Data Processing Addendum
This Data Processing Addendum (“DPA”) is incorporated into, and forms part of, the Framework Agreement, Quote, Purchase Order, Statement of Work, and/ or other contractual documents (individually and collectively, the “Agreement”) between Infoblox Inc. (“Infoblox”) and the Customer (“Customer”).
1. Scope, Order of Precedence, and Term
(a) This DPA applies when Personal Data is processed in connection with the Services.
(b) In the event of a conflict between this DPA and the Agreement, the DPA will control to the extent necessary to resolve the conflict. In the event the parties use an International Data Transfer Mechanism and there is a conflict between the Transfer Mechanism and this DPA, the Transfer Mechanism will control.
(c) The effective date of this DPA is the date of the Agreement, or the date that Customer first begins using Infoblox Products or Services, whichever is earlier. This DPA is coterminous with the Agreement, except for obligations that survive past termination as specified below.
In this DPA, the following terms have the meanings set forth below. In the event of a conflict between the definitions in this DPA and any applicable Data Protection Law, the definition provided by the Law in question will control. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.
“Affiliate” means (i) for Customer, any entity that directly or indirectly Controls, is Controlled by, or is under common Control with Customer and (ii) for Infoblox, any entity that is Controlled by Infoblox Inc.
“Control” means ownership of, or the power to vote, more than fifty percent (50%) of the outstanding shares of any class of voting security, control in any manner over the election of a majority of the directors, or of individuals exercising similar functions, or the power to exercise a controlling influence over the management of another entity.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing Personal Data.
“Customer” means the individual or entity that has entered into the Agreement with Infoblox and one that has agreed to incorporating this DPA into the Agreement.
“Customer Data” means any data, file attachments, text, images, reports, personal information, or other content that is uploaded or submitted to an online Service by Customer or Users and is Processed by Infoblox on behalf of Customer.
“Data Protection Laws” means any and all data protection and privacy laws applicable to the processing of Personal Data under the Agreement.
“Data Subject” means a living, natural person who is or can be identified directly or indirectly by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“EU Data Protection Law” means all data protection laws and regulations applicable to Europe, including (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (the “GDPR“); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (iii) applicable national implementations of (i) and (ii); and (iii) in respect of the United Kingdom (“UK“) any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the UK leaving the European Union).
“Infoblox Personnel” means any individual authorized by Infoblox to Process Customer Data.
“Parties” or “Party” means Customer and/or Infoblox as applicable.
“Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’) or household; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not it is performed via automatic means such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, obfuscation, or destruction.
“Processor” means a natural or legal person, public authority, agency or other body that processes Personal Data on behalf of a Controller.
“Professional Service” means consulting, implementation, or training services for Products and Services as described in a Purchase Order or Statement of Work.
“Security Breach” means any accidental, unauthorized, or unlawful breach of security that leads to the destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed or otherwise controlled by Infoblox.
“Security Incident” means a security event that does not lead to the destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed or otherwise controlled by Infoblox.
“SCCs” means the Standard Contractual Clauses approved by the European Commission or Swiss Federal Data Protection Authority (as applicable).
“Services” means the Support and Maintenance Services, Professional Services, Software as a Service, and any other online service or application provided or controlled by Infoblox and made available for Customer’s use online and specified in an applicable Purchase Order.
“Software as a Service (SAAS)” means a method of software delivery and licensing in which software is accessed online via a subscription, rather than bought and installed on individual computers. subscription services that can be accessed online or through a product interface, including Infoblox’s Cloud Services Platform (including software made available through Infoblox’s Cloud Services Platform), software-as-a-service offerings, network services, data feeds, or any other offering and any related applications, content, technology, or information, made available by Infoblox online and provided under an Order.
“Subprocessor” means any individual or entity (including any third party but excluding Infoblox) appointed by or on behalf of Infoblox to process Personal Data pursuant to the Agreement.
“Supervisory Authority” means an independent public authority which is established by a Member State pursuant to Article 51 of the GDPR.
“Support and Maintenance Services” means the Product or Service maintenance and technical support services provided by Infoblox under an Agreement or Purchase Order as described at https://www.infoblox.com/company/legal/terms-premium-maintenance/.
“Technical and Organizational Measures” or “TOMs” means the functions, processes, controls, systems, procedures, and measures that Infoblox implements to promote secure processing and storage of Personal Data, address and prevent data breaches, and facilitate compliance with relevant Data Protection Laws. See Annex II.
“User” means any individual authorized or invited by Customer or another User to access and use the Services under the terms of the Agreement.
