify:

(a) the Sub-Processor;

(b) the service provided;

(c) the country or jurisdiction in which Processing occurs; and

(d) the category of Customer Data Processed.

7.3 Swift shall provide Customer with reasonable notice of any material addition or replacement of a Sub-Processor and note it within a reasonable amount of time at www.swiftsmsgateway.com/sub-processors/.

7.4 Where Applicable Privacy Law gives Customer a right to object to a new Sub-Processor, Customer may object on reasonable data-protection grounds within the applicable notice period.

7.5 If Customer reasonably objects to a Sub-Processor and the Parties cannot resolve the objection commercially, Swift may, where commercially and technically feasible, provide an alternative service or terminate the affected Service in accordance with the MSA.

7.6 Swift shall enter into written agreements with its Sub-Processors requiring privacy and security protections appropriate to the Processing performed by the Sub-Processor.

7.7 Swift shall remain responsible to Customer for the performance of its Sub-Processors to the extent required by Applicable Privacy Law and the MSA.

7.8 Where GDPR or UK GDPR applies, Sub-Processor arrangements shall satisfy the applicable requirements concerning written authorization, equivalent data-protection obligations and Processor responsibility.

8. CANADIAN PRIVACY LAW

8.1 The Parties acknowledge that PIPEDA establishes principles concerning accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access and challenging compliance.

8.2 Swift shall provide contractual safeguards intended to support Customer’s obligations concerning third-party Processing.

8.3 Swift shall use appropriate safeguards proportionate to the sensitivity of Customer Data and the risks associated with the Services.

8.4 The Parties shall cooperate in addressing privacy complaints and inquiries from individuals and Canadian privacy regulators.

8.5 Where provincial privacy legislation applies instead of, or in addition to, PIPEDA, the Parties shall comply with the applicable provincial requirements.

8.6 Where Quebec privacy legislation applies, the Parties shall cooperate in relation to privacy impact assessments, contractual safeguards and cross-border transfers required by applicable Quebec law.

8.7 Nothing in this DPA shall be interpreted as limiting a mandatory obligation imposed by applicable Canadian privacy legislation.

9. UNITED STATES PRIVACY LAWS

9.1 Where Customer Data is subject to applicable U.S. privacy law, Swift shall Process such data in accordance with the contractual requirements applicable to a service provider, processor, contractor or equivalent regulated entity, as applicable.

9.2 Without limiting Section 9.1, Swift shall not:

(a) sell Customer Data;

(b) share Customer Data for cross-context behavioural advertising;

(c) retain Customer Data longer than reasonably necessary to provide the Services or comply with legal obligations;

(d) use Customer Data for purposes outside the Services except as expressly permitted by Applicable Law;

(e) use Customer Data to create or augment profiles unrelated to Customer’s Services; or

(f) combine Customer Data with data received from another customer except where legally permitted and necessary for security, fraud prevention, network operations or service administration.

9.3 Where applicable, this Section is intended to address contractual requirements applicable to service providers, processors and contractors under U.S. state privacy legislation, including California privacy law.

9.4 Where a particular U.S. state law imposes additional mandatory requirements, those requirements shall apply to the extent applicable to the Processing.

10. GDPR AND UK GDPR

10.1 Where EU GDPR or UK GDPR applies, Customer shall be the Controller and Swift shall be the Processor unless Section 4 applies. Currently, PIPEDA Under article 45 of Regulation (EU) 2016/679, the EU GDPR Commission has deemed “an adequate level of data protection” to Canada. Swift regularly reviews at no less than an annual basis a review of this and prepares a PIPEDA to GDPR matrix that is available on request.

10.2 Swift shall Process Personal Data only on documented instructions from Customer, unless required by applicable law.

10.3 Swift shall:

(a) maintain confidentiality;

(b) implement appropriate technical and organizational measures;

(c) assist Customer with Data Subject rights;

(d) assist Customer with security obligations;

(e) assist with breach notification;

(f) assist with Data Protection Impact Assessments;

(g) maintain appropriate Processing records where legally required;

(h) permit appropriate audits and compliance verification;

(i) control Sub-Processors in accordance with applicable law; and

(j) return or delete Personal Data at the end of the Services, subject to lawful retention requirements.

