Data Processing Agreement

Version 2026.10
Last updated 2026-10-01

This Data Processing Agreement (the "DPA"), published at https://feedwire.com/dpa, forms part of the Terms and Conditions between Feedwire and Customer published at https://feedwire.com/terms (the "Terms"), as Section 2.7 of the Terms provides. Customer enters into this DPA for itself and as agent for each of its Affiliates that is a controller of Customer Personal Data. Capitalized terms this DPA does not define, such as Affiliate, Customer Contract Manager, Data Retention Period, Declared Incident, Environment, Feedwire Personnel, Law, Operating Model, Post-Service Period, Proposal, Security Event, Services, and Third Party Provider, have the meanings the Terms give them.

1. Definitions

1.1 "Customer Data" means data that Feedwire or a Sub-processor Processes to provide the Services, whether it is in the Environment or Customer or its personnel give it to Feedwire. It includes Customer Personal Data and data that identifies no one. It is the "Customer data" to which Sections 6.5, 7.6, 7.8, 8.1, and 12.2 of the Terms refer.

1.2 "Customer Personal Data" means Customer Data that is personal data or personal information under Data Protection Laws.

1.3 "Customer Vendor" means a Third Party Provider for whose platform or service Customer is the contracting party or account owner, even when Feedwire purchases, resells, or administers it, such as Customer's own Microsoft 365, Google Workspace, or Apple Business Manager account. A Third Party Provider that Feedwire selects and contracts with to deliver the Services is a Sub-processor, not a Customer Vendor, even where Customer accepts its end user license agreement under Section 8.2 of the Terms.

1.4 "Data Protection Laws" means every Law that applies to the Processing of Customer Personal Data under this DPA, including:
(a) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations at Title 11, Division 6, of the California Code of Regulations (together, the "CCPA");
(b) other United States state privacy laws that set terms for processors or service providers;
(c) Regulation (EU) 2016/679 (the "EU GDPR");
(d) the EU GDPR as it forms part of the law of the United Kingdom (the "UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended, including by the Data (Use and Access) Act 2025; and
(e) any other data protection law the parties agree in writing applies.

1.5 "Data Subject" means an identified or identifiable individual to whom Customer Personal Data relates, including a "consumer" under the CCPA.

1.6 "EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) and Module Three (processor to processor).

1.7 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, including a breach of the security of the system as California Civil Code section 1798.82 defines it.

1.8 "Process" and "Processing" mean any operation performed on Customer Data, such as collection, recording, organization, storage, retrieval, use, disclosure, transfer, or deletion.

1.9 "Sub-processor" means a Third Party Provider that Feedwire selects and contracts with and that Processes Customer Data to deliver the Services. Customer Vendors are not Sub-processors. Feedwire Personnel who are individuals working under Feedwire's direction are not Sub-processors.

1.10 "Sub-Processors List" means the list of Sub-processors that Feedwire maintains and provides to Customer on request, by writing to support@feedwire.com or through Feedwire's trust center, which Feedwire may make subject to a nondisclosure agreement, as updated under Section 10.

1.11 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022, as amended.

1.12 "controller", "processor", "business", "service provider", "sell", and "share" have the meanings Data Protection Laws give them.

2. Roles, Scope, and Version

2.1 Roles. Customer is the controller of Customer Personal Data and, under the CCPA, the business. Feedwire is Customer's processor and, under the CCPA, its service provider. Where Customer is itself a processor for another controller, Feedwire is Customer's sub-processor, and Customer warrants that the controller has authorized Customer's instructions to Feedwire.

2.2 Other United States laws. Where another United States state privacy law applies, Feedwire acts as Customer's processor, or in the equivalent role that law defines, and this DPA supplies the contract terms that law requires.

2.3 Scope. This DPA applies to all Customer Data, except that Sections 4, 8, 9, 11, and 12 apply only to Customer Personal Data.

