This Data Processing Addendum (“顿笔础”) supplements the Pure End User Agreement, available at /legal/pure-end-user-agreement.html, as updated from time to time between End User and Pure, or other agreement between End User and Pure governing End User’s use of the Services (the “/legal/pure-end-user-agreement.html”). This DPA is entered into by and between you and the entity you represent (“you”, or “End User”) and 色控传媒. (“Pure”) and is effective as of the date of order acceptance for the Product requiring this DPA.?
1. PROCESSING OF PERSONAL DATA. End User will make End User Personal Data available to Pure for the limited and specified purpose of providing the applicable Product purchase. A list of categories of Data Subjects, types of End User Personal Data, and Processing activities to be provided by Pure is set out in a Details of Processing Addendum, attached below as Exhibit 1. The duration of the Processing is the duration in which Pure is providing the Product according to the applicable Order. The subject matter and the purpose of the Processing is as described herein.??
1.1 Pure as Processor. Pure acknowledges and agrees that: (a) with regard to the Processing of End Personal Data, Pure is acting as a Processor; (b) Pure understands the obligations and restrictions imposed on it by applicable Data Protection Laws in its role as a Processor; (c) Pure will comply with all such obligations, including providing the same level of privacy protection as required by applicable Data Protection Laws; and (d) will notify End User if Pure determines it can no longer meet its obligations under applicable Data Protection Laws or this DPA.?
1.2 Processing of End User Personal Data. Pure will only Process End User Personal Data on behalf of End User (a) to the extent, and in such a manner, as is necessary for the purposes of fulfilling its obligations under the Agreement; and (b) in accordance with the terms of the Agreement and this DPA, which together constitute End User’s instructions. The restrictions set forth in this section shall not restrict Pure’s ability to Process End User Personal Data where required to do so by applicable laws to which Pure is subject; provided, however, Pure shall promptly notify End User of such legal requirement before Processing, unless such law prohibits such notification. Pure will promptly inform End User if, in Pure’s opinion, a Processing instruction violates applicable Data Protection Laws. Without limiting Pure’s obligations herein, Pure will not: (i) retain, use, or disclose End User Personal Data for any purpose other than to perform its obligations under the Agreement; (ii) “sell” or “share” (as those terms are defined by applicable Data Protection Laws) End User Personal Data; or (iii) combine End User Personal Data with Personal Data Pure receives from or on behalf of another person or entity or collects from its own interactions with a Data Subject except to perform a business purpose as defined in regulations adopted pursuant to Cal. Civ. Code 1798.185(a)(10).?
1.3 Deidentified Information. If Pure receives Deidentified Information from End User, or creates Deidentified Information at Customers instruction, Pure will (a) take reasonable measures to ensure the Deidentified Information cannot be associated with a Data Subject or household, (b) publicly commit to maintain and use the Deidentified Information in deidentified form, and (c) not attempt to reidentify the Deidentified Information except for the sole purpose of determining whether the Pure’s deidentification processes satisfy the requirements of applicable Data Protection Laws.
2. Pure Personnel. Pure will take reasonable steps to ensure that access to End User Personal Data is limited to those of its Affiliates, employees, agents, and subcontractors who (a) have a need to know or otherwise access End User Personal Data to enable Pure to perform its obligations under the Agreement and this DPA, and (b) who are bound in writing by confidentiality obligations sufficient to protect the confidentiality of End User Personal Data in accordance with the terms of this DPA.?
3. Security. Pure will implement and maintain appropriate technical and organizational safeguards to protect End User Personal Data that are no less rigorous than accepted industry standards for information security and will ensure that such safeguards comply with applicable Data Protection Laws. Such safeguards are further specified in a Description of Technical and Organizational Security Measures entered into between the parties. In assessing the appropriate level of security, Pure will take into account the risks that are presented by Processing, in particular from accidental, unauthorized, or unlawful destruction, loss, alteration, damage, disclosure of, or access to End User Personal Data transmitted, stored, or otherwise Processed.?
4. Personal Data Breach. In the event of a Personal Data Breach impacting End User Personal Data, Pure will (a) notify End User without undue delay after Pure or any Subprocessor becomes aware of such Personal Data Breach; (b) provide End User with sufficient details of the Personal Data Breach to allow End User to meet any obligations under Data Protection Laws to report or inform Data Subjects or relevant Regulators of the Personal Data Breach; and (c) cooperate, and require any Subprocessor to cooperate, with End User in the investigation, mitigation, and remediation of any such Personal Data Breach.?
