## VENDOR DATA PROTECTION ADDENDUM This Vendor Data Protection Addendum (the " DPA ") forms part of, and is subject to the Agreement by and between the party identified as 'Vendor' or as otherwise named in the Agreement (collectively, ' Vendor ') and the member of the Snowflake Group that is a party to the Agreement with Vendor for Vendor's services (' Snowflake '). All capitalized terms not otherwise defined herein shall have the meanings set forth in the Agreement. Vendor will provide services as described in the Agreement that will involve the Processing of Personal Data (the ' Services '). In delivering the Services under the Agreement, Vendor may Process Personal Data controlled by Snowflake, Snowflake Affiliate and/or their respective representatives, customers, or business partners. ## A GREEMENT ## 1. DEFINITIONS - 1.1 " Agreement " means collectively the written agreement under which Snowflake licenses, or is provided access to, or receives the Services, which may include one or more purchase orders, contracts and/or agreements, including any evaluation or pre-release agreements. - 1.2 " Applicable Privacy Law(s) " means all data protection and privacy laws and regulations worldwide applicable to the Personal Data in question, including, where applicable, European Data Protection Law and U.S. state data protection laws, including, but not limited to, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, together with all implementing regulations (the ' CCPA '). - 1.3 " Authorized Person(s) " means any person who Processes Personal Data on Vendor's behalf, including Vendor's and its Sub-processors' employees, officers, partners, principals and contractors. - 1.4 " Business Contact Data " means contact information relating to Snowflake's representatives for (i) invoicing, billing and other business inquiries, (ii) information on usage of the Services, and (iii) contract management. - 1.5 ' Data Privacy Framework ' or ' DPF ' means (as applicable) the EU-U.S. Data Privacy Framework, the U.K. Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs as operated by the U.S. Department of Commerce, and their respective successors. - 1.6 ' DPF Principles ' means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time. - 1.7 " European Data Protection Law " means all data protection and privacy laws and regulations of Europe, including, where applicable, (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (" GDPR "); (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (" U.K. GDPR "); (iii) the U.K. Data Protection Act 2018; (iv) the Swiss Federal Act on Data Protection (' FADP '); and (v) any national data protection laws made under or pursuant to the GDPR. - 1.8 " Snowflake Personal Data " means any information Snowflake and/or its Authorized Affiliate provides to Vendor pursuant to the Agreement that relates to an identified or identifiable natural person (' data subject ') and information that is deemed personal data, personal information, or personally identifiable information under Applicable Privacy Laws. - 1.9 " Personal Data Breach " means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. - 1.10 " Restricted Transfer " means a transfer of Personal Data that is subject to Applicable Privacy Laws of the originating country to a country that does not provide an adequate level of protection for Personal Data according to the Applicable Privacy Laws of the originating country. - 1.11 " SCCs " or " Standard Contractual Clauses " means together (i) the ' EU SCCs ', found at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers\_en, or a successor website designated by the EU Commission, and (ii) the ' U.K. SCCs ' means the International Data Transfer Addendum issued by the Information Commissioner's Office under s.119(A) of the U.K. Data Protection Act 2018, currently available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transferaddendum.pdf . - 1.12 " Sub-processor " means any third party (including any Vendor Affiliate) engaged directly or indirectly by Vendor to Process any Personal Data relating to this DPA and/or the Agreement. - 1.13 The terms " Controller ", " Processor ", and ' Processing ' (including Process, Processed, and Processes), shall have the respective meanings ascribed to them in Applicable Privacy Laws. If and to the extent that Applicable Privacy Laws do not define such terms, then the definitions given in European Data Protection Law will apply. ## 2. ROLE AND SCOPE OF PROCESSING - 2.1 Roles of the Parties and Details of Processing. Vendor shall Process Personal Data solely as a Processor (or Sub-Processor) acting on behalf of Snowflake and/or Authorized Affiliate. Snowflake may be a Controller (e.g., for its own employees' personal data) or Processor (e.g., for personal data provided to Snowflake by its customers) of the Personal Data. - 2.2 Vendor's Processing of Personal Data. Vendor shall at all times: (i) only Process Personal Data as described in Annex IB (the "Permitted Purpose") in providing the Services to Snowflake under the Agreement and in accordance with Snowflake's documented instructions; and (ii) not Process the Personal Data for its own purposes or those of any third party. - 2.3 Vendor's Notification Obligations Regarding Snowflake Instructions. Vendor shall promptly notify Snowflake in writing, unless prohibited under Applicable Privacy Law, if: - (a) it becomes aware of or believes that any data Processing instruction(s) from Snowflake violates Applicable