# Page 1 of 4  	Adobe Data Protection Terms, 2023JAN3

Data Protection Terms for Cloud Services These data protection terms (“Data Protection Terms”) state the parties’ obligations to comply with applicable Data Protection Laws in connection with Adobe’s provision and Customer´s use of the Cloud Services.
1. Definitions The capitalized terms will have the meanings set out below.  All capitalized terms not defined in these Data Protection Terms shall have the meanings ascribed to them in the License Agreement.
a. “Cloud Services” means the On-demand Services and Managed Services provided by Adobe and its Affiliates.
b. “Data Protection Laws” means any applicable privacy and data protection laws, regulations, and rules.
c. "License Agreement" means the agreement under which Adobe supplies Customer with the Cloud Services, whether directly or indirectly.
d. “Instruction” means any documented instruction or data input received by Adobe from Customer.
e. “Personal Data” is given the meaning under Data Protection Laws relating to this term or any similar term (such as “personal information” or “personally identifiable information”) used in Data Protection Laws, or where no such laws apply, means any information that by itself or when combined with other information (such as telephone number, e-mail address, precise real-time GPS location, and government-issued identification number) can be used by Adobe to identify a specific natural person.
f. “Process” or “Processing” is given the meaning under the relevant Data Protection Laws relating to this term, or where no such term exists, shall mean any operation which is performed upon Personal Data, such as collecting, recording, storing, adaptation or alteration, retrieval, use, disclosure, or otherwise making available, erasing or destructing.
## 2. General Provisions.
These Data Protection Terms are applicable to the Processing of Personal Data by Adobe in providing the Cloud Services under the License Agreement.  Any data privacy claim or claim related to Personal Data will be subject to the liability cap in the License Agreement.  In case of inconsistencies between these Data Protection Terms and the License Agreement, these Data Protection Terms shall prevail.  These Data Protection Terms replace any prior version of the Data Protection Terms.
## 3. Processing and Types of Personal Data.

Page 2 of 4  	Adobe Data Protection Terms, 2023JAN3

For the purpose of applicable Data Protection Laws, Adobe is the “processor” or “service provider,” as defined, and Customer is the “controller” or “business.” The subject matter, nature, purpose, and details of the data Processing, and the types of Personal Data Processed are determined by the Customer through Customer’s use of the Cloud Services and may include Personal Data such as email, name, address, IP address, marketing profiles, unique user IDs (such as cookie IDs), or images, documents or content containing Personal Data.   The duration of Processing will be for the duration of the applicable Cloud Service as set forth in the License Agreement.
a. In relation to any Personal Data contained in Customer Data or Customer Content:
i. the parties acknowledge and agree that as between the parties, Adobe will Process the Personal Data on behalf of Customer and pursuant to Customer’s Instructions, in accordance with the License Agreement and these Data
Protection Terms;
ii. Adobe must comply with its obligations under Data Protection Laws and protect Personal Data as required by Data Protection Laws in the course of Processing Personal Data for Customer (including any such obligations that relate to Adobe’s use of subcontractors); and iii. Customer must comply with its obligations under Data Protection Laws and perform all acts required under Data Protection Laws in order for Adobe to Process the Personal Data for the purposes of the License Agreement (including but not limited to giving any notifications, obtaining any consents, and making any disclosures required under the Data Protection Laws).
b. Notwithstanding anything in the License Agreement, the liability of a party for breach of this clause 3 or its obligations under Data Protection Laws will be reduced proportionately to the extent that any wrongful (including negligent) act or omission of the other party or its personnel or any third party acting on its behalf directly caused or contributed to such breach.
## 4. Customer’s Responsibility.
a. Customer shall give Instructions to Adobe as agreed by the Parties in the License Agreement, or through its use of the Cloud Services.
b. If Customer becomes aware of any breaches of, or other irregularities with, the requirements of applicable Data Protection Laws, if required by applicable Data Protection Laws, Customer shall promptly notify and provide Adobe with commercially reasonable Instructions to avoid non-compliance with applicable Data Protection Laws.
## 5. Adobe’s Responsibility.
a. Adobe will only Process Personal Data within the scope of Customer’s Instructions and as permitted in the License Agreement for the business purposes specified in the License Agreement for the applicable Cloud Service.  If Adobe becomes aware, based on its