5. Subprocessors. Pure will not engage any Subprocessor without notifying End User. End User may object to the use of such Subprocessor within 30 days of Pure’s notification on the basis that subprocessor does not offer sufficient guarantees to meet the requirements under applicable Data Protection Laws. Any such objection will be in writing and include End User’s specific reasons for its objection and options to mitigate, if any. Notwithstanding the foregoing, End User hereby authorizes those Subprocessors listed in a Pure’s Annex 1 to the Standard Contractual Clauses, attached as Exhibit 3.?
5.1 Authorized Subprocessors. With respect to any authorized Subprocessor, Pure will: (a) enter into a written agreement with each Subprocessor containing the substantially similar but no less protective data protection obligations imposed on Pure under this DPA and applicable Data Protection Laws with respect to End User Personal Data; and (b) remain liable to End User for the performance of its Subprocessors’ obligations.?
6. Data Subject Rights. Where the data subject provides information to identify End User, Pure will notify End User if it receives a request from a Data Subject regarding End User Personal Data, including a request by a Data Subject to exercise a right under Data Protection Laws. Otherwise, Pure will ask Data Subject to redirect its request to the End User and End User shall be responsible for the handling of such requests with the reasonable assistance of Pure.
7. Deletion or Return of End User Personal Data. At any time during the term of the Agreement at End User’s request, or upon the termination or expiration of the Agreement for any reason, Pure will, and will instruct all Subprocessors to, promptly or in any event within sixty (60) calendar days of the effective date of termination] (a) return to End User all copies of End User Personal Data in its possession, or the possession of such Subprocessor, or (b) delete and procure the deletion of all other copies of End User Personal Data Processed by Pure or any Subprocessor. Pure will comply with all reasonable directions provided by End User with respect to the return or deletion of End User Personal Data. Notwithstanding the foregoing, Pure may retain End User Personal Data if required by applicable Data Protection Laws.?
8. Compliance and Audits. Upon End User’s request, Pure will provide such assistance as End User reasonably requires in ensuring compliance with End User’s obligations under applicable Data Protection laws, including but not limited to data protection impact assessments and prior consultations with a Regulator where required. In addition to any audit rights End User may have under the Agreement, Pure will make available to End User all information necessary to demonstrate Pure’s compliance with this DPA, as well as any applicable Data Protection Laws, and will allow for and contribute to audits, including inspections, by End User, or a third-party auditor mandated by End User, in order to assess Pure’s compliance. Pure will cooperate with such audits or assessments to the extent required by the applicable Data Protection Laws and not more than annually unless required by law.?
9. International Data Transfers from EEA. If the Processing (including storage) of End User Personal Data involves the transfer of End User Personal Data from the European Economic Area (“EEA”) to a jurisdiction outside of the EEA where the transfer would be prohibited by Data Protection Laws in the absence of standard contractual clauses or another adequate transfer mechanism as approved by the European Commission, the parties agree that such transfer(s) will be carried out in accordance with and subject to the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council annexed to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”) as set out in Exhibit 3 attached to this DPA. To the extent there is any conflict between this DPA and the EU SCCs, the terms of the EU SCCs will prevail.?
9.1 International Data Transfers from the UK. If the Processing (including storage) of End User Personal Data involves the transfer of End User Personal Data from the United Kingdom (“UK”) to a jurisdiction outside of the UK where the transfer would be prohibited by Data Protection Laws in the absence of standard contractual clauses or another adequate transfer mechanism as approved by the UK Information Commissioners Office (“ICO”), the Parties agree that such transfer(s) will be carried out in accordance with and subject to the International Data Transfer Agreement A1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022 (“UK IDTA”) as set out in the UK International Data Transfer Agreement, attached as Exhibit 4. To the extent there is any conflict between this DPA and the UK IDTA, the terms of the UK IDTA will prevail.
9.2 International Data Transfers from Switzerland. If the Processing (including storage) of End User Personal Data involves the transfer of End User Personal Data from Switzerland to a jurisdiction outside of Switzerland where the transfer would be prohibited by Data Protection Laws in the absence of standard contractual clauses or another adequate transfer mechanism as approved by the Swiss Federal Data Protection and Information Commissioner (“FDPIC”), the parties agree that such transfer(s) will be carried out in accordance with and subject to the EU SCCs as amended by the DPA to the EU SCCs, attached as Exhibit 5.??
