September 20, 2022

Home

Stay organized with collections

Save and categorize content based on your preferences.

Cloud Data Processing

Addendum (Partners)

Last modified: September 20, 2022

This is not the current version of this document and is provided for archival purposes.

View the current version

This Google Cloud Data Processing Addendum including its appendices (“Addendum”) is incorporated into the Agreement under which Google has agreed to provide Google Cloud Platform (the “Services”) to Partner. This Addendum was formerly known as the “Data Processing and Security Terms”.

1. Commencement

This Addendum will be effective and replace any terms previously applicable to the processing of Partner Data, including any Data Processing and Security Terms, from the Addendum Effective Date (as defined below).

2. Definitions

2.1 Capitalized terms used but not defined in this Addendum have the meaning given to them in the Agreement:

• Account has the meaning given in the Agreement or, if no such meaning is given, means Partner’s Google Cloud Platform account.

• Addendum Effective Date means the date on which Partner accepted, or the parties otherwise agreed to, this Addendum.

• *Additional Security Controls *means security resources, features, functionality and/or controls that Partner may use at its option and/or as it determines, including the Admin Console, encryption, logging and monitoring, identity and access management, security scanning, and firewalls.

• *Adequate Country *means:

(a) for data processed subject to the EU GDPR: the EEA, or a country or territory recognized as ensuring adequate protection under the EU GDPR;

(b) for data processed subject to the UK GDPR: the UK, or a country or territory recognized as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; and/or

(c) for data processed subject to the Swiss FDPA: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) recognized as ensuring adequate protection by the Swiss Federal Council under the Swiss FDPA;

in each case, other than on the basis of an optional data protection framework.

• Alternative Transfer Solution means a solution, other than SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law, for example a data protection framework recognized as ensuring that participating entities provide adequate protection.

• Audited Services means the then-current Services indicated as being in-scope for the relevant certification or report at

https://cloud.google.com/security/compliance/services-in-scope. Google may not remove any Services from this URL unless those Services have been discontinued in accordance with the Agreement.

• Data Incident means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Partner Data on systems managed by or otherwise controlled by Google.

• EEA means the European Economic Area.

• *EMEA *means Europe, the Middle East and Africa.

• EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.