Data Processing Addendum

Palo Alto Software Data Processing Addendum
Controller (Business) to Processor (Service Provider)

Last Updated: November 3, 2026

This Palo Alto Software Data Processing Addendum (this “DPA”), including its exhibits, forms part of and is incorporated by reference into the Terms of Service for each Palo Alto Software Subscription Service, including the LivePlan Terms of Service and the Docmunk Terms of Service, and any other written agreement between Palo Alto Software, Inc. (“Palo Alto Software”) and the customer (“Customer”) that references this DPA (each, the “Agreement”). Palo Alto Software and Customer are each a “Party” and collectively the “Parties.”

This DPA applies automatically when Customer accepts the Agreement, without the need for a separate signature, and takes effect on the date Customer first accepts the Agreement (the “Effective Date”). Customers that require a countersigned copy for their records may request one at privacy@paloalto.com; a countersigned copy does not change the terms of this DPA.

The term of this DPA shall follow the term of the Agreement, and this DPA shall continue to apply for as long as Palo Alto Software Processes Personal Data on Customer’s behalf.

Terms not otherwise defined herein shall have the meaning as set forth in the Agreement.

This DPA Includes:

1. Definitions

1.1. Capitalized definitions not otherwise defined herein shall have the meaning given to them in the Agreement. Except as modified or supplemented below, the definitions of the Agreement shall remain in full force and effect.

1.2. For the purpose of interpreting this DPA, the following terms shall have the meanings set out below:

(a) “Agreement” has the meaning given in the opening paragraph of this DPA, as such terms may be updated by Palo Alto Software from time to time. Where Customer uses more than one Subscription Service, this DPA applies separately to each Agreement;

(b) “Applicable Laws” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including laws of the European Union (or any member state thereof), the United Kingdom, Switzerland, the United States (including any U.S. state), and the laws of any other country, province, or state to which the Processing of the Personal Data is subject;

(c) “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

(d) “Contracted Processor” means any third party appointed by or on behalf of Palo Alto Software to Process Personal Data on behalf of Customer in connection with the Agreement;

(e) “Customer” means the person or entity that has accepted the Agreement and, where an individual accepts the Agreement on behalf of an organization, that organization;

(f) “GDPR” or “General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 “on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC,” as may be amended from time to time;

(g) “Personal Data” means any information relating to an identified or identifiable* natural person (a “Data Subject”) Processed by Palo Alto Software on behalf of the Customer pursuant to or in connection with the Agreement

*an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(h) “Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data which Palo Alto Software Processes on behalf of the Customer in connection with the Agreement;

(i) “Personal Data Recipient” means Palo Alto Software, a Contracted Processor, or both collectively;

(j) “Processing” (or any cognate terms) means any operation or set of operations which is performed on data or on sets of data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(k) “Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller;

(l) “Services” means the services and other activities carried out by or on behalf of Palo Alto Software for the Customer pursuant to the Agreement;

(m) “Subscription Service” means each software-as-a-service product offered by Palo Alto Software under its own Terms of Service, currently LivePlan and Docmunk; and

(n) “Service Annex” means the annex to Exhibit A that describes the Processing for a particular Subscription Service.

2. Relationship with the Agreement

2.1. The parties agree that this DPA shall replace any existing DPA the Parties may have previously entered into in connection with the Services.

2.2. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.

2.3. Any claims brought under or in connection with this DPA shall be subject to the terms and conditions (including but not limited to, the exclusions and limitations) set forth in the Agreement.

2.4. Any claims against Palo Alto Software or its affiliates under this DPA shall be brought solely against the entity that is a party to the Agreement. In no event shall any party limit its liability with respect to any individual’s data protection rights under this DPA or otherwise. Customer further agrees that any regulatory penalties incurred by Palo Alto Software in relation to the Personal Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this DPA or any Applicable Laws shall count toward and reduce Palo Alto Software’s liability under the Agreement as if it were liability to the Customer under the Agreement, to the fullest extent permitted under the applicable laws.