10.4 The Parties intend Sections 10 and 11 of this DPA to satisfy the contractual requirements applicable to Processor arrangements under Article 28 of the GDPR and corresponding UK GDPR requirements, to the extent applicable and deem PIPEDA provisions as adequate as it relates to applicable European Commission Standard Contractual Clauses (“EU SCCs”) and/or UK International Data Transfer Agreement or UK Addendums.

11. ASSISTANCE WITH DATA SUBJECT REQUESTS

11.1 Taking into account the nature of the Services, Swift shall provide reasonable technical and organizational assistance to Customer in responding to requests from Data Subjects.

11.2 Such requests may include, where applicable:

(a) access;

(b) correction or rectification;

(c) deletion or erasure;

(d) restriction of Processing;

(e) portability;

(f) objection;

(g) withdrawal of consent; and

(h) other rights recognized by Applicable Privacy Law.

11.3 Swift shall not respond directly to a Data Subject concerning Customer Data unless:

(a) Customer instructs Swift to do so;

(b) Applicable Law requires Swift to respond directly; or

(c) the request relates solely to Processing for which Swift is an independent Controller.

11.4 Where Swift receives a Data Subject request relating to Customer Data for which Customer is Controller, Swift shall promptly refer the request to Customer and provide reasonable assistance.

11.5 Swift may require Customer to provide sufficient information to identify the relevant data, account or transaction before undertaking a search or disclosure.

11.6 Customer shall remain responsible for verifying the identity of the Data Subject and determining whether the request is legally valid.

12. DATA PROTECTION IMPACT ASSESSMENTS

12.1 Swift shall provide reasonable assistance to Customer with privacy impact assessments and Data Protection Impact Assessments (“DPIAs”) relating to the Services.

12.2 Such assistance may include providing information concerning:

(a) categories of Customer Data Processed;

(b) Processing activities;

(c) Processing locations;

(d) Sub-Processors;

(e) security safeguards;

(f) retention and deletion practices;

(g) international transfers;

(h) incident-response procedures; and

(i) other reasonably available information necessary to assess privacy risk.

12.3 Customer shall remain responsible for determining whether a DPIA is legally required and for conducting the assessment.

12.4 Where a Quebec privacy impact assessment is required for a transfer outside Quebec, Swift shall reasonably cooperate with Customer in providing information necessary for the assessment and applicable contractual safeguards.

13. SECURITY AND CONFIDENTIALITY

13.1 Swift shall maintain administrative, technical and physical safeguards appropriate to the sensitivity and risk of Customer Data.

13.2 Depending upon the nature of the Services, such safeguards may include:

(a) encryption of data in transit;

(b) encryption of data at rest where technically appropriate;

(c) access controls;

(d) least-privilege access;

(e) authentication controls;

(f) administrative account controls;

(g) logging and monitoring;

(h) vulnerability management;

(i) malware protection;

(j) network security controls;

(k) backup and recovery procedures;

(l) incident-response procedures;

(m) employee security and privacy training;

(n) confidentiality obligations;

(o) secure development practices;

(p) system monitoring;

(q) physical security controls; and

(r) periodic review and testing of security controls.

13.3 Swift shall maintain security safeguards consistent with the risk-based requirements applicable to the Services.

13.4 Swift shall ensure that persons with authorized access to Customer Data are bound by confidentiality obligations.

13.5 Confidentiality obligations shall survive termination of the MSA and this DPA.

14. SECURITY INCIDENTS AND BREACH NOTIFICATION

14.1 Swift shall notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Data.

14.2 To the extent reasonably available and legally permissible, Swift’s notification shall include:

(a) the nature of the Security Incident;

(b) the approximate date and time;

(c) the systems affected;

(d) the categories of Customer Data affected;

(e) the approximate number of affected records or Data Subjects, if known;

(f) the likely consequences;

(g) mitigation measures undertaken; and

(h) the contact point for further information.

14.3 Swift shall reasonably cooperate with Customer in investigating and mitigating the Security Incident.

14.4 Swift shall not notify affected individuals, regulators or other third parties concerning a Security Incident involving Customer Data without Customer’s prior authorization, unless required by Applicable Law.

14.5 Where Applicable Law requires Swift to make a direct notification, Swift shall, where legally permitted, consult with Customer before making such notification.

14.6 Nothing in this Section prevents either Party from taking immediate action necessary to protect individuals, systems, telecommunications infrastructure or legal interests.

15. INTERNATIONAL DATA TRANSFERS

15.1 Swift shall identify the principal jurisdictions in which Customer Data is stored or Processed through the Services.

