By signing a hard copy of this DPA, or by accepting this DPA by electronic means or otherwise, or by receiving the Services from Radware, Customer enters this DPA on behalf of itself and in the name and on behalf of its Affiliates that are lawfully permitted to use Redware’s Services.
This DPA reflects the parties’ agreement with regard to the Processing of Personal Data in the performance by Radware, and the receipt by Customer, of the Service(s).
Definitions and Interpretation
Unless otherwise defined herein, capitalized terms and expressions used in this DAP shall have the following meaning:
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control of a party. "Control," for purposes of this definition, means direct or indirect ownership or control of more than 50% of the share of the stock, equity or voting interests of a party.
“Applicable Data Protection Laws" means, as the case may be, data protection laws addressing the safeguarding and lawful Processing of Personal Data that apply to the Services ordered by Customer, including, if Customer resides in an EU member country, GDPR and complementary data protection laws in EU member countries.
"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing of Personal Data, and in the context of this DPA shall mean the Customer.
“Controller to Processor SCCs” means the Standard Contractual Clauses in the Annex to the European Commission Decision dated February 5, 2010 (2010/87/EU), as may be amended or replaced from time to time by the European Commission.
"Customer Personal Data" means Personal Data described in Schedule A and any other Personal Data provided to Processor by or on behalf of Customer or by Customer’s end users for Processing on behalf of the Customer pursuant to or in connection with the Principal Agreement.
“Data Subject” means an identified or identifiable natural person to whom Personal Data relates;
"DPA" means this Global Data Processing Agreement and all Schedules thereto.
EEA" means the European Economic Area.
"GDPR" means EU General Data Protection Regulation 2016/679.
“Personal Data” means as the meaning ascribed to “personally identifiable information,” “personal information,” “personal data” or equivalent terms as such terms are defined under Applicable Data Protection Laws.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by the Service.
"Processing" or “Process” means any operation or set of operations that is performed upon Personal Data in connection with the Services, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as described in the Principal Agreement and in Schedule A.
“Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of a Controller, and in the context of this DPA shall mean Radware.
Radware” means Radware Ltd. or Radware Inc. depending on the Radware entity which is a party to the Principal Agreement.
"Services" means the services provided by Radware to Customer pursuant to the Principal Agreement.
“Subprocessor" means any third party appointed by Radware to process Customer Personal Data on behalf of the Customer in connection with this DPA.
"Supervisory Authority" means an independent public authority which is established in a jurisdiction under Applicable Data Protection Laws with competence over matters pertaining to data protection.
Processing of Customer Personal Data
Processor shall:
comply with Applicable Data Protection Laws in the Processing of Customer Personal Data; and
not Process Customer Personal Data other than on the Customer’s documented instructions including as described in Schedule A and in the Principal Agreement.
The Customer instructs Processor to process Customer Personal Data in accordance with Applicable Data Protection Laws: (a) to the extent required in order to carry out the Services pursuant to the Principal Agreement; (b) as further specified in the Data Processing Profile of the applicable Service attached hereto as Schedule A; (c) as further specified through Customer’s use of the Service Portal and other functionalities of the Services; and (d) as further documented in any other written instructions given by Customer to Radware.
Customer acknowledges and agrees that:
Customer is (or is acting with full authority on behalf of) the “Controller” of any Customer Personal Data. Customer will comply with all legal requirements applicable to a Controller of Personal Data in connection with the Services and the Customer Personal Data.
Customer will (i) not disclose any Customer Personal Data or other Personal Data and information to Radware, nor shall Customer transmit or cause to be transmitted through the Service any Customer Personal Data or other Personal Data and information, if such disclosure or transmission would violate any applicable law including any Applicable Data Protection Laws, in particular Customer shall ensure it has all necessary appropriate consents and notices in place to enable lawful transfer of Personal Data to Radware for the duration and purposes of the Principal Agreement; (ii) not request Radware to use, disclose or otherwise Process Customer Personal Data or other Personal Data and information in any manner that would violate any Applicable Data Protection Laws ; (iii) disclose to Radware or transmit or cause to be transmitted through the Services only the minimum amount of Customer Personal Data reasonably necessary for Radware to perform the Services under the Principal Agreement; and (iv) where practicable and commercially reasonable, de-identify and/or encrypt any such Customer Personal Data before making it available to Radware or before transmitting or cause to be transmitted such Customer Personal Data through the Services.