2.4 Version and updates. Feedwire maintains this DPA online at https://feedwire.com/dpa and may update it by posting a new version there. Feedwire gives notice of each update, with its effective date, on Customer's next invoice or by email, at least thirty (30) days before the update takes effect. An update applies from its effective date and does not reach back to earlier events. No update reduces the protection this DPA gives Customer Data, except as Law requires. If Customer objects, Customer may terminate the affected Services without penalty by written notice before the effective date. Continued use of the Services after the effective date is acceptance of the update.

2.5 Sub-Processors List. An update to the Sub-Processors List under Section 10, including an emergency replacement under Section 10.5, follows Section 10 and is not an update under Section 2.4.

3. Processing on Instructions

3.1 Documented instructions. Feedwire Processes Customer Data only on Customer's documented instructions, including for transfers under Section 9. Those instructions are this DPA, the Terms, the Proposals, the Operating Model, and requests that people Customer authorizes make through Feedwire's support channels, within the approvals the Operating Model requires.

3.2 Processing Law requires. If Law to which Feedwire is subject requires other Processing, Feedwire informs Customer of that requirement before the Processing, unless that Law forbids it.

3.3 Infringing instructions. Feedwire informs Customer immediately if, in Feedwire's opinion, an instruction infringes Data Protection Laws. Feedwire may decline to follow that instruction until Customer confirms or changes it.

3.4 Business purposes. Feedwire Processes Customer Personal Data only for these business purposes, which are the specific purposes for which Customer discloses it:
(a) help desk support for Customer's personnel;
(b) administration of identities, accounts, email, collaboration tools, devices, and networks;
(c) security monitoring, detection, containment, and response, including through the security operations centers Feedwire contracts;
(d) backup, restoration, and recovery;
(e) onboarding, changes, and offboarding of Customer's personnel;
(f) documentation and configuration management;
(g) license and equipment procurement;
(h) security awareness training and phishing simulation;
(i) compliance and audit support, including the governance, risk, and compliance platform on the Prepared plan;
(j) discovery and control of AI tools, as the Operating Model describes;
(k) documenting, billing, and communicating about the Services; and
(l) transition of the Services when they end.

3.5 Access to content. Feedwire opens email, files, and other content in Customer's systems only as a task requires.

3.6 Monitoring. Feedwire and its Sub-processors monitor devices, accounts, and networks only on Customer's instructions and for Customer's security. Feedwire does not use security data for its own purposes. A Sub-processor that provides a security service may use security data to detect threats and improve that service, only as its terms with Feedwire and Data Protection Laws permit.

3.7 AI providers. Feedwire uses AI providers to Process Customer Data only under business terms that do not permit the provider to train its models on Customer Data. The Sub-Processors List identifies each such provider.

4. CCPA Service Provider Terms

Where the CCPA applies, Feedwire:
(a) does not sell or share Customer Personal Data;
(b) Processes Customer Personal Data only for the business purposes in Section 3.4;
(c) does not retain, use, or disclose Customer Personal Data for any purpose other than those business purposes, except as the CCPA permits a service provider to do;
(d) does not retain, use, or disclose Customer Personal Data for any commercial purpose other than those business purposes;
(e) does not retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Feedwire;
(f) does not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits;
(g) complies with the CCPA's obligations for service providers, provides the level of privacy protection the CCPA requires of Customer, and maintains the security measures in Schedule 2;
(h) grants Customer the right to take reasonable and appropriate steps to ensure that Feedwire uses Customer Personal Data consistently with Customer's obligations under the CCPA, including the review and audit rights in Section 14, which Customer may exercise at least once every twelve (12) months;
(i) notifies Customer if it determines that it can no longer meet its obligations under the CCPA;
(j) grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data;
(k) acts on the consumer requests Customer informs it of under Section 11;
(l) cooperates with Customer's cybersecurity audits and risk assessments by making relevant information available and not misrepresenting any fact, as the CCPA requires; and
(m) engages Sub-processors only under Section 10, by written contract that binds them to the terms this Section requires.

5. Customer's Obligations

5.1 Notices and consents. Customer has, and maintains for as long as Feedwire Processes Customer Personal Data, every right, notice, and consent Feedwire needs to Process it under this DPA, including notice to Customer's personnel of the monitoring the Services involve.