15.2 Customer acknowledges that telecommunications infrastructure may require Processing or transmission through multiple jurisdictions.

15.3 Where Customer Data is transferred outside Canada, the Parties shall implement safeguards appropriate to the Applicable Privacy Law.

15.4 For Canadian transfers, the Parties shall take reasonable measures to ensure a level of protection appropriate to Applicable Canadian Privacy Law.

15.5 Where Quebec law requires a privacy impact assessment before an international transfer, Customer shall conduct or arrange such assessment and Swift shall reasonably assist.

15.6 Where EU GDPR applies, transfers to countries outside the EEA shall be made using an applicable mechanism in PIPEDA that aligns under Chapter V of the GDPR, including an adequacy decision, appropriate safeguards and available transfer mechanism.

15.7 Where UK GDPR applies, transfers shall comply with applicable UK international-transfer requirements, including an adequacy regulation, IDTA, UK Addendum shall be made using an applicable mechanism in PIPEDA that aligns, as applicable.

15.8 Where EU SCCs are required, the applicable SCC module shall be incorporated into this DPA by reference or executed as a separate schedule.

15.9 Where a governmental authority legally requires disclosure of Customer Data, Swift shall, where legally permitted, notify Customer before disclosure and disclose only the information legally required.

16. DATA RETENTION, DELETION AND RETURN

16.1 Swift shall retain Customer Data only for as long as reasonably necessary to:

(a) provide the Services;

(b) comply with Customer’s documented instructions;

(c) satisfy legal, regulatory, accounting or telecommunications requirements;

(d) investigate or prevent fraud, abuse or security incidents; or

(e) establish, exercise or defend legal claims.

16.2 At Customer’s written request, Swift shall delete or return Customer Data within a commercially reasonable period following termination of the applicable Services, subject to Section 16.3.

16.3 Swift may retain information where required by Applicable Law or reasonably necessary to establish, exercise or defend legal claims.

16.4 Retained information shall remain protected under this DPA and shall not be used for any purpose other than the purpose requiring retention.

16.5 Upon expiry of the applicable retention period, retained Customer Data shall be securely deleted, destroyed or anonymized.

16.6 Backup copies may remain in disaster-recovery systems for a limited period consistent with Swift’s normal backup-retention cycle, provided such copies are protected from ordinary use and are not restored except for legitimate recovery purposes.

16.7 Customer acknowledges that certain telecommunications records may be required to be retained for legal, regulatory, billing, fraud-prevention, dispute-resolution or network-management purposes.

17. AUDITS AND COMPLIANCE INFORMATION

17.1 Swift shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

17.2 Customer may request reasonable compliance documentation, including, where available:

(a) relevant security policies;

(b) privacy policies;

(c) security assessment summaries;

(d) penetration-test summaries;

(e) certifications or attestations;

(f) relevant audit reports; and

(g) Sub-Processor information.

17.3 Customer may conduct an audit where:

(a) required by Applicable Privacy Law;

(b) Swift has experienced a material Security Incident involving Customer Data;

(c) there is reasonable evidence of material non-compliance with this DPA; or

(d) a competent privacy regulator requires an audit.

17.4 Audits shall:

(a) be conducted on reasonable notice;

(b) occur during normal business hours;

(c) minimize disruption to Swift’s operations;

(d) protect Swift’s confidential information and security-sensitive information; and

(e) not permit access to another customer’s information.

17.5 Customer shall first use available audit reports, certifications and compliance documentation before conducting an on-site audit.

17.6 Customer shall bear its audit costs unless the audit identifies a material breach of this DPA by Swift, in which case the Parties shall discuss reasonable allocation of directly incurred audit costs.

18. GOVERNMENT AND LAW-ENFORCEMENT REQUESTS

18.1 Swift may disclose Customer Data where required by law, court order, subpoena, warrant, regulatory requirement or other legally binding governmental demand.

18.2 Unless legally prohibited, Swift shall notify Customer promptly upon receiving such demand.

18.3 Where legally permitted, Swift shall provide Customer with reasonable opportunity to seek protective measures.

18.4 Swift shall disclose only the information reasonably required by the applicable legal obligation.

18.5 Nothing in this DPA requires Swift to violate a lawful prohibition on notifying Customer or to obstruct a lawful governmental investigation.

