Customer Data Protection Addendum

This Data Protection Addendum including its schedules (“DPA”) forms part of the Business User License Agreement or Product Licensing Terms or any other applicable licensing or service terms and conditions (collectively the “Agreement”) between “You” and “Us” and governs the Processing of Personal Data of Your Users by Us as a Processor under applicable Data Protection Laws. The terms “You” or “Your” in this DPA shall mean the customer entity being the party to the Agreement. The terms “Us” or “We” or “Our” shall mean Parallels International GmbH (“Parallels”), Vordergasse 59, 8200 Schaffhausen, Switzerland. This DPA does not apply to Personal Data for which We are a Controller. 

1. Definitions

1.1. General. The terms “Personal Data,” “Process/Processing,” “Controller,” “Processor,” and “Data Subject” have the meanings given to them under the GDPR, provided that the term “Personal Data” as used herein only applies to Personal Data for which We are a Processor. All other capitalized terms used herein (including in the above preamble) will have the meaning set forth in this Section 1 or elsewhere in this DPA, unless otherwise defined in the Agreement. 

1.2. “Affiliate” means an entity that directly or indirectly Controls, is Controlled by or is under common Control with Parallels where "Control" means ownership, voting, or similar interest representing fifty percent (50%) or more of the total interests then-outstanding equity of the entity in question.  

1.3. “Customer Data” means data referring to Users or any User created content ("User” is defined in Section 1.11 below) to the extent it constitutes Personal Data. 

1.4. “Data Protection Laws” means all data protection and privacy laws and regulations applicable to the processing of Personal Data under the Agreement, including where applicable, European Data Protection Law.

1.5. “EEA” means the European Economic Area.

1.6. “European Data Protection Law” means: i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "GDPR"); (ii) in respect of the United Kingdom the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); and (iii) the Swiss Federal Data Protection Act of June 19, 1992, SR 235.1 and its totally revised version of 25 September 2020, which is scheduled to come into force in the second half of 2022 ("Swiss GDPR”).

1.7. “Standard Contractual Clauses” mean as applicable, (i) Standard Contractual Clauses for data controller to data processor transfers approved by the European Commission in decision 2010/87/EU (“Controller to Processor SCCs”); (ii) Standard Contractual Clauses for data controller to data controller transfers approved by the European Commission in decision 2004/915/EC (“Controller to Controller SCCs”), (iii) the European Commission’s implementing decision on Standard Contractual Clauses for the Transfer of Personal Data to Third Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 4 June 2021 and as approved by the Federal Data Protection and Information Commissioner of Switzerland (“FDPIC”) on 27 August 2021 adapted for the requirements under the Federal Act on Data Protection (FADP) of June 19, 1992, SR 235.1 and its totally revised version of 25 September 2020 (revised FADP); (iv) UK Standard Contractual Clauses as published by the UK Information Security Officer (“ICO”).

1.8. “Services” means any services and products provided to You in accordance with the Agreement.

1.9. “Sub-processor” means any Processor engaged by Us (as defined in the Agreement) to assist in fulfilling its obligations to provide the specific Services pursuant to the Agreement or this DPA. Sub-processors may include third parties or Our Affiliates.

1.10. “Supervisory Authority” means an independent public authority, which is established by an EU member state, the UK, or Switzerland pursuant to the applicable European Data Protection Law.

2. Processing of Customer Personal Data

2.1. Your Processing of Personal Data. You shall, in Your use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws. For the avoidance of doubt, Your instructions for the Processing of Personal Data shall comply with all applicable Data Protection Laws. You shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which You acquired Personal Data. Specifically, You undertake to only introduce Personal Data to the Services for which You have either obtained a valid declaration of consent or may rely on a sufficient other statutory basis under applicable Data Protection Laws to justify the processing. We are not obligated to assess the legality of Your instructions, but We will inform You if We believe that an instruction from You violates applicable Data Protection Law.

