Flex Data Processing Agreement

This Data Processing Agreement ("this DPA") forms part of the Flex Terms of Service at countly.com/legal/flex-terms (the "Agreement") and applies from the date on which Customer accepts the Flex Terms of Service (the "Effective Date"). In providing the Data Processing Services to Customer pursuant to the Agreement, Countly may Process (as defined below) Personal Data (as defined below) on behalf of Customer. "Data Processing Services" means hosting and operating the dedicated Countly server that Countly runs for Customer on Google Cloud ("Customer's Flex server"), providing the related support and, where Customer uses them, providing Countly's AI gateway and crash symbolication service. Countly will comply with the provisions in this DPA with respect to its processing of any Personal Data. Capitalized terms used but not defined in this DPA have the same meanings as set out in the Agreement.

For the purposes of this DPA:

(a) “Adequacy Regulation” means regulations made under section 17A of the Data Protection Act 2018 or Article 45A of the UK GDPR, and adequacy regulations having effect under sub-paragraph 4(1), Part 3, Schedule 21 of that Act, covering a transfer of Customer Data to a certain non-UK country or territory.

(b) “Adequacy Decision” means a positive finding of adequacy covering an international transfer by the European Commission in relation to the data protection regime of a certain non-EEA country or territory, pursuant to Article 45 of the GDPR.

(c) "Affiliate(s)" has the same meaning ascribed to it in the Agreement and, if not defined in the Agreement, the term means any legal entity directly or indirectly controlling, controlled by or under common control with a party, where control means the ownership of a majority share of the stock, equity or voting interests of such entity.

(d) "Applicable Data Protection Law" means any applicable legislation in force from time to time relating to the protection of personal data of individuals including, where applicable, Regulation (EU) 2016/679 (the "EU GDPR" or "GDPR"), the UK GDPR (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) (the “UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

(e) "Controller", “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process” and “Processing” shall each have the respective meanings given to them (and equivalent expressions) in Applicable Data Protection Law.

(f) "Customer Data" means any data, information or material originated by Customer that Customer or its authorised users submit to the Services, collects through its use of the Services or provides to Countly in the course of using the Services, and as set out in the Description of Processing. Customer Data excludes Account Data.

(g) "Account Data" means Personal Data relating to Customer's personnel and authorised users that Countly collects for its own purposes in connection with registration, authentication, billing, support, communications and the use of the Countly websites and the Countly Flex console, which Countly Processes as an independent Controller in accordance with its Flex Privacy Policy (countly.com/legal/flex-privacy) and Website Privacy Policy (countly.com/legal/privacy-policy).

(h) “Description of Processing” means the description of Processing set out in Appendix A.

(i) "EU Model Clauses" means the 2021 Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914; Module 4 (Processor-to-Controller) applies to Restricted Transfers from Countly to Customer and Module 3 (Processor-to-Processor) applies to Restricted Transfers from Countly to a Sub-processor.

(j) “Non-Adequate Country” means a country, territory or jurisdiction which: (i) in the case of a transfer concerning Customer Data regulated by the UK GDPR, is not subject to a valid Adequacy Regulation; and (ii) in the case of a transfer concerning Customer Data regulated by the EU GDPR, is not subject to an Adequacy Decision.

(k) “Restricted Transfer” means a transfer of Customer Data by Countly to a Non-Adequate Country.

(l) "Service Data" means technical information about the installation and operation of a Countly server that the Countly software sends to Countly, as described in Countly's Connected Services and Telemetry notice (countly.com/legal/connected-services). Countly Processes it as an independent Controller.

(m) "Subscription Services" means the Countly Flex services provided by Countly to Customer under the Agreement.

(n) "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 (version B1.0, in force 21 March 2022).

2.1 Parties' Roles. The parties agree that Customer is a Controller and Countly is a Processor for the purposes of Processing Customer Data pursuant to this DPA. In some circumstances Customer may be a Processor, in which case Customer appoints Countly as Customer's sub-processor, which shall not change the obligations of either Customer or Countly under this DPA, as Countly will remain a Processor with respect to Customer in such event. Nothing in this DPA authorises Countly to Process Customer Data for its own advertising, marketing or analytics purposes.