19. LIMITATION OF LIABILITY

19.1 The liability of either Party arising out of or relating to this DPA shall be subject to the limitations, exclusions and allocation of liability contained in the MSA (Master Service Agreement).

19.2 In no event shall this DPA create a liability exposure for Swift greater than the applicable aggregate liability limitation imposed upon Swift under the MSA.

19.3 For greater certainty, execution of this DPA shall not create a separate or additional liability cap, uncapped liability, statutory indemnity or independent damages regime unless expressly stated in the MSA.

19.4 Nothing in this DPA limits liability to the extent that Applicable Law prohibits such limitation.

19.5 Where Applicable Privacy Law imposes a mandatory liability, compensation or regulatory obligation that cannot lawfully be excluded or limited by contract, that statutory obligation shall apply only to the extent required by law.

20. INDEMNIFICATION

20.1 Any indemnification relating to privacy, data protection, confidentiality or Security Incidents shall be governed by the indemnification provisions of the MSA.

20.2 Nothing in this DPA creates a separate indemnification obligation unless expressly stated in the MSA.

21. TERM AND TERMINATION

21.1 This DPA shall commence on the Effective Date of the MSA and remain in force for so long as Swift Processes Customer Data.

21.2 Termination of the MSA shall terminate this DPA except to the extent that provisions necessarily survive termination.

21.3 Sections concerning confidentiality, security, retained information, deletion, liability, dispute resolution and legally required record retention shall survive termination for so long as applicable.

22. ORDER OF PRECEDENCE

22.1 This DPA forms part of the MSA.

22.2 In the event of a conflict:

(a) Applicable Privacy Law shall prevail to the extent legally required;

(b) this DPA shall govern with respect to privacy, Processing, data protection and information-security matters; and

(c) the MSA shall govern all other commercial matters.

22.3 This DPA supersedes and replaces all previous data-processing agreements, privacy addenda, data-processing addenda or similar privacy schedules between the Parties concerning the Services.

22.4 No previous privacy addendum or data-processing provision shall remain effective to the extent it conflicts with this DPA.

23. CHANGES IN LAW

23.1 The Parties acknowledge that privacy and telecommunications laws may change during the term of the MSA.

23.2 Where a change in Applicable Privacy Law requires modification of this DPA, the Parties shall cooperate in good faith to make the minimum amendments reasonably necessary to maintain compliance.

23.3 Swift may update its privacy and security procedures from time to time where such changes do not materially reduce the protections provided under this DPA.

24. CONFIDENTIALITY

24.1 Customer Data is Confidential Information for purposes of the MSA.

24.2 Swift shall not disclose Customer Data except:

(a) to authorized personnel;

(b) to authorized Sub-Processors;

(c) as necessary to provide the Services;

(d) with Customer’s written authorization; or

(e) as required by Applicable Law.

24.3 Confidentiality obligations shall survive termination of the MSA and this DPA.

25. REGULATORY COOPERATION

25.1 Each Party shall reasonably cooperate with the other in responding to a lawful inquiry from a privacy or telecommunications regulator concerning Processing under this DPA.

25.2 Neither Party shall make admissions on behalf of the other Party without authorization.

25.3 Where legally permissible, each Party shall provide reasonable notice of regulatory inquiries relating directly to the other Party’s Processing activities.

26. RECORDS AND DOCUMENTATION

26.1 Swift shall maintain reasonable records necessary to demonstrate compliance with its obligations under this DPA.

26.2 Records may include:

(a) Processing activities;

(b) Sub-Processors;

(c) Security Incidents;

(d) privacy complaints;

(e) security assessments;

(f) data-retention practices; and

(g) regulatory requests.

26.3 Records may be maintained electronically.

26.4 Records shall be retained for the period required by Applicable Law or Swift’s documented retention schedule, whichever is applicable.

27. NO THIRD-PARTY RIGHTS

Except where Applicable Privacy Law expressly grants rights to Data Subjects, this DPA does not create rights in any person other than the Parties.

Nothing in this Section is intended to prevent Data Subjects from exercising statutory rights that cannot lawfully be waived or restricted.

28. SEVERABILITY

If any provision of this DPA is held invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall remain in full force.

29. GOVERNING LAW

29.1 This DPA shall be governed by the governing-law and jurisdiction provisions of the MSA of Swift. 

29.2 Mandatory privacy legislation applicable to the Processing shall apply notwithstanding the governing-law provision of the MSA to the extent required by law.