Processor Personnel
Processor shall take reasonable steps to provide the reliability of any employee, agent or contractor of Processor who may have access to the Customer Personal Data, providing in each case that access is strictly limited to those individuals who need to know and/or access the relevant Customer Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Data Protection Laws in the context of that individual's duties to the Processor, providing that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
-
Security
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall in relation to the Customer Personal Data implement appropriate technical and organizational measures designed to provide a level of security appropriate to that risk in the provision of the Services, including, if applicable and as appropriate, in consistent with the measures as referred to in Article 32(1) of the GDPR, and as set forth in Schedule B.
In assessing the appropriate level of security, Processor shall take account in particular the risks that are presented by Processing, in particular from a Personal Data Breach.
Subprocessing
Except as set forth is section 5.3 below, Processor shall not appoint (or disclose any Customer Personal Data to) any Subprocessor unless required or authorized by the Customer.
With respect to each Subprocessor, Radware will impose substantially similar data protection obligations as set out in this DPA on any approved Subprocessor prior to the Subprocessor Processing any Customer Personal Data. As between the Customer and Radware, Radware shall remain fully liable for all acts or omissions of any Subprocessor appointed by it pursuant to this section 5.2 and section 5.3 below.
The Customer acknowledges and agrees that Radware uses the Subprocessors set out in Schedule C and as described in Schedule A, for the purpose of Processing data in connection with the Services including for the purpose of Processing Customer Personal Data; provided that Radware reserves the right to update the list of Subprocessors in Schedule C by providing a notice in writing to Customer, and such updated list shall be deemed accepted by Customer unless Customer raises an objection in writing within thirty (30) days of receipt of such notice. The Customer acknowledges that where it raises an objection to the use of a Subprocessor its use of the Service under the Principal Agreement may be limited or impossible and Processor shall have no liability in respect of any such limitation or impossibility. Customer’s sole recourse if Customer objects to the appointment of a new Subprocessor will be to terminate the Principal Agreement with regard to the affected Service by providing Radware with written notice within thirty (30) days of receipt of the notice informing Customer of a change in the list of Subprocessors.
Data Subject Rights
Taking into account the nature of the Processing, Processor shall assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer obligations, as reasonably understood by Customer, to respond to requests to exercise Data Subject rights under Appliable Data Protection Laws.
- Processor shall:
Promptly notify Customer if it receives a request from a Data Subject under Applicable Data Protection Law in respect of Customer Personal Data; and
Not respond to that request except on the documented instructions of Customer or as required by Applicable Data Protection Law to which the Processor is subject, in which case Processor shall, to the extent permitted by Appliable Data Protection Laws, inform Customer of that legal requirement before the Processor responds to the request.
Personal Data Breach
Processor shall notify Customer without undue delay within 72 hours upon Processor becoming aware of a Personal Data Breach, thereby providing Customer with sufficient information to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under Applicable Data Protection Laws.
Processor shall reasonably co-operate with the Customer and take reasonable commercial steps as are reasonably directed by Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
Data Protection Impact Assessment and Prior Consultation
Processor shall provide reasonable assistance to the Customer with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Customer reasonably considers to be required by Applicable Data Protection Laws (including article 35 or 36 of the GDPR to the extent applicable), in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to, the Processor. To the extent that any such impact assessment and/or prior consultation requires assistance beyond Radware providing the applicable Radware processing record(s) and documentation, Radware reserves the right to charge Customer for such engagement at Radware’s then current daily rates.
Deletion or return of Customer Personal Data
Subject to this section 9, Processor shall, as soon as reasonably feasible after the date of cessation of any Services involving the Processing of Customer Personal Data (the "Cessation Date"), but, in any event, in accordance with Applicable Data Protection Laws, delete and procure the deletion of all copies of those Customer Personal Data.
Upon Customer’s request, Processor shall provide written confirmation to Customer that it has fully complied with this section 9 within ten (10) business days of the Cessation Date.
Information and Audit Rights
The Processor maintains ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certifications, which are issued by an independent third-party auditor. The Processor will continue to undergo regular ISO/IEC 27001:2013, ISO/IEC 27017 and ISO/IEC 27018 audits necessary for maintaining such certifications for the Services during the term of the Principal Agreement. Moreover, an annual Service Organization Control 2 (SOC 2) Type II Report is being prepared for Radware’s cloud Services and in addition Radware relies on the SOC 2 Type II audits undergone by some of its Subprocessors. Subject to the Processor’s confidentiality obligations and no more than once a year, the Processor will provide the Customer with a copy of the most recent SOC 2 Type II Report(s) and/or excerpt of any of Processor’s available SOC 2 Type II Report and such Reports of its Subprocessors upon written request by the Customer.