9.3 International Data Transfers from Other Jurisdictions. Insofar as the Agreement involves the transfer of End User Personal Data from any other jurisdiction where applicable Data Protection Laws requires that additional steps, or safeguards, be imposed before the data can be transferred to a second jurisdiction, Pure agrees to cooperate with End User to take appropriate steps to comply with applicable Data Protection Laws.
10. Business Contact Information. The parties anticipate they will need to exchange business contact information to facilitate a normal and customary business relationship (e.g., communication, invoicing, etc.). Business contact information may include Personal Data, such as name, business function, and contact information, for the parties’ respective personnel (“Party Personnel”). The parties acknowledge and agree that they independently control the purpose and means of Processing Personal Data relating to Party Personnel, and, as such, each party is solely responsible for how it uses, collects, protects, and shares Personal Data about Party Personnel received from the other party. The parties further acknowledge that the sharing of Personal Data about Party Personnel is incidental to the Agreement and does not form a part of the consideration provided by either party to fulfill its contractual obligations under the Agreement. Each party will, to the extent required by applicable Data Protection Laws, be responsible for notifying the Party Personnel about whom it receives Personal Data of its privacy practices and obtaining any required consents. The parties agree that if Personal Data about Party Personnel will be transmitted across national borders they will, to the extent required by law, enter into a separate cross-border transfer agreement to facilitate the transfer of Personal Data from a controller to a controller.?
11. Changes in Data Protection Laws. If any variation is required to this DPA as a result of a change in or subsequently applicable Data Protection Laws, the parties agree to discuss and negotiate in good faith any variations to this DPA necessary to address such changes, with a view to agreeing and implementing those or alternative variations as soon as practicable.
12. Standard Contractual Clauses and Annex to Standard Contractual Clauses. This DPA includes the Standard Contractual Clauses and the Annex to the Standard Contractual Clauses.?
13. Definitions. For purposes of this DPA, the following terms will have the meanings set forth below. Capitalized terms used but not otherwise defined herein have the meaning given to them in the Agreement.?
13.1 Affiliate: an entity that owns or controls, is owned or controlled by, or is under common control or ownership with, either Company or Service Provider respectively. “Control,” for purposes of this definition, means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.?
13.2 Data Protection Laws: laws, rules and regulations related to privacy, security, data protection, and/or the Processing of Personal Data, in any relevant jurisdiction discussed in the Agreement, each as amended, replaced or superseded from time to time.?
13.3 Data Subject: the identified or identifiable natural person to whom Personal Data relates.??
13.4 Deidentified Information: information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Data Subject.
13.5 Description of Technical and Organizational Security Measures: description of the technical and organizational safeguards to protect End User Personal Data that are no less rigorous than accepted industry standards for information security and comply with applicable Data Protection Law.?
13.6 End User Personal Data: any Personal Data received by Pure or a Subprocessor on behalf of End User in connection with the Agreement, or any Personal Data created or otherwise Processed by Pure or Subprocessor pursuant to the Agreement.
13.7 Personal Data: (a) information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household; and (b) any information defined as “personal data”, “personal information,” or other similar terms under applicable Data Protection Laws.?
13.8 Personal Data Breach:?the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, End User Personal Data transmitted, stored or otherwise Processed by Pure or any Subprocessor.
13.9 Processing: any operation or set of operations that is performed upon Personal Data,? such as access, storage, use, or reading. The terms “Process”, “Processes” and “Processed” will be construed accordingly.?
13.10 Processor: any person or entity which Processes End User Personal Data, including as applicable any “service provider” or “contractor” as those terms are defined by applicable Data Protection Laws.?
13.11 Regulator: any independent public authority, government agency, and any similar regulatory authority responsible for the enforcement of Data Protection Laws.?
13.12 Subprocessor: any other Processor who may Process Company Personal Data.
14. General Terms. This DPA supplements the Agreement (or other written agreement covering the same subject matter executed by Pure) for the applicable hardware Product purchased by End User. Capitalized terms not specifically defined in this DPA have the same meaning as in the Agreement. Pure reserves the right to update this DPA from time to time, as noted by the “Last Updated” date below.?
![Lightning bolt icon](/content/dam/purestorage/online-assets/icons/lightning.svg.imgo.svg"/){kind=icon}