5.2 Protected data. Customer identifies to Feedwire any data subject to special legal protection, as Section 4.4 of the Terms requires.

5.3 Lawful instructions. Customer's instructions to Feedwire comply with Data Protection Laws.

5.4 Customer's controls. Customer is responsible for the controls the Operating Model assigns to it, including storing its own passwords, and the credentials it uses for its own clients, in its own vault. Customer is responsible for its Customer Vendors.

6. Personnel and Confidentiality

Feedwire limits access to Customer Data to Feedwire Personnel who need it to provide the Services. Every member of Feedwire Personnel, including subcontracted technicians, is bound by confidentiality obligations at least as restrictive as Section 9 of the Terms.

7. Security

Feedwire implements and maintains the technical and organizational measures in Schedule 2, which are appropriate to the nature of the Processing and the risks it presents. Feedwire may change those measures only if the overall level of security does not decrease.

8. Personal Data Breach

8.1 Notice. Feedwire notifies Customer of a Personal Data Breach, or of unauthorized access to an information system Feedwire maintains for Customer that holds Customer Personal Data, without undue delay, and in any event within forty-eight (48) hours after Feedwire becomes aware of it. Feedwire becomes aware when Feedwire Personnel confirm the breach or have reasonable grounds to believe it has occurred, including through a notice from a Sub-processor. This duty applies whether or not Customer declares an incident.

8.2 Security Events. A Security Event in which no one gains unauthorized access to, or acquires, Customer Personal Data, and no Customer Personal Data is lost or altered, is not a Personal Data Breach. Feedwire handles Security Events, and reports suspected incidents to the Client Leadership Team, as the Operating Model describes.

8.3 Recipients. Feedwire sends breach notice to the Customer Contract Manager and to the emergency contacts Customer names in writing.

8.4 Content. The notice describes, as far as Feedwire then knows, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a Feedwire contact. Feedwire provides further information as it becomes available.

8.5 Customer's decisions. Customer decides whether to declare an incident, whether a Personal Data Breach requires notification, and whether and how to notify regulators, Data Subjects, and others. The Operating Model assigns the first two decisions to the Client Leadership Team and the notifications to the Client Legal Team. Feedwire does not notify regulators or Data Subjects about Customer Personal Data without Customer's instruction, unless Law requires it.

8.6 Assistance and charges. Feedwire assists Customer to investigate, contain, and remediate a Personal Data Breach, and to meet Customer's own notice obligations. Feedwire charges for this work as the Terms provide for Security Events and Declared Incidents: triage, containment, and basic handling are part of the Services where Customer's Proposal includes support, and recovery and rebuilding, support for forensic investigators, and extended response (together, "recovery work") are billed hourly at Feedwire's incident response rate. Where Feedwire's breach of this DPA or of Section 9 of the Terms caused the Personal Data Breach, Feedwire does not charge for that recovery work.

8.7 Sub-processors. Feedwire requires each Sub-processor to notify Feedwire without undue delay of a breach affecting Customer Data.

8.8 No admission. A notice under this Section 8 is not an admission of fault or liability.

9. International Transfers

9.1 Location. Feedwire is based in the United States and Processes Customer Data there. Sub-processors store Customer Data mainly in the United States. The Sub-Processors List states where each one stores it.

9.2 EU SCCs. Whenever Customer, or an Affiliate for which Customer acts, transfers Customer Personal Data subject to the EU GDPR to Feedwire, the parties enter into the EU SCCs, which this DPA incorporates by reference: Module Two where Customer is a controller, and Module Three where Customer is a processor. The parties make these elections:
(a) Clause 7 (docking clause) applies.
(b) Clause 9(a): Option 2, general written authorization, with at least thirty (30) days' notice under Section 10.4.
(c) Clause 11(a): the optional language does not apply.
(d) Clause 13: the competent supervisory authority is the one Clause 13(a) identifies for the data exporter.
(e) Clause 17: Option 1. The EU SCCs are governed by the law of Ireland.
(f) Clause 18: the courts of Ireland, without prejudice to a Data Subject's right to bring proceedings where the Data Subject habitually resides.
(g) Annex I.A and I.C are the Annex to this DPA. Annex I.B is Schedule 1. Annex II is Schedule 2. Annex III is the Sub-Processors List.