30. NOTICES

All notices required under this DPA shall be provided in accordance with the notice provisions of the MSA.

Privacy or Security Incident notices may additionally be provided through the designated privacy or security contact maintained by each Party.

31. ENTIRE AGREEMENT

31.1 This DPA, together with the MSA and any schedules expressly incorporated into it, constitutes the entire agreement between the Parties concerning the Processing of Customer Data.

31.2 This DPA supersedes prior data-processing addenda, privacy schedules and similar agreements relating to the same subject matter.

31.3 Except as expressly modified by this DPA, the MSA remains unchanged.

32. ELECTRONIC EXECUTION

This DPA may be executed electronically and in counterparts, each of which shall constitute an original and all of which together constitute one agreement.

SCHEDULE 1

PROCESSING DETAILS

1. Subject Matter

Provision of SMS aggregation, messaging, routing, API, telecommunications, delivery, monitoring, reporting, support and related services.

2. Duration

The duration of Processing shall correspond to the term of the MSA and any applicable post-termination retention period permitted or required under this DPA.

3. Nature of Processing

Processing may include:

• transmission;
• routing;
• temporary storage;
• message queuing;
• delivery processing;
• delivery-status processing;
• API processing;
• authentication;
• account administration;
• billing;
• technical support;
• monitoring;
• fraud prevention;
• security monitoring;
• troubleshooting;
• regulatory compliance; and
• reporting.

4. Categories of Personal Information

Depending on the Services, Customer Data may include:

• mobile telephone numbers;
• sender identification;
• recipient identification;
• SMS message content;
• message metadata;
• timestamps;
• delivery status;
• IP addresses;
• API credentials or identifiers;
• account information;
• billing information;
• customer-support information;
• telecommunications routing information;
• device or network information; and
• other information supplied by Customer.

5. Special Categories / Sensitive Information

Customer shall not intentionally submit special-category or highly sensitive personal information unless such Processing is expressly contemplated by the MSA and Customer has confirmed that appropriate safeguards are in place.

Where such information is Processed, the Parties shall implement additional safeguards reasonably appropriate to the increased risk.

6. Categories of Data Subjects

Depending on the Customer’s Services, Data Subjects may include:

• Customer’s customers;
• employees;
• contractors;
• business contacts;
• SMS recipients;
• SMS senders;
• end users;
• subscribers;
• account holders; and
• other persons whose information Customer lawfully submits through the Services.

SCHEDULE 2

SECURITY MEASURES

Swift shall maintain a security program appropriate to the nature, scope and risk of the Services, which may include:

1. logical access controls;
2. least-privilege access;
3. authentication controls;
4. administrative access restrictions;
5. encryption in transit;
6. encryption at rest where appropriate;
7. network segmentation;
8. firewalls;
9. intrusion and threat monitoring;
10. vulnerability management;
11. malware protection;
12. security logging;
13. security-event monitoring;
14. backup and recovery procedures;
15. disaster-recovery procedures;
16. incident-response procedures;
17. personnel confidentiality obligations;
18. security awareness training;
19. secure software-development practices;
20. change-management controls;
21. physical security;
22. vendor and Sub-Processor risk management;
23. periodic security testing;
24. access reviews;
25. data-retention controls; and
26. secure deletion procedures.

The specific security measures may evolve as technology, industry practices and security risks change, provided that the resulting measures remain appropriate to the risk.

⸻

SCHEDULE 3

SUB-PROCESSOR REGISTER

Swift shall maintain a current Sub-Processor register identifying material Sub-Processors used in connection with the Services.

The current register may be maintained electronically and incorporated into this DPA by reference.

SCHEDULE 4

INTERNATIONAL TRANSFER MECHANISM

Where applicable:

EU: The Parties shall execute and incorporate the European Commission’s applicable Standard Contractual Clauses.

United Kingdom: The Parties shall execute and incorporate the applicable UK International Data Transfer Agreement or UK Addendum.

Canada: The Parties shall implement contractual and organizational measures appropriate to Applicable Canadian Privacy Law, including any assessment required by applicable provincial law.

United States: The Parties shall implement contractual provisions necessary to maintain applicable processor, service-provider or contractor status under relevant U.S. privacy laws.

SCHEDULE 5

PRIVACY CONTACTS

Customer

As acknowledged it is the customer’s Privacy Officer / DPO:

Swift

As acknowledged it is Swift’s directors and prime shareholders.