2.2. Our Processing of Personal Data. We shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Your documented instructions for the following purposes: (i) in accordance with the Agreement and applicable order form(s); (ii) as initiated by Users in their use of the Services; and (iii) to comply with other documented reasonable instructions provided by You (e.g., via email), where such instructions are consistent with the terms of the Agreement, unless We are required to do so by applicable Data Protection Law. In this case, We shall inform You of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

2.3. Details of Data Processing. The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex 1.

3. Sub-processing

3.1. Appointment of Sub-processors. You acknowledge and agree that We may engage third-party Sub-processors (including Our Affiliates) in connection with the provision of the specific processing activities on behalf of You. We or one of Our Affiliates have entered or, for new Sub-processors, will enter into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA with respect to the protection of Your Data, to the extent applicable to the specific services provided by such Sub-processor. A list of Our current authorized Sub-processors is available under the following link https://www.parallels.com/about/legal/sub-processors/. Where the engagement of a Sub-Processor involves a transfer of personal data within the meaning of applicable Data Protection Law, You acknowledge that We rely on Standard Contractual Clauses as applicable to the relevant transfer.

3.2. Objection Right for New Sub-processors. We will provide reasonable prior notice to You if We intend to make any changes to Our list of Sub-processors. You may object to Our use of a new Sub-processor in respect of the Services provided to You by notifying Us promptly in writing within ten (10) business days after Our notice is posted. However, You shall not object to the engagement of any new Sub-processor without having a legitimate legal concern to so including, but not limited to, documented gaps in the new Sub-processor’s compliance with Data Protection Laws.

3.3. Further Procedure in the Event of an Objection. We will provide reasonable prior notice to You if We intend to make any changes to Our list of Sub-processors. You may object to Our use of a new Sub-processor in respect of the Services provided to You by notifying Us promptly in writing within ten (10) business days after Our notice is posted. However, You shall not object to the engagement of any new Sub-processor without having a legitimate legal concern to so including, but not limited to, documented gaps in the new Sub-processor’s compliance with Data Protection Laws.

3.4. Liability for Sub-processors. We shall be liable for the acts and omissions of our Sub-processors to the same extent We would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the Agreement.

4. Security

4.1. Security Measures. We have implemented and, for the term of this DPA, will maintain appropriate technical and organizational security measures to protect Your Personal Data from security incidents and to preserve the confidentiality, integrity, availability and resilience of Your Personal Data ("Security Measures"). A copy of the Security Measures applicable to the Services can be obtained by emailing privacy@parallels.com.

4.2. Updates to Security Measures. You are responsible for reviewing the information made available by Us relating to Our Security Measures and making an independent determination as to whether the Services meet Your requirements and legal obligations under Data Protection Laws. You acknowledge that the Security Measures are subject to technical progress and development and that We may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by You.

4.3. Personnel. We restrict Our personnel from processing Your Personal Data without authorization by Us, as set forth in the Security Measures, and shall ensure that any person who is authorized by Us to process Your Personal Data is under an appropriate obligation of confidentiality.

4.4. Your Responsibilities. Notwithstanding the above, You agree that except as provided for in this DPA, You are responsible for Your secure use of the Services, including securing Your account authentication credentials, protecting the security of Your Personal Data when in transit to and from the Services, and taking any appropriate steps to securely encrypt or back up any of Your Personal Data uploaded to the Services.

4.5. Customer Data Incident Management and Response. We shall notify You without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, including Personal Data, transmitted, stored, or otherwise Processed by Us or Our Sub-processors (a “Customer Data Incident”). Where, and insofar as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. We shall use reasonable efforts to identify the cause of such Data Incident and take those steps as We deem reasonably necessary in order to remediate the cause of such Data Incident to the extent the remediation is within Our reasonable control. The obligations herein shall not apply to incidents that are caused by You or Your Users.

5. Audit Rights

We shall upon request make available to You the information necessary to demonstrate compliance with the obligations set out in this Agreement and mandatory applicable Data Protection Laws. Any provision of security attestation reports or audits shall take place in accordance with Your rights under the Agreement. If the Agreement does not include a provision regarding security attestation reports, We shall, in the ordinary course of business, provide a copy of Our most current security attestation report upon Your written request no more than once annually or if there is evidence of non-compliance. Your further right to audit Us shall remain limited to Your reasonable concern that We have failed to implement the Security Measures under this DPA. Upon Your written request, We and You will discuss and agree in advance on the reasonable start date, scope and duration of and security and confidentiality controls applicable to any audit, and We reserve the right to charge a fee (based on Our reasonable costs) for any such audit. You may engage an independent auditor at Your own costs, however, We reserve the right to reject such an auditor if the auditor is a competitor of Ours or if there is reason to believe that Our business and trade secrets may be affected. You shall make the results of any audit conducted by You or on Your behalf, available to Us.