9.3 UK Addendum. Whenever Customer, or an Affiliate for which Customer acts, transfers Customer Personal Data subject to the UK GDPR to Feedwire, the parties enter into the UK Addendum, which this DPA incorporates by reference, completed as follows:
(a) Table 1: the parties, their details, and their contacts are as the Annex to this DPA states. The start date is the date this DPA first applies to Customer.
(b) Table 2: the Approved EU SCCs, with the modules and elections in Section 9.2.
(c) Table 3: Annex 1A is the Annex to this DPA; Annex 1B is Schedule 1; Annex II is Schedule 2; Annex III is the Sub-Processors List.
(d) Table 4: neither party may end the UK Addendum under its Section 19.
(e) The Mandatory Clauses of the UK Addendum apply. The UK Addendum is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction over disputes under it.

9.4 Customer as exporter. Customer, as data exporter, decides whether to transfer Customer Personal Data to Feedwire and is responsible for its own transfer risk assessment. On request, Feedwire provides the information Customer reasonably needs for that assessment, including the Sub-Processors List, Schedule 2, the locations where Customer Data is stored, and how Feedwire responds to requests from public authorities.

9.5 Requests from public authorities. If a public authority requests Customer Personal Data, Feedwire notifies Customer unless Law forbids it and discloses only what Law requires, as Section 9.2 of the Terms provides. For Customer Personal Data transferred under the EU SCCs or the UK Addendum, Feedwire also meets Clause 15 of the EU SCCs, including reviewing the legality of the request and challenging it where there are reasonable grounds to do so.

9.6 Onward transfers. Feedwire transfers Customer Personal Data subject to the EU GDPR or UK GDPR to a Sub-processor only where a safeguard that Data Protection Laws recognize applies, such as the Sub-processor's certification under the EU-U.S. Data Privacy Framework (and, for UK data, its UK Extension), its agreement to the EU SCCs (and, for UK data, the UK Addendum), or an adequacy decision for the country where it stores the data. Where no safeguard applies, Feedwire does not send that Sub-processor such data.

9.7 Data Privacy Framework. Feedwire is not certified under the EU-U.S. Data Privacy Framework or its UK Extension. If Feedwire certifies, it will say so in the Sub-Processors List, and Sections 9.2 and 9.3 continue to apply.

10. Sub-processors and Customer Vendors

10.1 Two kinds of Third Party Provider. Sub-processors are Third Party Providers that Feedwire selects and contracts with. Customer Vendors are Customer's own processors, under Customer's own contracts with them. The party that signs the vendor contract decides the kind, not where the data is stored.

10.2 Authorization. Customer authorizes Feedwire to engage the Sub-processors listed in the Sub-Processors List, and to engage new Sub-processors under this Section 10. Sub-processors exercise the access that Section 4.1(b) of the Terms grants Third Party Providers only as this DPA permits.

10.3 Due diligence and contracts. Before a Sub-processor Processes Customer Data, Feedwire reviews its security and data protection practices and binds it by written contract to the confidentiality, security, and data protection obligations that Data Protection Laws require of a sub-processor. For most Sub-processors, those obligations are in the vendor's standard data processing terms, which Feedwire reviews against this DPA before engagement. On request, Feedwire provides a copy or summary of the relevant terms, with commercial information removed.

10.4 Notice of new Sub-processors. Feedwire gives at least thirty (30) days' notice before a new Sub-processor Processes Customer Data. Feedwire gives notice on Customer's next invoice or by email, naming the new Sub-processor and the date it begins, and updates the Sub-Processors List and its version.

10.5 Emergency replacement. Where Feedwire must replace a Sub-processor urgently to protect the security or continuity of the Services, Feedwire may make the change at once and gives notice as soon as practicable. Customer's right to object applies from that notice.