2.5. No one other than a party to this DPA, its successors and permitted assignees shall have any right to enforce any of its terms, except as provided in the Standard Contractual Clauses.

2.6. This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Laws.

2.7. Palo Alto Software may update this DPA from time to time in accordance with the Agreement, provided that no update will materially reduce the protection of Personal Data under this DPA or remove a transfer mechanism without replacing it with another lawful one.

3. Applicability

3.1. This DPA applies where and only to the extent that Palo Alto Software Processes Personal Data that is subject to Applicable Laws on behalf of Customer as Processor in the course of providing Services pursuant to the Agreement.

3.2. If Palo Alto Software determines the purposes and means of Processing with respect to Personal Data, Palo Alto Software shall be a Controller with respect to such Processing operations and shall act in accordance with the Palo Alto Software Privacy Policy and Applicable Laws.

3.3. This DPA will apply to the Processing of all Personal Data, regardless of country of origin, place of Processing, location of Data Subjects, or any other factor.

3.4. The general terms of this DPA apply to every Subscription Service. The Service Annex for the Subscription Service Customer uses describes the Processing for that service and forms part of Customer’s documented instructions. If Customer uses more than one Subscription Service, each applicable Service Annex applies to the Processing for that service.

4. Processing and Disclosing of Personal Data

4.1. In the context of this DPA and its appendices, with regard to the Processing of Personal Data, 1) when Customer acts as a Controller, Palo Alto Software acts as a Processor; and 2) when Customer acts as a Processor, Palo Alto Software acts as a Sub-Processor. For the avoidance of doubt, both situations fall within the scope of and are covered by this DPA.

4.2. Palo Alto Software shall:

(a) comply with all Applicable Laws in the Processing of Personal Data;

(b) not Process Personal Data other than on Customer’s relevant documented instructions (including with regard to international transfers of Personal Data), unless such Processing is required by Applicable Laws to which the relevant Personal Data Recipient is subject, in which case Palo Alto Software shall to the extent permitted by Applicable Laws, inform Customer of that legal requirement before the respective act of Processing of that Personal Data;

(c) only conduct transfers of Personal Data in compliance with all applicable conditions, as laid down in Applicable Laws;

(d) not retain, delete, or otherwise Process Personal Data contrary to or in the absence of the direct instructions of the Customer, provided, however, that the Customer expressly and irrevocably authorizes such retention, deletion, or other Processing if and to the extent required or allowed by Applicable Laws;

(e) immediately inform the Customer in the event that, in Palo Alto Software’s opinion, a Processing instruction given by the Customer may infringe Applicable Laws; and

(f) not use Personal Data, or any other content Customer submits to the Services, to train artificial intelligence or machine learning models, and not permit any Contracted Processor to do so.

4.3. Exhibit A, including the applicable Service Annex, describes the Processing. Customer shall inform Palo Alto Software if any information in the applicable Service Annex does not accurately describe Customer’s use of the Services.

4.4. The Customer instructs Palo Alto Software (and authorizes Palo Alto Software to instruct each Contracted Processor) to Process Personal Data, and in particular, transfer Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Agreement and this DPA. Customer’s configuration and use of the Services (for example, connecting a repository, providing application login details, or publishing a help center) constitute further documented instructions.

4.5. The Customer represents and warrants that it has all necessary rights to provide the Personal Data to Palo Alto Software for the purpose of Processing such data within the scope of this DPA and the Agreement. Within the scope of the Agreement and in its use of the Services, the Customer shall be solely responsible for complying with the statutory requirements relating to data protection and privacy, in particular regarding the disclosure and transfer of Personal Data to Palo Alto Software and the Processing of Personal Data.

5. Palo Alto Software Personnel

5.1. Palo Alto Software shall take reasonable steps to ensure the reliability of any of its employees, agents, or contractors who may have access to Personal Data.