6. Individual Data Subject Rights

We shall, to the extent legally permitted, promptly notify You if We receive a request from a Data Subject to access, correct, or delete that person’s Personal Data or if a Data Subject objects to the Processing thereof (“Data Subject Request”). We shall not respond to a Data Subject Request without Your prior written consent except to confirm that such request relates to You. To the extent You, in Your use of the Services, do not have the ability to address a Data Subject Request, We shall upon Your request provide commercially reasonable assistance to facilitate such Data Subject Request to the extent We are legally permitted to do so and provided that such Data Subject Request is exercised in accordance with Data Protection Laws. To the extent legally permitted, You shall be responsible for any costs arising from Our provision of such assistance.

7. Data Protection Impact Assessment and Prior Consultation

Upon Your request, We shall provide You with reasonable cooperation and assistance needed to fulfil Your obligation under the GDPR to carry out a data protection impact assessment related to Your use of the Services, to the extent You do not otherwise have access to the relevant information, and to the extent such information is available to Us. We shall provide reasonable assistance to You in the cooperation or prior consultation with the Supervisory Authority in the performance of its tasks relating to this Section 7, to the extent required under the GDPR.

8. Deletion or Return of Personal Data

Following termination of the Agreement, We shall, at Your choice and instruction, delete all personal data processed on behalf of You, or return all the personal data to You and delete existing copies unless law requires Us to store the personal data. Until the data is deleted or returned, We shall continue to ensure compliance with these Clauses.

9. International Data Transfers

9.1. Data Storage/Transfer. If You are established in the EU or a member state of the EEA (collectively "Europe"), in Switzerland or in the UK, You acknowledge that We may transfer Personal Data outside of these regions, either by maintaining data centers outside of this region or by retaining Sub-processors with their registered seat of business outside of this region. For such transfers, We shall ensure appropriate safeguards for the transfer and Processing of Personal Data outside of Europe in accordance with the requirements of European Data Protection Law. Please refer to the list of Our Sub-processors under the following link https://www.parallels.com/about/legal/sub-processors/. The parties acknowledge and agree that, in transferring and Processing Personal Data outside of Europe under this Agreement: (i) You are the Controller of Personal Data; (ii) We are a Processor of such Personal Data; (iii) You will comply with Your obligations as a Controller under European Data Protection Law; and (iv) We will comply with Our obligations as a Processor under European Data Protection Law and this DPA.

9.2. Adequate Level of Data Protection. Parallels as the Processor is domiciled in Switzerland. To the extent that We process any Personal Data relating to Data Subjects in Europe, the parties acknowledge that Parallels shall be deemed to provide adequate protection for any such Personal Data by virtue of being incorporated in Switzerland. As per decision 2000/518/EC of the EU Commission, Switzerland is deemed to provide an adequate level of data protection regarding commercial organizations such as both Parallels and the Customer. We shall ensure an adequate level of data protection for the entire duration of the Agreement even in the event that the EU Commission decides to revoke the adequacy decision for Switzerland/Canada. In this case, We will implement other appropriate safeguards to ensure an adequate level of data protection for Customer Data.

9.3. Standard Contractual Clauses. All transfers of Your Personal Data to Sub-Processors established in third countries outside the EEA, or processing Personal Data in such third countries, shall be governed by the Standard Contractual Clauses.

10. Liability

Without prejudice to mandatory provisions of Data Protection Laws that We are subject to, Our liability arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.

ANNEX 1

Details of Data Processing

Subject Matter. The subject matter of the data processing under this DPA is the automated processing of Customer Data to the extent it constitutes Personal Data.

Duration. As between Us and You, the duration of the data processing under this DPA is the term of the Agreement. 

Purpose. The purpose of the data processing under this DPA is the provision of the Services to You and the performance of mutual obligations under the Agreement and this DPA (or as otherwise agreed by the Parties).

Categories of Data Subjects. Data Subjects consist of Your Users and Your customers’ Users.

Nature of Processing. The type of Processing performed by Parallels under this DPA will depend on the product chosen and services received by You. Parallels generally performs processing on local machines and in the cloud. 

Types of Your Personal Data. The types of Personal Data processed by Parallels under this DPA include registration information and further specified contact data (name, email address).