10.6 Objection. Customer may object to a new Sub-processor by written notice within thirty (30) days after Feedwire's notice, on reasonable grounds relating to data protection. The parties then discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services by written notice, without penalty and without the notice period in Section 6.3 of the Terms, and Feedwire refunds fees paid in advance for the period after termination.

10.7 Feedwire's responsibility for Sub-processors. Feedwire answers to Customer for each Sub-processor's handling of Customer Data, including its confidentiality, security, use, and deletion, as for its own, subject to Section 15. That responsibility covers loss or exposure of Customer Data caused by a security failure, such as unauthorized access, unauthorized deletion, or a misconfiguration by Feedwire. It does not cover the availability or performance of a Sub-processor's service, such as an outage, a degraded service, a threat a security service does not detect, or a loss of Customer Data, including backups, caused by a failure of the Sub-processor's platform, such as a storage fault, data corruption, or a service outage. Section 8.1 of the Terms governs those failures.

10.8 Customer Vendors. Feedwire does not answer for Customer Vendors. An outage of Customer's own Google or Microsoft account is not a failure of Feedwire or of the Services. Feedwire answers only for its own administration of Customer Vendor accounts under the Services, subject to Section 15. When Feedwire accepts a vendor's terms on Customer's behalf under Section 8.2 of the Terms, those terms bind Customer and the vendor.

11. Data Subject Requests

11.1 Requests sent to Feedwire. If Feedwire receives a request from a Data Subject about Customer Personal Data, Feedwire forwards it to Customer without undue delay and does not respond except on Customer's instructions or as Law requires.

11.2 Requests Feedwire must act on. Customer informs Feedwire of each Data Subject or consumer request that requires Feedwire to act, and gives Feedwire the information it needs to do so.

11.3 Assistance. Feedwire assists Customer to respond to Data Subject requests and complaints with appropriate technical and organizational measures, such as account exports, mailbox and file searches, corrections, and deletions in the systems Feedwire administers. Where Customer gives reasonable notice, Feedwire acts in time for Customer to meet its legal deadline, or tells Customer promptly why it cannot. Section 13 governs copies in backups and security logs.

11.4 Charges. This assistance is support under Customer's Proposal.

12. Impact Assessments and Consultations

Feedwire provides reasonable assistance with Customer's data protection impact assessments, risk assessments, and consultations with regulators, where they concern the Services. This assistance is support under Customer's Proposal.

13. Return and Deletion

13.1 Customer's choice. During the Data Retention Period under Section 6.5 of the Terms, Customer, or its successor provider on Customer's behalf, chooses whether Feedwire returns Customer Data or deletes it. Feedwire returns Customer Data by export in standard formats. The first export is free of charge.

13.2 Deletion. If Customer chooses deletion, or makes no choice, Feedwire deletes Customer Data from its systems and those of its Sub-processors within thirty (30) days after the Data Retention Period ends, or after any extended storage Customer purchases ends, except as Sections 13.3 to 13.9 provide. Feedwire confirms deletion in writing on request. Customer Data in a Customer Vendor's platform belongs to Customer and remains there; Feedwire removes its own access as Section 6.5 of the Terms describes.

13.3 Customer's backups. Feedwire stores Customer's backups in Customer's own sub-organization of Feedwire's backup service and retains each backup for at least seven (7) years, unless Customer instructs otherwise. Single records cannot be removed from a backup, so a backup is retained or deleted as a whole. At the end of the Services, Feedwire deletes Customer's sub-organization as a whole, or migrates it to Customer or its successor provider, as Customer or its successor provider decides under Section 13.1. If neither decides, Feedwire deletes it under Section 13.2. Storage after the Data Retention Period is extended storage under Section 6.5 of the Terms.

13.4 Feedwire's own backups. Feedwire's backups of its own systems, such as its ticketing, documentation, and email systems, contain records about many customers and cannot be divided by customer. Copies of Customer Data in those backups are retained beyond use until the backups expire under Feedwire's retention schedule, which retains them for at least seven (7) years. Until then, Feedwire stores them encrypted and separate from production, and does not access or use them. Feedwire restores Customer Data from those backups only on Customer's written request. If Feedwire restores one of those backups for another reason, such as recovering its own systems, it does not use the restored Customer Data and deletes it again promptly.