5.2. Palo Alto Software shall ensure that access to Personal Data is strictly limited to those individuals who need to know or access it, as strictly necessary to fulfill the documented Processing instructions given to Palo Alto Software by the Customer or to comply with Applicable Laws.

5.3. Palo Alto Software shall ensure that all such individuals are subject to formal confidentiality undertakings, professional obligations of confidentiality, or statutory obligations of confidentiality.

6. Security of Processing

6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, Palo Alto Software shall, with regard to Personal Data, implement and maintain appropriate technical and organizational security measures, including those described in Exhibit C, to ensure a level of security appropriate to that risk, as well as assist the Customer with regard to ensuring compliance with the Customer’s obligations pursuant to the Applicable Laws.

6.2. In assessing the appropriate level of security, Palo Alto Software shall take account, in particular, of the risks that are presented by the nature of such Processing activities, and particularly those related to possible Personal Data Breaches.

6.3. The Customer is responsible for reviewing the information made available by Palo Alto Software relating to data security and making an independent determination as to whether the Services meet the Customer’s requirements and legal obligations under Applicable Laws. The Customer acknowledges that the security measures are subject to technical progress and development and that Palo Alto Software may update or modify the security measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Customer.

6.4. Notwithstanding the above, the Customer agrees that, except as provided by this DPA, the Customer is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of the Personal Data when in transit to and from the Services, and taking any appropriate steps to securely encrypt or backup any Personal Data uploaded to the Services.

7. Subprocessing

7.1. The Customer authorizes Palo Alto Software to appoint (and permit each Contracted Processor appointed in accordance with this Section 7 to appoint) Contracted Processors in accordance with this Section 7 and any possible further restrictions, as set out in the Agreement, as the case may be.

7.2. Palo Alto Software may continue to use those Contracted Processors already engaged by Palo Alto Software as of the date of this DPA, subject to Palo Alto Software meeting the obligations set out in Section 7.4. The list of Palo Alto Software’s Contracted Processors for each Subscription Service as of the Effective Date is located at: https://www.paloalto.com/policies/processors. Contracted Processors used only for Docmunk, including its artificial intelligence processing providers, are also listed in Annex A-2.

7.3. Palo Alto Software shall provide Customer prior written notice of the appointment of any new Contracted Processor by updating the list of Palo Alto Software Contracted Processors. Customer may object in writing to Palo Alto Software’s appointment of any Contracted Processor within five (5) calendar days of posting such notice of that Contracted Processor’s appointment, provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss Customer’s concerns in good faith with a view to achieving resolution. If this is not possible, Customer may suspend or terminate the Agreement (without prejudice to any fees incurred by Customer prior to suspension or termination) as a remedy. Notice is required only for Contracted Processors that will Process Personal Data for a Subscription Service Customer uses.

7.4. With respect to each Contracted Processor, Palo Alto Software shall:

(a) carry out adequate due diligence to ensure that the Contracted Processor is capable of providing the level of protection and security for Personal Data required by this DPA, the Agreement, and Applicable Laws before the Contracted Processor first Processes Personal Data or, where applicable, in accordance with Section 7.3; and

(b) ensure that the arrangement between Palo Alto Software and the prospective Contracted Processor is governed by a written contract that includes terms which offer at least the same level of protection for Personal Data as those set out in this DPA, including the prohibition on model training in Section 4.2(f), and that such terms meet the requirements of Applicable Laws.

7.5. Third-party services that Customer chooses to connect to the Services (for example, a source code hosting service such as GitHub, or accounting software such as QuickBooks or Xero) are not Contracted Processors. Customer’s relationship with those services is governed by Customer’s agreements with them.

8. Rights of the Data Subjects

8.1. Taking into account the nature of the Processing, Palo Alto Software shall assist Customer by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer’s obligations, as reasonably understood by the Customer, to respond to requests to exercise rights of the Data Subjects under Applicable Laws.