2.2 Purpose Limitation. Countly shall process Personal Data for the purposes set forth in the Agreement and only in accordance with the lawful, documented instructions of Customer, except where otherwise required by applicable law. The Agreement and this DPA set out Customer's complete instructions to Countly in relation to the processing of Personal Data and any processing required outside of the scope of these instructions (inclusive of the rights and obligations set forth under the Agreement) will require prior written agreement of the parties. Notwithstanding the preceding sentences, Countly shall have no obligation to comply (nor any liability for non-compliance) with any of Customer instructions which will or are likely to (in Countly’s opinion): (i) vary the provisions of this DPA; (ii) be inconsistent with the Description of Processing; and (iii) breach any Applicable Data Protection Laws, and shall notify Customer in writing of the same.

2.3 Compliance. Customer, as Controller, shall (in connection with Customer Data and the Services):

(a) ensure it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Law;

(b) ensure it has, and will continue to have, the right to transfer, or provide access to, the Customer Data to Countly for processing in accordance with the terms of the Agreement and this DPA;

(c) ensure that the Description of Processing at all times accurately reflects Countly’s Processing of Customer Data as a Processor for Customer in relation to the Data Processing Services;

(d) ensure that all instructions it issues to Countly comply with Applicable Data Protection Laws; and

(e) be and remain solely responsible for determining the legal basis and conditions for the Processing of all Customer Data under this DPA.

3.1 Security. Countly shall implement appropriate technical and organizational measures designed to protect against accidental, unauthorized or unlawful destruction, loss, alteration, or disclosure of, or access to Customer Data (each a "Security Incident"). Countly maintains an information security management system certified to ISO/IEC 27001, implementing the controls of ISO/IEC 27017 and ISO/IEC 27018, and is audited against SOC 2.

3.2 Confidentiality of Processing. Countly shall ensure that any person that it authorizes to Process the Customer Data (including its and its Affiliates’ staff, agents, and subcontractors) shall be subject to a duty of confidentiality (whether a contractual or a statutory duty).

3.3 Security Incidents. Upon becoming aware of a Security Incident, Countly shall notify Customer without undue delay and pursuant to the terms of the Agreement and shall provide such timely information as Customer may reasonably require to enable Customer to fulfill any data breach reporting obligations under Applicable Data Protection Law.

4.1 Sub-processors. Customer agrees that Countly may engage Countly Affiliates and is generally authorized to engage any third party Processor to process Customer Data on Countly’s behalf (collectively, "Sub-processors"). The Sub-processors currently engaged by Countly and authorized by Customer are those published on the page at countly.com/legal/flex-subprocessors (the "Sub-processor List"), which forms part of this DPA and is updated in accordance with Sections 4.2 and 4.3. Countly shall impose on such Sub-processors data protection terms that protect the Personal Data to the same standard provided for by this DPA and shall remain liable for any breach of this DPA caused by a Sub-processor.

4.2 Changes to Sub-processors. Countly may, by giving no less than thirty (30) days' notice to Customer (by e-mail to the holder of Customer's Countly Flex account), add or make changes to the Sub-processors. Customer may object to the appointment of an additional Sub-processor within fourteen (14) calendar days of such notice on reasonable grounds relating to the protection of the Personal Data, in which case Countly shall have the right to cure the objection through one of the following options (to be selected at Countly's sole discretion): (a) Countly will cancel its plans to use the Sub-processor with regard to Personal Data or will offer an alternative to provide the Subscription Services without such Sub-processor; or (b) Countly will take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the Sub-processor with regard to Personal Data; or (c) Countly may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Subscription Services that would involve the use of such Sub-processor with regard to Personal Data, subject to a mutual agreement of the parties to adjust the remuneration for the Subscription Services considering the reduced scope of the Subscription Services. If none of the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Countly's receipt of Customer's objection, Customer may cancel its Flex subscription and will receive a pro-rata refund of prepaid fees for Subscription Services not performed as of the date of cancellation.

4.3 Emergency Replacement. Countly may replace a Sub-processor if the reason for the change is beyond Countly's reasonable control. In such instance, Countly shall notify Customer of the replacement as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-processor pursuant to Section 4.2 above.

5.1 Data Subjects' Rights. Countly shall provide commercially reasonable assistance, including by appropriate technical and organizational measures as reasonably practicable, to enable Customer to respond to any inquiry, communication or request from a Data Subject seeking to exercise his or her rights under Applicable Data Protection Law, including rights of access, correction, restriction, objection, erasure or data portability, as applicable. In the event such inquiry, communication or request is made directly to Countly, Countly shall promptly inform Customer by providing the full details of the request. For the avoidance of doubt, Customer is responsible for responding to Data Subject requests for access, correction, restriction, objection, erasure or data portability of that Data Subject's Personal Data.