13.5 Configuration documentation. Unless Customer chooses deletion, Feedwire maintains Customer's configuration documentation during the Post-Service Period, even where Customer makes no choice, and deletes it when that period ends.

13.6 Service records. Feedwire retains its records of the Services it performed for Customer, such as tickets, support communications, recordings and notes of calls and meetings, contracts, and billing records, for as long as it needs them to resolve questions or disputes and to meet legal requirements, as Feedwire's Privacy Policy describes, and then deletes them. Feedwire uses them only for those purposes after the Services end.

13.7 Retention Law requires, and legal holds. Feedwire may retain Customer Data that Law requires it to retain, only for that purpose and only for as long as Law requires. Feedwire does not delete Customer Data while a legal hold that Customer has notified to Feedwire in writing is in effect. During the hold, Feedwire stores the data under this DPA, and the storage is billed as extended storage under Section 6.5 of the Terms.

13.8 Security logs. Security logs and telemetry are retained for the period the Operating Model states or, where it states none, for the period the security service that records them retains them, and are then deleted. Access to them is restricted. Because their integrity matters for security and incident response, Feedwire does not alter or delete individual entries before then, including on a Data Subject's request.

13.9 Deletion for non-payment. Where Section 7.8 of the Terms applies, Feedwire deletes Customer Data on the date that Section sets, only after the written notice it requires and subject to any legal hold under Section 13.7, and completes deletion across its Sub-processors within thirty (30) days. Customer's backups are deleted as a whole with the rest of Customer Data, and copies in Feedwire's own backups are handled under Section 13.4.

13.10 Continuing protection. Customer Data that Feedwire retains under this Section 13 remains protected under this DPA for as long as Feedwire retains it.

14. Information and Audits

14.1 Documentation first. Once in any twelve (12) month period, on request and free of charge, Feedwire provides the information reasonably needed to demonstrate compliance with this DPA, including through its trust center: a completed security questionnaire, Feedwire's CIS Controls Implementation Group 2 self-assessment, its GTIA Trustmark once awarded, and the reports Sub-processors make available to Feedwire for sharing.

14.2 Audits. Customer, or an independent auditor bound by confidentiality and not a competitor of Feedwire, may audit Feedwire's compliance with this DPA:
(a) once in any twelve (12) month period, where the documentation in Section 14.1 does not reasonably answer a specific question;
(b) where a regulator requires it; or
(c) after a Personal Data Breach.

14.3 Conduct. Customer gives at least thirty (30) days' written notice of an audit, except after a Personal Data Breach or where a regulator requires less. The parties agree the scope, timing, and duration in advance. Audits take place during business hours and do not disrupt Feedwire's operations or compromise the security of other customers' data. Audit results are Feedwire's Confidential Information, which Customer may share with its regulators and professional advisers.

14.4 Cost. Customer bears its own audit costs. Feedwire's time on audits beyond Section 14.1 is billed at Feedwire's then-current hourly rates.

14.5 Cybersecurity audits. Feedwire cooperates with a cybersecurity audit or risk assessment that Customer conducts under Data Protection Laws, by making available the information in its possession that the auditor reasonably needs. Feedwire's time beyond Section 14.1 is billed under Section 14.4. Feedwire is not Customer's auditor and does not perform Customer's cybersecurity audit.

15. Liability

15.1 Limits between the parties. Each party's liability arising out of or related to this DPA is subject, between the parties, to Section 12 of the Terms, including the limit in Section 12.3, unless a Proposal signed by both parties expressly sets a different limit for claims under this DPA. As Section 12.2 of the Terms states, it does not exclude Feedwire's liability for loss, corruption, or unauthorized disclosure of Customer Data caused by Feedwire's breach of this DPA or of Section 9 of the Terms, including through a Sub-processor for which Feedwire answers under Section 10.7.

15.2 Data Subjects' rights. Nothing in the Terms or this DPA limits any right of a Data Subject under the EU SCCs, the UK Addendum, or Data Protection Laws, or any liability that Data Protection Laws do not permit to be limited.