Privacy Law; - (b) it is unable to comply with Snowflake's data Processing instructions for any reason; and/or; - (c) it is unable to comply with the terms of the Agreement (including this DPA) as they relate to, or govern the Processing or security of Personal Data, and/or Business Contact Data for any reason. - 2.4 Business Contact Data. Snowflake may disclose Business Contact Data to Vendor. Vendor shall comply with all applicable laws and its applicable privacy policies with respect to the Processing of Business Contact Data and use Business Contact Data only for the purposes defined in Section 1.4 (i)-(iii). ## 3. SUB-PROCESSING - 3.1 Appointment of Sub-processors . Vendor shall not subcontract any Processing of Personal Data to a Sub-processor without the prior written consent of Snowflake. Upon execution of the Agreement, Vendor shall provide Snowflake with an up-to-date list of its then current Subprocessors. Notwithstanding the foregoing, Snowflake consents to Vendor's engagement of additional Sub-processors provided that: - (a) Vendor provides at least twenty-one (21) days prior written notice to Snowflake of a change to existing Sub-processors or the engagement of any new Sub-processor, including details and location of the Processing (the ' Objection Period ') and, if Snowflake has not objected to the new Sub-processor pursuant to Section 3.2 below, Vendor shall update the list of Sub-processors authorized to Process Personal Data and send such updated list to Snowflake at privacy@snowflake.com prior to the engagement of the Sub-processor; - (b) Vendor enters into a written agreement with each Sub-processor imposing data protection obligations no less protective of Personal Data as Vendor's obligations under this DPA (including the SCCs and/or other data transfer provisions) to the extent applicable to the nature of the services provided by such Sub-processor; and - (c) Vendor remains fully liable to Snowflake for any breach of this DPA, the Agreement, and/or Applicable Privacy Laws, that is caused by an act, error or omission of such Subprocessor. - 3.2 Objection Right for New Sub-processors . Snowflake may object to the appointment or replacement of a Sub-processor during the Objection Period provided such objection is based on reasonable grounds. In such an event, the parties shall discuss in good faith commercially reasonable alternative solutions. If the parties cannot reach resolution within a reasonable period of time, which shall not exceed thirty (30) days, Vendor will either replace or not appoint the Subprocessor or, if this is not possible based on the parties' good faith discussion, Snowflake may terminate the Agreement (in whole or in part), by providing written notice to Vendor. Vendor will refund Snowflake any prepaid unused fees under the Agreement following the effective date of termination. ## 4. DATA SUBJECT RIGHTS AND COOPERATION - 4.1 Data Subject Request . Vendor shall reasonably cooperate with Snowflake and, if feasible, provide Snowflake a mechanism to enable Snowflake to respond to any requests, complaints or other communications from a data subject, supervisory authority, and regulatory or judicial body relating to the Processing of Personal Data and Business Contact Data under the Agreement, including requests from data subjects seeking to exercise their rights under Applicable Privacy Laws. If any such request or complaint or communication is made directly to Vendor, Vendor shall promptly forward it to Snowflake and shall not respond to such communication without Snowflake's express authorization. - 4.2 Subpoenas and Court Orders . If Vendor receives a subpoena, court order, warrant or other legal demand from a third party (including law enforcement or other public or judicial authorities) seeking the disclosure of Personal Data, Vendor shall not disclose any information but shall immediately notify Snowflake in writing of such request, and reasonably cooperate with Snowflake if it wishes to limit, challenge or protect against such disclosure, to the extent permitted by applicable laws. - 4.3 Data Protection Impact Assessments ('DPIAs') and Consultation . To the extent Vendor is required under Applicable Privacy Laws, Vendor will provide reasonable assistance to Snowflake to conduct a data protection impact assessment and/or consult with applicable data protection authorities in respect of any proposed Processing activity under this DPA. ## 5. DATA ACCESS & SECURITY MEASURES - 5.1 Confidentiality and Limitation of Access . Vendor shall ensure that any Authorized Person is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and that they Process the Personal Data only for the purpose of delivering the Services under the Agreement to Snowflake. - 5.2 Security Measures . Vendor will implement and maintain all appropriate technical and organizational security measures to protect Personal Data and Business Contact Data from Personal Data Breaches and to preserve the security, integrity and confidentiality of such data ("Security Measures"). Such Security Measures shall take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The Vendor Security Agreement executed between the parties shall be incorporated by reference. ## 6. PERSONAL DATA BREACHES - 6.1 Notification of Personal Data Breaches . In the event of a Personal Data Breach, Vendor shall notify Snowflake without undue delay, and in any case, within forty-eight (48) hours after becoming aware. The notification shall