March 1, 2025 – Data Processing Addendum

Skip to content

ARCHIVE Data Processing Addendum - 2025-03-01

This is an archived version of our Data Processing Addendum dated March 1, 2025. View the current version here.

This Data Processing Addendum (“DPA“) forms part of, and is subject to, the Master SaaS Agreement or other written or electronic terms of service or subscription agreement (the “Agreement”) between the member of the Snowflake Group that is a party to such agreement (“Snowflake”) and the entity or person defined as ‘Customer’ thereunder, and each Customer Affiliate that is party to an Order Form pursuant to the Agreement (collectively and individually referred to herein as “Customer”; and together with Snowflake, collectively, the “Parties” or individually, a “Party”). All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.

1. Definitions.

“Account” means Customer’s account in the Service in which Customer stores and processes Customer Data.

“Affiliate” has the meaning set forth in the Agreement.

“Authorized Affiliate” means a Customer Affiliate who has not signed an Order Form pursuant to the Agreement, but is either a Data Controller or Data Processor for the Customer Personal Data processed by Snowflake pursuant to the Agreement, for so long as such entity remains a Customer Affiliate.

“California Consumer Privacy Act” or “CCPA” means the California Consumer Privacy Act of 2018, as may be amended from time to time.

“Customer Data” has the meaning set forth in the Agreement.

“Customer Personal Data” means any Customer Data that is Personal Data.

“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.

“Data Processor” means an entity that Processes Personal Data on behalf of a Data Controller.

“Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement, including, where applicable, EU & UK Data Protection Law and the CCPA.

“Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.

“EU & UK Data Protection Law” means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2018.

“Personal Data” means any information, including opinions, relating to an identified or identifiable natural person and includes similarly defined terms in Data Protection Laws, including, but not limited to, the definition of “personal information” in the CCPA.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, and “Process”, “Processes” and “Processed” will be interpreted accordingly.

“Purposes” means (i) Snowflake’s provision of the Snowflake Offerings as described in the Agreement, including Processing initiated by Users in their use of the Snowflake Offerings; and (ii) further documented, reasonable instructions from Customer agreed upon by the Parties.