Snowflake Vendor Data Protection Addendum

Skip to content

Vendor Data Protection Addendum

**Last Updated: **March 10, 2025 | Previous Versions

This Vendor Data Protection Addendum (the “DPA“) forms part of, and is subject to the Agreement by and between the party identified as ‘Vendor’ (or as otherwise named in the Agreement) along with its Affiliates (collectively, “Vendor”) and the member of the Snowflake Group that is a party to the Agreement with Vendor for Vendor’s services (“Snowflake”). All capitalized terms not otherwise defined herein shall have the meanings set forth in the Agreement.

Vendor will provide services as described in the Agreement that will involve the Processing of Personal Data (the “Services”). In delivering the Services under the Agreement, Vendor may Process Personal Data controlled by Snowflake, Snowflake Affiliate and/or their respective representatives, customers, or business partners.

1. DEFINITIONS

“Agreement” means collectively the written agreement under which Snowflake licenses, or is provided access to, or receives the Services, which may include one or more purchase orders, contracts and/or agreements, including any evaluation or pre-release agreements.”

Applicable Privacy Law(s)” means all data protection and privacy laws and regulations worldwide applicable to the Personal Data in question, including, where applicable, European Data Protection Law and U.S. state data protection laws, including, but not limited to, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, together with all implementing regulations (the “CCPA”).”

Authorized Person(s)” means any person who Processes Personal Data on Vendor’s behalf, including Vendor’s and its Sub-processors’ employees, officers, partners, principals and contractors.

“Data Privacy Framework” or “DPF” means (as applicable) the EU-U.S. Data Privacy Framework, the U.K. Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs as operated by the U.S. Department of Commerce, and their respective successors.

“DPF Principles” means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time.

“European Data Protection Law” means all data protection and privacy laws and regulations of Europe, including, where applicable, (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR“); (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (“U.K. GDPR“); (iii) the U.K. Data Protection Act 2018; (iv) the Swiss Federal Act on Data Protection (“FADP”); and (v) any national data protection laws made under or pursuant to the GDPR.

“Personal Data” means any information Snowflake and/or its Affiliate provides to Vendor pursuant to the Agreement that relates to an identified or identifiable natural person (“data subject”) and information that is deemed personal data, personal information, or personally identifiable information under Applicable Privacy Laws.

“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.