Page 3 of 4  	Adobe Data Protection Terms, 2023JAN3

reasonable belief, that an Instruction from Customer is in breach of Data Protection Laws, Adobe shall notify Customer.  Adobe shall be entitled, but not obliged, to suspend execution of the Instructions concerned, until Customer confirms in writing that such Instructions are in accordance with applicable Data Protection Laws. Notwithstanding the foregoing, Adobe may Process the Personal Data if it is required under the Data Protection Laws to which it is subject. In this situation, Adobe shall inform the Customer of such a requirement before Adobe Processes the data unless the Data Protection Laws prohibit this on important grounds of public interest.
b. Upon Customer’s reasonable request, and if required by applicable Data Protection Laws, Adobe shall: (i) delete or return, or provide technical and/or organizational measures designed to enable Customer to delete and/or download, all Personal Data contained in Customer Data or Customer Content to Customer as requested upon the end of the provision of applicable Could Services, unless retention of Personal Data is required by law; (ii) make available information necessary to demonstrate compliance with applicable Data Protection Laws; and (iii) make available to Customer, via the Adobe Trust Center, third-party certifications and audits related to the Cloud Services.  If Adobe determines it can no longer meet its obligations under applicable Data Protection Laws, and if required by applicable Data Protection Laws, Adobe will notify Customer without undue delay.
c. Adobe will require that each person Processing Personal Data contained in Customer Data or Customer Content is subject to confidentiality with respect to such Personal Data.
d. Customer agrees that Adobe shall be entitled to use subcontractors (also referred to as sub-processors) for the respective 	Cloud Services :
https://www.adobe.com/go/processing (“Processor Website”). Such subcontractors may be Affiliates of Adobe or third-party service providers. Adobe has entered into agreements with the subcontractors which ensure that such subcontractors shall be obliged to meet equivalent obligations as those set out in these Data Protection Terms.
To receive notice of any new subcontractor, Customer may subscribe to receive email notifications for updates to the Processor Website via the link on the Processor Website.
e. Adobe will not:
i. sell, or share for targeted advertising or cross-context behavioral advertising, as defined by applicable Data Protection Laws, the Personal Data it receives from or on behalf of Customer, except as directed by Customer and as permitted in the
License Agreement;
ii. retain, use, or disclose Personal Data received from or on behalf of Customer outside of its direct business relationship with Customer or for any business or commercial purpose other than the business purpose(s) specified in the License Agreement, or as permitted by applicable Data Protection Laws; or iii. combine Personal Data received from or on behalf of Customer with Personal Data received from or on behalf of another person or persons, except for a

Page 4 of 4  	Adobe Data Protection Terms, 2023JAN3

permitted business purpose as specified in the License Agreement or as permitted by applicable Data Protection Laws.
## 6. Security of Personal Data.
a. Adobe has implemented and maintains reasonable and appropriate Technical and Organizational Measures for Cloud Services regarding the protection of Personal Data Processed under these terms, assessable via th	is link:
https://www.adobe.com/go/CloudSvcsTOSM.
b. Adobe has obtained the third-party certifications and audits evaluating these Technical and Organizational Measures and which are listed on Adobe´s Trust Center website (also accessible via https://www.adobe.com/security/compliance.html).
c. Adobe´s Technical and Organizational Measures are subject to technical progress and further development. Accordingly, Adobe reserves the right to modify the Technical and Organizational Measures provided that the functionality and security of the Cloud Services are not degraded.
## 7. Individual Requests.
If Adobe receives a data rights request from an individual that relates to Customer, Adobe will promptly inform Customer of said request(s) it receives from an individual in connection with the Cloud Services licensed by Customer. Customer is responsible for ensuring such requests are handled in accordance with Data Protection Laws.
## 8. Costs.
In the event that Customer requests that Adobe provide assistance with Customer fulfilling its obligations under applicable Data Protection Laws which goes beyond the standard functionality of the Cloud Services, Adobe may charge Customer for any costs beyond the agreed upon license fees to the extent it is not commercially reasonable for Adobe to provide such assistance without charge (considering relevant factors such as volume of requests, complexity of Instructions and timescale requested). This shall include, without limitation, costs incurred by Adobe in executing Customer's Instructions relating to the erasure or return of Customer’s Personal Data, additional storage costs, or retention of Customer's Personal Data.