15.3 Customer's indemnity. Customer indemnifies Feedwire against third-party claims, losses, and expenses arising from Customer's breach of this DPA or of Data Protection Laws.

16. Governing Law and Disputes

16.1 United States data and everything else. This DPA is governed by the law of the State of California, and disputes under it are resolved as Sections 17.12 and 17.13 of the Terms provide, except as this Section 16 states.

16.2 UK data. As it applies to Processing subject to the UK GDPR, this DPA is governed by the law of England and Wales.

16.3 EU data. As it applies to Processing subject to the EU GDPR, this DPA is governed by the law of Ireland.

16.4 Transfer clause and Data Subject claims. Claims under the UK Addendum are resolved in the courts of England and Wales, and claims under the EU SCCs in the courts of Ireland. A Data Subject may bring a claim in any court that the EU SCCs, the UK Addendum, or Data Protection Laws make available, including where the Data Subject habitually resides. Section 17.8 of the Terms, the six-month claims period in Section 17.12 of the Terms, and Section 17.13 of the Terms do not apply to these claims and do not limit any Data Subject's rights.

16.5 Other claims. Every other claim under this DPA, including a claim about Customer Personal Data subject to the UK GDPR or EU GDPR that does not arise under the UK Addendum or the EU SCCs, is resolved by arbitration under Section 17.13 of the Terms, applying the law that Sections 16.1 to 16.3 select.

17. Order of Precedence

17.1 Personal data. For the Processing of Customer Personal Data, this order applies in a conflict:
(a) the EU SCCs and the UK Addendum, where they apply, with the UK Addendum prevailing as its own terms provide;
(b) this DPA;
(c) the Terms and the Proposals, in the order Section 17.6 of the Terms sets; and
(d) the Operating Model.

17.2 Proposals. A Proposal signed by both parties may change a specific section of this DPA for that Customer only if it expressly says so. No Proposal changes the EU SCCs or the UK Addendum.

17.3 Other matters. On all other matters, including fees, payment, and the scope of the Services, the Terms prevail.

18. General

18.1 Duration. This DPA applies for as long as Feedwire or a Sub-processor Processes Customer Data, including in backups and the records Section 13 permits Feedwire to retain.

18.2 Notices. Notices under this DPA are given as Section 17.4 of the Terms provides, except that breach notices are given under Section 8 and Sub-processor notices under Section 10.4.

18.3 Severability. If a court finds any provision of this DPA invalid or unenforceable, the rest remains in force, and the provision applies as closely to the parties' intent as Law permits.

Schedule 1: Details of Processing

Subject matter. The Services under the Terms and Customer's Proposals.

Duration. The Term, and then until deletion under Section 13, including the expiry of backups.

Nature of the Processing. Continuous administration, monitoring, storage, backup, restoration, retrieval, configuration, support, transfer, and deletion of Customer Data, with full administrative access to the systems the Services cover.

Purposes. The business purposes in Section 3.4.

Categories of Data Subjects.

  • Customer's employees, contractors, interns, and former personnel.
  • Customer's own clients, customers, and correspondents whose data is stored in Customer's systems.
  • For media and entertainment customers, talent, crew, and production contacts.
  • Customer's job applicants.
  • Visitors to Customer's premises, where Customer's access control or camera systems record them.
  • Any other individual whose data is stored in Customer's systems.

Categories of Customer Personal Data.

  • Identity and directory data: names, usernames, email addresses, phone numbers, job titles, departments, managers, group memberships, and photographs.
  • Authentication and access data: sign-in records, multifactor authentication registrations, permissions, and administrative activity.
  • Content: email, calendars, chats, and files stored in systems Feedwire administers.
  • Device data: inventory, serial numbers, installed software, configuration, health, and the users assigned to each device.
  • Security data: endpoint and identity telemetry, such as processes, file activity, network connections, IP addresses, DNS queries, and browsing session data.
  • Network data: device configurations, traffic metadata, and connected devices.
  • Backups: copies of files, mail, and systems.
  • Service records: tickets, support communications, call recordings, transcripts, and AI meeting notes.
  • Training data: security awareness training and phishing simulation results.
  • AI governance data: the AI tools in use and their users.
  • Billing data: the people counted for per-person fees, and billing contacts.