3. Roles and Responsibilities
(a) Role of the Parties. Annex I lists the parties’ statuses as Controller, Joint Controller, Processor, or Subprocessor under relevant Data Protection Laws for each processing activity. The parties agree and understand that Section 3 will apply to them according to their role as indicated in Annex I.
(i) Controller is responsible for the accuracy of Customer Data and the legality of the means by which it acquires Customer data.
(ii) Controller’s instructions to process Customer Data will comply with all applicable Data Protection Laws and be duly authorized, with all necessary rights, permissions, and authorizations secured.
(i) Processor, and any person who is authorized by it, will process Customer Data only: (a) as instructed by Customer or as initiated by Users via a Service; (b) only to the extent necessary to provide Services or to prevent or address technical issues with a Service; (c) to prevent or address violations of the Agreement or this DPA; (d) to comply with Customer’s instructions to the extent they are consistent with the terms of the Agreement and applicable law; (e) to comply with appropriate obligations of confidentiality; and/ or (f) in accordance with the rights and duties attached to the Customer Data.
(ii) Processor will not disclose Customer Data to a third party for monetary or other consideration except as otherwise permitted under this DPA or the Agreement.
(d) Customer Responsibilities. Customer shall:
(i) be responsible for its secure use of the Services (including account authentication and configuration, securing data when in transit to and from the Services, and any appropriate backup and encryption steps);
(ii) implement appropriate TOMs relating to its use of the Services in a manner which enables Customer to comply with applicable laws and regulations and maintain appropriate security, protection, deletion and backup of Personal Data; and
(iii) control the type and substance of Customer Data, set User permissions to access Customer Data, and be responsible for reviewing and evaluating whether the documented functionality of the Services meets Customer’s required security and privacy obligations.
(i) Use of Subprocessors. Customer hereby permits Infoblox to engage Subprocessors to process Customer Data and approves of the Supplier Affiliates and third parties listed in Annex III as Subprocessors. Customer shall treat such list as strictly confidential and proprietary information of Infoblox.
(ii) Such Subprocessors will treat all Customer Data as confidential and will be permitted to access Customer Data only to deliver the services that Infoblox has retained them to provide in connection with the services, and they are prohibited from using Customer Data for any other purpose.
(iii) Infoblox will: (a) enter into a written agreement with each Subprocessor containing data protection obligations that provide at least the same level of protection for Customer Data as those in this DPA, to the extent applicable to the nature of the services provided by such Subprocessor; (b) Restrict the Subprocessor’s access to Customer Data only to what is necessary to maintain or provide the services to Customer; and (c) remain responsible for such Subprocessor’s compliance with the obligations of this DPA and for any acts or omissions of such Subprocessor that cause Infoblox to breach any of its obligations under this DPA.
(b) Liability for Subprocessors. Each party will be liable for the acts and omissions of its Subprocessors to the same extent it would be liable if performing the services of the Subprocessor directly under the DPA.
(c) Objection to Subprocessors. Customer agrees to register and subscribe to https://support.infoblox.com/s/article/InfobloxSubprocessors to be notified of any new or updated Subprocessor, including details of the Processing to be undertaken by the Subprocessor.
(i) In the event that Customer reasonably objects to a Subprocessor and notifies Infoblox in writing, Infoblox will notify Customer of any available alternatives to change the Services or receive the Services from an alternate Subprocessor, together with any applicable charges or changes to terms, but only to the extent that qualified alternatives are available.
(ii) If an alternative Subprocessor that is acceptable to Customer is not available within a reasonable time, then Customer may terminate the Services which cannot be provided by Infoblox without the objectionable Subprocessor; provided that Customer shall not receive a refund of any prepaid fees for such Services due to the termination. Infoblox will work with Customer in good faith to make available a change in the provision of the Services which avoids the use of that proposed Subprocessor.
5. Data Subject Rights
(a) Data Subject Rights. As part of the Services, Infoblox may provide Customer with a number of self-service features that Customer may use to retrieve, correct, delete or restrict the use of Customer Data, which Customer may use to assist it in connection with its obligations under Data Protection Laws with respect to responding to requests from Data Subjects via Customer’s account. In addition, Infoblox will, taking into account the nature of the processing, provide reasonable assistance to Customer to the extent possible to enable Customer to comply with its data protection obligations with respect to Data Subject rights under Data Protection Laws.
(b) If Customer does not have access to such Personal Data through its use of the Services to respond to such request, Infoblox will provide Customer with commercially reasonable cooperation and assistance in relation to responding to a Data Subject’s request for access to that individual’s Personal Data to the extent legally permitted. Customer will be responsible for any costs arising from Infoblox’s provision of such assistance.