8.2. With regard to the rights of the Data Subjects within the scope of this Section 8, Palo Alto Software shall:

(a) promptly notify Customer if any Personal Data Recipient receives a request from a Data Subject under any Applicable Law with respect to Personal Data;

(b) ensure that the Personal Data Recipient does not respond to that request, except on the documented instructions of Customer, or as required by Applicable Laws to which the Personal Data Recipient is subject, in which case Palo Alto Software shall, to the extent permitted by Applicable Laws, inform Customer of that legal requirement before the Personal Data Recipient responds to the request.

8.3. The Customer agrees to pay Palo Alto Software, upon receipt of invoice, a reasonable fee based on the time spent, as well as to account for the materials expended, in relation to the Customer exercising its rights under this Section 8 or the Standard Contractual Clauses.

9. Personal Data Breach

9.1. Palo Alto Software shall notify the Customer without undue delay upon Palo Alto Software becoming aware of a Personal Data Breach affecting Personal Data under Palo Alto Software’s direct control or upon Palo Alto Software being notified of a Personal Data Breach affecting Personal Data under the direct control of a Contracted Processor, providing the Customer with sufficient information to allow the Customer to meet any applicable obligations pursuant to the Applicable Laws, such as to report to the supervisory authorities or any other competent authorities, or inform the Data Subjects of the Personal Data Breach.

9.2. Palo Alto Software shall cooperate with Customer and take all reasonable commercial steps to assist Customer in the investigation, mitigation, and remediation of each such Personal Data Breach.

9.3. Palo Alto Software’s notification of or response to a Personal Data Breach under this Section 9 will not be construed as an acknowledgement by Palo Alto Software of any fault or liability with respect to the Personal Data Breach.

10. Data Protection Impact Assessment and Prior Consultation

10.1. Palo Alto Software shall provide Customer with relevant information and documentation, such as, if available, an audit report (upon a written request and subject to obligations of confidentiality), with regard to any data protection impact assessments, and prior consultations with supervisory authorities when the Customer reasonably considers that such data protection impact assessments or prior consultations are required pursuant to Applicable Laws but in each such case solely with regard to Processing of Personal Data by, and taking into account the nature of the Processing and information available to, the respective Personal Data Recipient.

11. Deletion or Return of Personal Data

11.1. Palo Alto Software shall provide the Customer with the technical means, consistent with the way the Services are provided, to request the deletion of Personal Data upon the request of the Customer unless Applicable Laws require storage of any such Personal Data.

11.2. Palo Alto Software shall promptly, following the date of cessation of Services involving the Processing of Personal Data, at the choice of the Customer delete or return all Personal Data to the Customer as well as delete existing copies, unless Applicable Laws require storage of any such Personal Data. Any service-specific deletion periods are set out in the applicable Service Annex.

12. Security Reports and Audits

12.1. Customer acknowledges that Palo Alto Software is regularly audited against PCI standards by independent third-party auditors and internal auditors. Upon request, Palo Alto Software shall supply (on a confidential basis) a summary copy of its audit report(s) to Customer, so that Customer can verify Palo Alto Software’s compliance with the audit standards against which it has been assessed, and this DPA.

12.2. Palo Alto Software shall also provide written responses (on a confidential basis) to all reasonable requests for information made by Customer, including responses to information security and audit questionnaires that are necessary to confirm Palo Alto Software’s compliance with this DPA.