The Customer agrees that the Processor’s obligations set forth in this section 10.1 fully satisfy the information and audit rights under Applicable Data Protection Laws, including under Article 28.3(h) of the GDPR as well as under Clause 5(f) and Clause 12 (2) of the Controller to Processor SCCs.
The audit rights of the Customer under section 10.1 above are without derogating from any audit rights provided under the Principal Agreement (if any).
Data Transfer
Customer allows the transfer of Customer Personal Data outside the country from which it is originally collected provided that such transfer is required in connection with the provision of Services under the Principal Agreement and such transfers take place in accordance with Applicable Data Protection Laws.
Where GDPR applies, Customer agrees and consents to Processor‘s transferring or authorizing the transfer of Customer Personal Data to countries outside the EU and/or the European Economic Area (EEA) for the purpose of the provision of the Services; provided however, that in the event of any transfer of Customer Personal Data Processed under this DPA from a country within the European Economic Area to a country outside the European Economic Area which does not ensure an adequate level of data protection within the meaning of Applicable Data Protection Laws or which transfer is not otherwise governed by a framework approved by the European Commission to which Processor or any of its Affiliates is officially certified, the Parties shall ensure that the Personal Data is adequately protected. To achieve this, unless agreed otherwise, the Parties agree that the EU approved Controller to Processor SCCs shall come into effect and be deemed executed upon execution of this DPA and shall apply pursuant to the order of precedence described in section 12.1 below. In the event the Controller to Processor SCCs apply, Appendix 1 thereto shall be deemed to be prepopulated with the relevant Schedule A of this DPA, Appendix 2 thereto shall be deemed to be prepopulated with Schedule B of this DPA and the Data Exporter and Data Importer thereunder shall be the Controller and Processor, respectively.
General Terms
This DPA is without prejudice to the rights and obligations of the parties under the Principal Agreement which shall continue to have full force and effect. Any claims brought under this DPA shall be subject to the terms of the Principal Agreement including, without limitation, choice of jurisdiction, governing law and any liability limitations or exclusions. In the event of any conflict between the terms of this DPA and the terms of the Principal Agreement and/or any other agreements between the parties, including (except where explicitly agreed otherwise in writing and signed on behalf of the parties) agreements entered into or purported to be entered into after the date signing or acceptance of this DPA, the terms of this DPA shall prevail but only so far as the subject matter concerns the processing of Personal Data.
In the event of any conflict or inconsistency between this DPA or the Principal Agreement and the Controller to Processor SCCs, the Controller to Processor SCCs shall prevail.
Radware’s liability under or in connection with this DPA is subject to the limitations on liability contained in the Principal Agreement.
In the event the Principal Agreement does not include limitations of liability, the following limitations of liability will apply between the parties in connection with this DPA including with regards to the Controller to Processor SCCs:
Neither party shall be liable to the other party or to any third party, for any special, indirect, incidental or consequential, exemplary or reliance damages, losses or expenses (including without limitation, loss of profits, loss of information, loss or corruption of data, loss or interruption of business) arising from or in any way connected with the parties’ obligations under this DPA, however caused, and whether based on contract, tort (including negligence), equity or other theory of liability whatsoever, even if such party has been advised of the possibility of such damages or losses or expenses. Without derogating from the foregoing, except for liability for payments for the Services, in no event shall a party’s total aggregate liability to the other party exceed the amounts actually paid to Supplier for the Service that is the subject matter of the claim during the twelve (12) month period preceding the damaging event. This section will survive the termination/expiration any sale/purchase document between Radware and Customer. Notwithstanding the foregoing, none of the exclusions and limitations in this section shall apply in respect of (i) liability in negligence causing personal injury or death; (ii) liability for fraudulent misrepresentation; or (iii) any other liability which cannot by law be excluded or limited (as appropriate).
In the event the Principal Agreement does not include a provision addressing governing law and jurisdiction, the following will apply between the parties in connection with this DPA:
This DPA will be governed and construed in accordance with the substantive laws of, and exclusive venue will be located in: (i) Israel if Customer is located in Israel; (ii) England and Wales if Customer is located in EMEA; (iii) Singapore if Purchaser is located in APAC; and (iv) the state of New York for all other Customer locations.