be sent to security@snowflake.com and with written details of the Personal Data Breach, including all information necessary for Snowflake to fulfill its obligations under Applicable Privacy Laws, including data breach reporting and risk assessment obligations. - 6.2 Vendor's Obligations Following Personal Data Breach . Furthermore, in the event of a Personal Data Breach, Vendor shall: - (a) provide timely information and cooperation as Snowflake may reasonably require, including without limitation, collecting and preserving all information and evidence pertaining to the Personal Data Breach and the investigation conducted by Vendor; - (b) take such measures and actions as are appropriate to remedy or mitigate the effects of the Personal Data Breach and keep Snowflake up-to-date about all material developments in connection with the Personal Data Breach; and - (c) to the extent that a Personal Data Breach is caused by an act, error or omission of Vendor or a Sub-processor which includes a failure to comply with their obligations under this DPA and/or Applicable Privacy Laws, reimburse Snowflake, subject to any applicable limitations under the Agreement, for the reasonable costs for Snowflake to prepare and send all notifications that are legally required. At the written request of Snowflake and to the extent legally required, Vendor agrees to provide, at its sole expense, credit monitoring and identity theft protection services to individuals affected by a Personal Data Breach. - 6.3 Communications . Any notification, public/regulatory communication or press release concerning the Personal Data Breach that identifies Snowflake shall be solely at Snowflake's discretion, except as otherwise required by Applicable Privacy Laws. ## 7. SECURITY REPORTS & INSPECTIONS - 7.1 Vendor Security Standards . Vendor shall maintain relevant records of its information security management system. Upon request, Vendor shall provide copies of any existing relevant external information security certifications, audit report summaries and/or other documentation reasonably required by Snowflake to verify Vendor's compliance with this DPA. - 7.2 Right of Inspection . Notwithstanding Section 7.1 above, Snowflake may require Vendor to periodically complete a written privacy or security questionnaire. Snowflake (or its appointed independent third-party auditor that is not a competitor of Vendor) may carry out an inspection of the Vendor's operations and facilities for the purposes of verifying Vendor's compliance with this DPA. Such audit or inspection shall occur during normal business hours and subject to reasonable prior notice where Snowflake considers it necessary or appropriate (for example, without limitation, where Snowflake has reasonable concerns about Vendor's data protection compliance, following a Personal Data Breach, following instruction from a data protection authority or based on Vendor's responses to a security questionnaire that reveal a material issue in Vendor's Security Measures). Snowflake will provide Vendor any audit reports generated in connection with this Section 7.2, unless prohibited by applicable law. ## 8. INTERNATIONAL TRANSFERS - 8.1 International Transfers . Vendor and/or its Affiliate shall not Process or transfer any Personal Data and/or Business Contact Data in or to a territory other than the territory in which the Personal Data and/or Business Contact Data was first collected or provided to Vendor (nor permit such data to be so Processed or transferred) unless it takes all measures necessary to ensure such Processing or transfer is in compliance with Applicable Privacy Laws. - 8.2 Data Privacy Framework . Snowflake is self-certified to the Data Privacy Framework. To the extent that Vendor and/or its Affiliates are recipients of Personal Data and/or Business Contact Data that is within scope of Snowflake's DPF certification, Vendor agrees that it shall (i) only process such Personal Data and/or Business Contact Data for the limited and specified purposes described in this DPA, and (ii) provide at least the same level of protection for such Personal Data and/or Business Contact Data as is required by the DPF Principles by complying with its obligations set forth in this DPA. - 8.3 Transfer Mechanism . To the extent that the transfer of Personal Data and/or Business Contact Data from Snowflake to Vendor is a Restricted Transfer, Vendor shall comply with the following: - (a) If Vendor is self-certified to the Data Privacy Framework and the Personal Data and/or Business Contact Data is within the scope of such certification, Vendor represents and warrants that it shall (i) provide at least the same level of protection for such Personal Data and/or Business Contact Data as is required by the DPF Principles, (ii) promptly notify Snowflake if it can no longer meet its obligations under the DPF Principles and, (iii) in such event, work with Snowflake and promptly take all reasonable and appropriate steps to stop and remediate (if remediable) any Processing until such time as the Processing complies with Applicable Privacy Laws. - (b) Alternatively, if European Data Protection Law requires that appropriate safeguards are put in place (for example, if Vendor is not self-certified to the Data Privacy Framework, the Data Privacy Framework does not cover the Restricted Transfer, and/or the Data Privacy Framework is invalidateD), the SCCs shall automatically be incorporated into this DPA and apply to the Restricted