(c) In the event that any such request is made to Infoblox directly, Infoblox will not respond to such communication except as necessary (for example, to direct the Data Subject to contact Customer or if legally required) without Customer’s prior authorization. If Infoblox is required to respond to such a request, Infoblox will promptly notify Customer and provide Customer with a copy of the request unless Infoblox is legally prohibited from doing so. For the avoidance of doubt, nothing in the Agreement (including this DPA) will restrict or prevent Infoblox from responding to any Data Subject or Supervisory Authority requests in relation to Personal Data for which Infoblox is a Controller.
(a) Data Protection Impact Assessment. To the extent required under applicable Data Protection Laws, and under strict confidentiality, Infoblox will (taking into account the nature of the processing and the information available to Infoblox) provide all reasonably requested information regarding the Services to enable Customer to carry out data protection impact assessments or prior consultations with Supervisory Authorities as required by Data Protection Laws.
(b) Legal Disclosure Requests. If either party receives a legally binding request for the disclosure of Personal Data which is subject to this DPA, such request will be immediately forwarded to the other party to allow the party an opportunity to engage in any legal processes it deems appropriate with respect to the protection or disclosure of Personal Data.
(i) Infoblox will respond to all reasonable requests for information made by Customer to confirm Infoblox’s compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, by making additional information available regarding its information security program upon Customer’s written request to firstname.lastname@example.org provided that Customer will not exercise this right more than once per calendar year.
(ii) Once per year, upon Customer’s written request and on a confidential basis, Infoblox will, within a reasonable time following such request, make available to Customer (or Customer’s independent third party auditor that is not a competitor of Infoblox) information regarding Infoblox’s compliance with the obligations set forth in the DPA, which may be in the form of third party audit reports and certifications, to the extent that Infoblox has such current reports or certifications and generally makes them available to customers.
(iii) Customer agrees that it will provide at least 30 days written notice for any audit activities. Before the commencement of any audit, Infoblox and the Customer will agree upon the scope, purpose, timing, and duration of the audit.
(iv) Customer will reimburse Infoblox for any time expended and expenses incurred for any audit at Infoblox’s standard Professional Services rates.
7. Data Transfers and Exports
(a) The Parties acknowledge and agree that the Processing of Customer Data by Infoblox may involve an international transfer of Customer Data from Customer to Infoblox (“International Transfer”).
(b) Standard Contractual Clauses. With respect to any International Transfer from the European Economic Area or the United Kingdom that would be prohibited by applicable Data Protection Laws in the absence of a lawful data transfer mechanism, the Parties agree that the SCCs issued by the European Commission under decision 2010/87/EU will be in effect between the Parties.
(c) The SCCs will apply to Customer Data that is transferred outside the European Economic Area (“EEA”), either directly or via onward transfer, to any country not recognized by the European Commission as providing an adequate level of protection for personal data (as described in the GDPR).
(d) The Standard Contractual Clauses will not apply to Customer Data that is not transferred, either directly or via onward transfer, outside the EEA. Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply if Infoblox has adopted Binding Corporate Rules for Processors or an alternative recognized compliance standard for the lawful transfer of personal data (as defined in the GDPR) outside the EEA.
(a) Infoblox will not assess the type or substance of Customer Data to identify whether it contains Customer Data or is subject to any specific legal requirements.
(b) Infoblox has implemented and maintains appropriate TOMs that are designed to protect Customer Data from Security Incidents and to preserve the security and confidentiality of Customer Data in accordance with Infoblox’s security standards described in Annex II.
(c) For any Services for which Infoblox obtains third party certifications or audits, upon request, Infoblox will provide a copy of Infoblox’s most recent third party certification or audit as applicable, which Infoblox generally makes available to its customers at the time of the request.
(d) Updates to TOMs. Customer is responsible for reviewing the information made available by Infoblox relating to data security and for making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Laws. Customer acknowledges that the TOMs may change through the adoption of new or enhanced security technologies and development and as a result Infoblox may update or modify the TOMs from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services provided to Customer.
(e) Security Breach Response. Customer agrees and acknowledges that Infoblox’s notification of or response to a Security Breach will not be construed as an acknowledgment by Infoblox of any fault or liability with respect to the Security Incident.