5.2 Data Protection Impact Assessments and Prior Consultation. Countly shall, to the extent required by Applicable Data Protection Law, provide Customer with reasonable assistance with data protection impact assessments, security, breach notifications or prior consultations with data protection authorities that Customer is required to carry out under Applicable Data Protection Law.

Countly shall provide its current security reports and certificates upon Customer's written request, no more than once annually. Customer, or an auditor it mandates, may audit Countly, including by inspection, only where these are not sufficient to demonstrate Countly's compliance with this DPA or where Applicable Data Protection Law requires it. Any audit shall be agreed in advance as to timing and scope, and Countly may charge its reasonable costs.

Upon termination or expiration of the Agreement, including when Customer cancels its Flex subscription, Countly shall, at Customer's choice, delete or make available to Customer for retrieval all relevant Personal Data (including copies) in Countly's possession, save to the extent that Countly is required by any applicable law to retain some or all of the Personal Data. In such event, Countly shall extend the protections of the Agreement and this DPA to such Personal Data and limit any further processing of such Personal Data to only those limited purposes that require the retention, for so long as Countly maintains the Personal Data.

8.1 Where Customer Data processed subject to the UK GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer the EU Model Clauses (Module 4) as amended by the UK Addendum shall be deemed signed by Customer and incorporated into this DPA. Table 3 of the UK Addendum shall be deemed populated in accordance with the information set out in Appendix A of this DPA; and

(b) to the extent a conflict exists between the terms of this DPA and the terms of the EU Model Clauses or the UK Addendum, the terms of the EU Model Clauses and/or UK Addendum shall take precedence.

8.2 Where Customer Data processed subject to the EU GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer, the EU Model Clauses shall be deemed signed by Customer and incorporated into this DPA. The relevant Annexes of the EU Model Clauses shall be deemed populated in accordance with the information set out in Appendix A of this DPA; and

(b) to the extent a conflict exists between the terms of this DPA and the terms of the EU Model Clauses, the terms of the EU Model Clauses shall take precedence.

8.3 Where Countly makes a Restricted Transfer to a Sub-processor, Countly shall ensure that the transfer is covered by the EU Model Clauses (Module 3) and, for Customer Data subject to the UK GDPR, the UK Addendum, or by another valid transfer mechanism under Applicable Data Protection Law, and shall provide details of the mechanism relied upon to Customer on request.

Processing of Personal Data

Nature and Subject Matter: The Data Processing Services: storing and processing the data that Customer's websites and applications send to Customer's Flex server and making it available to Customer's dashboard users; sending the e-mails that Customer's Flex server sends; and, where Customer uses them, forwarding AI Assistant requests to the model provider and returning the responses, and symbolicating crash reports.

Duration: The Processing begins on the Effective Date and continues for the term of Customer's Flex subscription.

Location: the Google Cloud region Customer chooses for its Flex server; Sub-processors process Customer Data in the locations stated on the Sub-processor List (Section 4.1).

Data Subjects

The Personal Data concerns the following categories of Data Subjects:

• Customer's employees
• End users of Customer’s websites and applications that send data to Customer's Flex server
• Customer's dashboard users

Purposes of the Processing

The Processing is necessary for the following purposes:

• Countly shall Process Personal Data as necessary to perform its obligations as set out in the Agreement and any written instructions provided by the Customer to Countly in accordance with this DPA.

Categories of Personal Data

The Personal Data that can be processed fall within the following categories:

• Randomly generated/pseudo anonymized/advertising ID
• Name
• Username
• Organization/Company
• Address
• Phone number
• Email
• Location data (country code, region, city, coordinates)
• Birth year
• Gender
• Events
• Time zone
• Time processed
• Device information (OS, OS version, screen size and density, browser, browser version, device model, device type, device manufacturer, locale, screen orientation)
• AI Assistant prompts and the data sent with them
• Crash reports and the symbol files Customer uploads

Special Categories of Personal Data and/or Article 10 GDPR Personal Data (if applicable)

The Personal Data Processed falls within the following special categories of Personal Data/Article 10 data:

• N/A

Rights and Obligations of Customer

The rights and obligations of the customer where it is a controller shall be as set out in this DPA and Applicable Data Protection Law.

Sub-Processors

Those on the Sub-processor List (Section 4.1) on the Effective Date, as updated in accordance with Sections 4.2 and 4.3.

Restricted Transfers