Special category and sensitive data. Customer's systems may contain special category data under the EU GDPR and UK GDPR, such as health information in HR files or sick notes, and data revealing racial or ethnic origin, religious beliefs, trade union membership, or sexual orientation. They may also contain criminal offence data, such as background checks, and sensitive personal information under the CCPA, such as government identification numbers, financial account details, and account credentials. Feedwire does not seek out or analyze this data. Feedwire Processes it only as part of administering the systems that store it. Safeguards: the measures in Schedule 2, access limited to people who need it, Feedwire activity logged under each person's name, and no use outside the purposes in Section 3.4.

Frequency of transfer. Continuous.

Retention. As Section 13 provides.

Transfers to Sub-processors. For the subject matter, nature, and duration above, to the Sub-processors in the Sub-Processors List.

Schedule 2: Technical and Organizational Security Measures

Framework. Feedwire follows the CIS Critical Security Controls and operates at Implementation Group 2.

Identity and access.

  • Every Feedwire account is a named account and requires multifactor authentication.
  • Feedwire's accounts sign in through Feedwire's identity provider wherever the vendor supports it; otherwise the vendor's own sign-in requires multifactor authentication. The Sub-Processors List shows which applies to each vendor console.
  • Administrative elevation requires multifactor authentication again.
  • Feedwire stores its credentials to Customer systems in Feedwire's password vault, which requires multifactor authentication.
  • Feedwire does not store Customer's own passwords, and never sees or changes the credentials Customer uses for its own clients. When a person leaves Customer, Feedwire removes that person's access to Customer's own accounts, including Customer's vaults.
  • Access follows least privilege and need to know, is reviewed every year, and is removed when a person leaves or no longer needs it.

Logging. Feedwire logs its activity, such as delegated access and credential use, under each person's name, and produces reports from those logs on Customer's request. Customer does not have standing access to Feedwire's logs.

Separation between customers. In the tools that store data from Customer's systems, such as device management, security, backup, and network tools, each customer has its own sub-organization or dedicated subtenant. Feedwire's own business tools, such as its ticketing, documentation, and credential tools, serve all customers, organize records by customer, and restrict access to Feedwire Personnel. The Sub-Processors List shows which arrangement applies to each tool.

Endpoint security and monitoring. Feedwire's devices are protected by endpoint detection and response, monitored around the clock by a security operations center.

Encryption. Customer Data is encrypted in transit and at rest in Feedwire's systems and backups.

Backups. Feedwire's own data is backed up with an encrypted offsite backup service, stored separately from production, and retained for at least seven (7) years. Feedwire tests that the backups it maintains can be restored.

Incident response. Feedwire maintains an incident response plan, escalates detections from its security operations centers, and notifies Customer under Section 8.

AI. Feedwire's AI accounts are business accounts owned by Feedwire, with training on Feedwire's data turned off.

Vendors. Feedwire reviews each Sub-processor before engagement and binds it by contract under Section 10.

Personnel. Every member of Feedwire Personnel is bound by confidentiality obligations under Section 6.

Annex: Parties and Supervisory Authority

Data exporter. Customer, and each Affiliate for which Customer acts, as named in Customer's Proposal. Address and contact: as stated in the Proposal. Role: controller, or processor where Section 2.1 applies. Activities: receiving the Services. Signature and date: by accepting the Terms or this version of the DPA.

Data importer. Feedwire, 8605 Santa Monica Blvd 15005, West Hollywood, CA 90069, United States. Contact: support@feedwire.com, +1-310-984-6946. Role: processor, or sub-processor where Section 2.1 applies. Activities: providing the Services. Signature and date: by accepting the Terms or this version of the DPA.

Competent supervisory authority. For the EU SCCs, the authority Clause 13(a) identifies. For the UK Addendum, the Information Commissioner.