(f) Upon becoming aware of a Security Breach that results in unlawful exposure, destruction, or loss of access that is likely to affect the rights and freedoms of data subjects, Infoblox will: (a) notify Customer without undue delay, and where feasible, in any event no later than 48 hours from becoming aware of the Security Breach; (b) provide timely information relating to the Security Breach as it becomes known or as is reasonably requested by Customer; and (c) investigate and, as necessary, take appropriate steps to mitigate or remediate in accordance with Infoblox’s Security policies and procedures.
(a) Modification to the DPA Terms. The parties agree to mutually determine and execute appropriate modifications to the terms of this DPA which do not materially alter the economics or allocation of risk established by the Agreement: (i) if required to do so by a Supervisory Authority or other government or regulatory entity [with appropriate jurisdiction]; (ii) if necessary to comply with Data Protection Law; or (iii) to implement or adhere to revised SCCs which may be issued under Data Protection Law.
(b) Waiver. Unless otherwise expressly stated herein, this DPA may be modified only by a written agreement executed by an authorized representative of each Party. The waiver of any breach of this DPA will be effective only if in writing, and no such waiver will operate or be construed as a waiver of any subsequent breach.
(c) Relationship with the Agreement. Any claims brought under this DPA will be subject to the terms and conditions of the Agreement.
(i) This DPA will remain in effect for as long as Infoblox carries out Customer Data processing operations on behalf of Customer or until termination of the Agreement (and all Customer Data has been returned or deleted in accordance with Section 9(d) below).
(ii) Except for cases, where there is a valid data processing agreement already signed between Infoblox and the Customer, to the extent that there is a conflict between, or ambiguity relating to this DPA and any agreement the Parties may have previously entered into in connection with the Services, this DPA shall prevail.
(d) Return or Deletion of Data.
(i) Upon termination or expiration of the Agreement, Infoblox will (at Customer’s written request) delete or return to Customer all Personal Data in Infoblox’s possession or control. The Customer acknowledges that Infoblox may retain anonymized data for research purposes.
(ii) This requirement will not apply to the extent Infoblox is required by applicable law to retain some or all of the Customer Data or to Customer Data Infoblox has archived in its backup systems. In this case, Infoblox will archive the data and implement reasonable measures to prevent the Personal Data from any further processing and eventually delete in accordance with Infoblox’s retention and deletion policies, unless otherwise required by applicable law.
(e) Severability. If any provision of this DPA is held to be unenforceable, then that provision is to be construed either by modifying it to the minimum extent necessary to make it enforceable (if permitted by law) or disregarding it (if not permitted by law), and the rest of this DPA is to remain in effect as written. Notwithstanding the foregoing, if modifying or disregarding the unenforceable provision would result in failure of an essential purpose of this DPA, the entire DPA will be considered null and void.
(f) Notices. Unless otherwise expressly stated herein, the parties will provide notices under this DPA in accordance with the Agreement, provided that all such notices may be sent via email.
(g) Governing Law and Jurisdiction. Unless prohibited by Data Protection Laws, this DPA is governed by the laws stipulated in the Agreement and the Parties to this DPA hereby submit to the choice of jurisdiction and venue stipulated in the Agreement, if any, with respect to any dispute arising under this DPA.
(h) Enforcement. Regardless of whether Customer or its Affiliate(s) or a third party is a Controller of Customer Data, unless otherwise required by law: (a) only Customer will have any right to enforce any of the terms of this DPA against Infoblox; and (b) Infoblox’s obligations under this DPA, including any applicable notifications, will be to only Customer.
10. Limitation of Liability
(a) Each Party’s and all of its Affiliates’ liability taken together in the aggregate arising out of or related to this DPA (including the SCCs) will be subject to the exclusions and limitations of liability set forth in the Agreement to the extent permissible by applicable law.
(b) Any claims made against Infoblox or its Affiliates under or in connection with this DPA (including, where applicable, the SCCs) will be brought solely by the Customer entity that is a party to the Agreement.
(c) Variations in Data Protection Laws. If any variation is required to this DPA as a result of a change in or subsequently applicable Data Protection Law, then either Party may provide written notice to the other Party of that change in law. The Parties will then discuss and negotiate in good faith any variations to this DPA necessary to address such changes, with a view to agreeing and implementing those or alternative variations as soon as practicable, provided that such variations are reasonable with regard to the functionality and performance of the Services and Infoblox’s business operations.
(d) Reservation of Rights. Notwithstanding anything to the contrary in this DPA: (a) Infoblox reserves the right to withhold information the disclosure of which would pose a security risk to Infoblox or its customers or is prohibited by applicable law or contractual obligation; and (b) Infoblox’s notifications, responses, or provision of information or cooperation under this DPA are not an acknowledgement by Infoblox of any fault or liability.
Last updated September 2021