The applicable law provisions of this DPA are without prejudice to clauses 7 (Mediation and Jurisdiction) and 9 (Governing Law) of the Controller to Processor SCCs where applicable to transfers of Personal Data from the European Union to a third country.
To the extent that Processing relates to Personal Data originating from a jurisdiction or Processed in a jurisdiction which has any mandatory requirements in addition to those that are set out in this DPA, Customer will inform Radware of such additional mandatory requirements and both parties may agree to any additional measures required to provide compliance with such applicable additional mandatory requirements and any such additional measures agreed to by the parties will be documented as an Annex to this DPA or in an Order under the Principal Agreement. Due to the fact that Radware has no control over the type, character, properties, content, and/or origin of Customer Personal Data Processed hereunder, notwithstanding anything to the contrary herein, Radware shall not be in breach of this DPA or the Principal Agreement or liable to Customer to the extent Customer Personal Data subject to jurisdictional requirements mandating security, processing or other measures not set forth in, or contrary to the terms of, this DPA is provided by Customer without first informing Radware and amending this DPA or entering into an Order addressing the same.
If any variation is required to this DPA as a result of a change in Applicable Data Protection Laws, including any variation which is required to the Controller to Processor SCCs, then either party may provide written notice to the other party of that change in law. The parties will discuss and negotiate in good faith any necessary variations to this DPA, including the Controller to Processor SCCs, to address such changes.
Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be: (i) amended as necessary to ensure its validity and enforceability while preserving the parties’ intentions as closely as possible, or, if this is not possible; (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
To the maximum extent legally permitted, there are no third-party beneficiaries under this DPA.
SCHEDULE A
DATA PROCESSING ACTIVITY PROFILE
Radware's Cloud Web Application Firewall (CWAF) Service Data Processing Profile
Radware's Cloud DDoS Protection Service Data Processing Profile
Radware's Bot Manager Service Data Processing Profile
Radware's Cloud Native Protector Service Data Processing Profile
SCHEDULE B
TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
Processor shall implement appropriate technical and organizational security measures intended to protect the Customer Personal Data it Processes against accidental or unauthorized loss, destruction, alteration, disclosure or access:
IS Program - Radware maintains an information security program with the aim to identify reasonably foreseeable external and internal risks to the security of Radware Network and minimize security risks through risk assessments and regular testing.
CISO - Radware has designated a Chief Information Security Officer (CISO) to coordinate and be accountable for the information security management system.
Security Reviews - Radware conducts periodic reviews of the security of its infrastructure and the adequacy of its information security program.
Baseline for the management system - Radware follows industry best practices for its security Information Security Management system (ISMS) and is certified for ISO 27001, ISO 27017, ISO 27018 and ISO 27032. PCI Service Provider and HIPAA compliance is confirmed by an annual self-assessment.
Human Resources - Radware provides that employees, contractors, partners, and vendors understand their data protection and security responsibilities. These responsibilities include maintaining the confidentiality, integrity and availability of the Customer information processed by Radware. All employees of the organization and where relevant, contractors receive appropriate awareness education and training and regular updates in organizational policies and procedures, as relevant for their job function.
Access Control
Radware provides that only authorized users will have access to its information assets and to private data. Users are only be provided with access to assets that they have been specifically authorized to use.
Radware provides the customers with an access control management system for the relevant cloud management portals as part of the service.
Encryption - Radware provides proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information, Radware will provide that confidential data will be encrypted whenever extracted from their primary repository.
Physical and Environmental Security - Radware will use physical and environmental measures to prevent unauthorized physical access, damage to or disruption of the organization’s information and information processing facilities.
Operational & Communication Security - Radware will maintain appropriate controls related to management of IT production including change management, capacity management, malware, backup, logging, monitoring and vulnerabilities management.
System acquisition, development, and maintenance - Radware maintains security throughout the lifecycle of the information systems.
Supplier Relationship - Radware provides that its partners, suppliers, and contractors maintain adequate security measurements to secure Radware and its customers' information, through contracts and periodic audits.
Data Retention and disposal
Information stored withing the service, such as logs and alerts will be retained according to customer requirements. When no longer required, the information will be securely deleted.
SCHEDULE C
LIST OF CURRENT SUB-PROCESSORS
Radware Cloud Services Sub-processors