Transfer as set forth in Section 8.4. - 8.4 Standard Contractual Clauses (SCCs). Pursuant to Section 8.3 above, the parties agree that the SCCs (including Annexes I and II) shall be incorporated by reference and form an integral part of this DPA. Each party is deemed to have executed the SCCs by executing the Agreement incorporating this DPA . With respect to the SCCs, the following shall apply: - (a) Snowflake (acting on behalf of itself and its Authorized Affiliate) shall be the "data exporter" and Vendor shall be the "data importer"; - (b) Module Two shall apply to the extent that Snowflake is a Data Controller and Module Three shall apply to the extent that Snowflake is a Data Processor. The same shall apply with respect to Table 2 of the U.K. SCCs; - (c) The optional Clause 7 shall apply and Affiliate(s) of both Snowflake and Vendor may accede to the SCCs under the same terms, where applicable. The foregoing shall apply with respect to table 2 of the U.K. SCCs; - (d) For purposes of Clause 9 of the SCCs, Option 2 ('General written authorization') shall apply and the time period for the addition or replacement of Sub-processors shall be described in Section 3.1 (Appointment of Sub-processors), and the same shall apply with respect to Table 2 of the U.K. SCCs; - (e) The optional language in Clause 11 shall not apply; - (f) For purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law and jurisdiction shall be the Netherlands. Part 2, Section 15(m) and Part 2, Section 15(n) of the U.K. SCCs regarding Clause 17 and Clause 18 of the EU SCCs shall apply; - (g) Table 3 of the U.K. SCCs shall be populated with the relevant information set out at Annex I, Annex II and Section 3 (Sub-Processing) to this DPA; - (h) With respect to Table 4 of the U.K. SCCs, either the data exporter or data importer may terminate the U.K. SCCs prior to termination of the Agreement and this DPA; and - (i) For transfers from Switzerland or other countries that adopted and/or has determined the EU SCCs are adequate for Restricted Transfers, references in the EU SCCs shall be interpreted to include applicable terminology for those territories (e.g. 'Member State' shall be interpreted to mean 'Switzerland' for transfers from Switzerland). - 8.5 Required Disclosures . Vendor acknowledges that Snowflake may disclose this DPA and any relevant privacy provisions in the Agreement to the U.S. Department of Commerce, the Federal Trade Commission, European supervisory authorities or any other U.S., EU, Swiss or U.K. judicial or regulatory body upon their request. ## 9. DELETION & RETURN - 9.1 Upon Snowflake's request, or upon termination or expiration of this DPA, Vendor shall, at Snowflake's choice, securely and permanently destroy or return to Snowflake all Personal Data (including copies) in its possession or control (including any Personal Data Processed by its Subprocessors). Until the Personal Data is destroyed or returned, Vendor shall continue to ensure compliance with this DPA. ## 10. CCPA OBLIGATIONS - 10.1 Snowflake and Vendor agree that, solely the purposes of this Section 10, the terms ' aggregate consumer information ,' ' deidentified ,' ' process ,' ' processor ,' ' sell ,' ' service provider ,' and ' share ' shall have the respective meanings ascribed to them under CCPA. - 10.2 To the extent the CCPA applies to Vendor's Processing of Personal Data, Vendor is acting as a 'service provider' or 'processor' to Snowflake and will not (i) 'sell' or 'share' Personal Data, (ii) combine the Personal Data with any other Personal Data, unless expressly instructed by Snowflake for a specific purpose, and for the sole benefit of Snowflake, in providing the Service or (iii) retain, use, or disclose Personal Data for any purpose (including any commercial purpose) other than for the specific purpose of Vendor's performance of the Services under the Agreement. Vendor certifies that it understands the preceding restrictions. - 10.3 To the extent that Vendor reserves rights under the Agreement to 'aggregate' or 'aggregated' Personal Data, Vendor agrees that the CCPA definition of 'aggregate consumer information' applies to such Personal Data and Vendor will process such Personal Data accordingly . - 10.4 To the extent that Vendor reserves rights under the Agreement to 'deidentified,' 'anonymized,' or 'anonymous' Personal Data, Vendor agrees that the CCPA definition of 'deidentified' applies to such Personal Data and Vendor will process such Personal Data accordingly. - 10.5 Notwithstanding the foregoing, and for the purpose of addressing other prospective data protection laws, Vendor shall not process any Personal Data other than for the specific purpose of Vendor's performance of its Services under the Agreement. ## 11. LIABILITY - 11.1 Vendor acknowledges and agrees that it shall be liable for any loss of Personal Data and/or Business Contact Data caused by an act, error or omission of Vendor arising under or in connection with the Agreement and this DPA. - 11.2 The parties acknowledge and agree that a material breach by Vendor of this DPA shall constitute a material breach of the Agreement, in which event and without prejudice to any other right or remedy available to it, Snowflake may elect to immediately terminate the Agreement and this DPA. - 11.3 In no event shall either party limit its liability with respect to any data subject's data protection rights under this DPA (including the SCCs, if applicable) or otherwise. For clarity, this DPA (including the SCCs, if applicable) are governed by the liability provisions of the Agreement to the extent allowable under Applicable Data Protection Law. ## 12. GENERAL - 12.1 The obligations placed upon Vendor under this DPA shall survive so long as Vendor and/or its Subprocessors Process Personal Data on behalf of Snowflake. This DPA may not be modified except by a subsequent written instrument signed by both parties. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected. In the event of any conflict or inconsistency between this DPA and the Agreement, the parties agree that the terms of this DPA shall prevail solely to the extent of such conflict or inconsistency. - 12.2 This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions set forth in the Agreement, unless otherwise required by Applicable Privacy Laws or as set forth in the SCCs (if applicable) pursuant Section 8.4(f) above. ## ANNEX I ## ANNEX IA: LIST OF PARTIES | Data Exporter: | Data Exporter: | |--------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------| | Name: | Snowflake (as defined in the Agreement) | | Address: | As set forth in the Agreement | | Contact person's name, position and contact details: | Head of Privacy, privacy@snowflake.com | | Data Protection Officer: | dpo@snowflake.com | | Representative: | privacy@snowflake.com or Snowflake Computing Netherlands B.V., FOZ Building, Gustav Mahlerlaan 300- 314, 1082 ME Amsterdam, Netherlands | | Activities relevant to data transferred under these Clauses: | Relevant activities are described in Annex 1B below. | | Role (controller / processor): | Controller and/or Processor | | Data Importer: | Data Importer: | |--------------------------------------------------------------|--------------------------------------------------------------------------| | Name: | Vendor (as defined in the Agreement) | | Address: | As set forth in the Agreement | | Contact person's name, position and contact details: | Contact details as set forth in the Agreement | | Activities relevant to data transferred under these Clauses: | The Vendor provides Snowflake with Services as defined in the Agreement. | | Role (controller / processor): | Processor | ## ANNEX IB: DESCRIPTION OF THE TRANSFER | Description | Controller | |--------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SCCs Modules | Module Two and Module Three | | Categories of data subjects: | ● Prospects, applicants, candidates, current and former employees, agents, advisors, contractors, freelancers of Snowflake and/or Authorized Affiliate; ● Employees or contact persons of Snowflake's prospects, customers, business partners and vendors; ● Business contacts, marketing leads, vendors of Snowflake and/or Authorized Affiliate. | | Categories of personal data: | Snowflake determines the categories of personal data processed by Vendor as it relates to the Services procured by Snowflake as further described in the Agreement which may include: Identification and contact data (name, title, address, phone number, email address); financial information (credit card details, account details, payment information); employment details (employer, job title, academic and professional qualifications, geographic location, area of responsibility, affiliated organization, area of responsibility and industry); purchase and usage history; IT related data (IP addresses of visitors to websites of Snowflake and/or Snowflake's customers, online navigation data, browser type, language preferences, pixel data, cookies data, web beacon data); and IT information (computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (ie cookies and information recorded for operation and training purposes). | | Sensitive data transferred (if applicable) and applied | The parties do not expect the Services to include the Processing of special categories of data or sensitive data, such as data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union | | restrictions or safeguards: | membership, genetic data, biometric data, data concerning health and/or data concerning a natural person's sex life or sexual orientation. If and to the extent necessary for Vendor to perform the Services and as permitted by Applicable Privacy Law, Vendor Processes such special categories of data, then such Processing is subject to Annex II for applied restrictions and safeguards. | |-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Frequency of the transfer: | Continuous with the provision of the Services. | | Nature of the processing: | Vendor shall perform Processing as needed to provide the Services to Snowflake as described in the Agreement and comply with Snowflake's Processing instructions where applicable. | | Purpose(s) of the data transfer and further processing: | To provide the Services to Snowflake as described in the Agreement. | | Period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: | The duration of Processing will be as designated in the Agreement. | | For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: | The subject matter, nature and duration of the processing by sub- processors are as set forth in this DPA. | ## ANNEX IC: COMPETENT SUPERVISORY AUTHORITY The supervisory authority of the Member State in which the Data Exporter's representative is established, namely the Netherlands. ## ANNEX II ## SECURITY MEASURES The description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons are as set forth in the Vendor Security Agreement executed between the parties.