13. Audit Rights

13.1. Where the Customer is entitled to and desires to review Palo Alto Software’s compliance with the Applicable Laws, the Customer may request, and Palo Alto Software will provide (subject to obligations of confidentiality) relevant documentation, or any relevant audit report Palo Alto Software might have been issued, as elaborated in Section 12. If the Customer, after having reviewed such audit report(s), still reasonably deems that it requires additional information, Palo Alto Software shall further reasonably assist and make available to the Customer, upon a written request and subject to obligations of confidentiality, all other information (excluding legal advice) and/or documentation necessary to demonstrate compliance with this DPA, and the obligations pursuant to the Applicable Laws (Articles 32 to 36 of the GDPR in particular), and shall allow for and contribute to audits, including remote inspections of the Services, by the Customer or an auditor mandated by the Customer with regard to the Processing of the Personal Data by the Contracted Processors. Palo Alto Software shall provide the assistance described in this Section 13.1, insofar as in Palo Alto Software reasonable opinion such audits, and the specific requests of the Customer, do not interfere with Palo Alto Software’s business operations or cause Palo Alto Software to breach any legal or contractual obligation to which it is subject.

13.2. The Customer agrees to pay Palo Alto Software, upon receipt of invoice, a reasonable fee based on the time spent, as well as to account for the materials expended, in relation to the Customer exercising its rights under this Section 13 or Clause 8.9 of the Standard Contractual Clauses.

14. Jurisdiction Specific Terms

14.1. To the extent Palo Alto Software processes Personal Data originating from, or protected by, Applicable Laws in one of the jurisdictions listed in Exhibit B, then the terms specified in Exhibit B with respect to the applicable jurisdiction(s) (“Jurisdiction Specific Terms”) shall apply in addition to the terms of this DPA.

14.2. Palo Alto Software may update Exhibit B from time to time, to reflect changes in or additions to Applicable Laws to which Palo Alto Software is subject. If Palo Alto Software updates Exhibit B, it will notify the Customer. If the Customer does not object to the updated Exhibit B within 14 days of notice, the Customer will be deemed to have consented to the updated Exhibit B.

14.3. In case of any conflict or ambiguity between the Jurisdiction Specific Terms and any other terms of this DPA, the applicable Jurisdiction Specific Terms will take precedence.

15. No Selling of Personal Data

15.1. Palo Alto Software acknowledges and confirms that it does not receive any Personal Data as consideration for any services or other items that Palo Alto Software provides to the Customer. The Customer retains all rights and interests in Personal Data. The Customer agrees to refrain from taking any action that would cause any transfers of Personal Data to or from Palo Alto Software to qualify as selling or sharing Personal Data under Applicable Laws.

16. Indemnification.

16.1. The Customer agrees to indemnify and hold harmless Palo Alto Software and its officers, directors, employees, agents, affiliates, successors, and permitted assigns against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind which Palo Alto Software may sustain as a consequence of the breach by the Customer of its obligations pursuant to this DPA or the Applicable Laws.

17. General Terms

17.1. This DPA supersedes and replaces all prior and contemporaneous proposals, statements, sales materials or presentations and agreements, oral and written, with regard to the subject matter of this DPA, including any prior data processing addenda entered into between the Palo Alto Software and the Customer.

17.2. All clauses of the Agreement, that are not explicitly amended or supplemented by the clauses of this DPA, and as long as this does not contradict with compulsory requirements of Applicable Laws under this DPA, remain in full force and effect and shall apply.

17.3. In the event of any conflict between the Agreement (including any annexes and appendices thereto) and this DPA, the provisions of this DPA shall control.

17.4. Should any provision of this DPA be found legally invalid or unenforceable, then the invalid or unenforceable provision will be deemed superseded by a valid, enforceable provision that most closely matches the intent of the original provision and the remainder of the DPA will continue in effect.

17.5. If Palo Alto Software makes a determination that it can no longer meet any of its obligations in accordance with this DPA, it shall promptly notify the Customer of that determination, and cease the Processing or take other reasonable and appropriate steps to remediate.

17.6. If you are accepting the terms of this DPA on behalf of an entity, including by accepting the Agreement, you represent and warrant to Palo Alto Software that you have the authority to bind that entity and its affiliates, where applicable, to the terms and conditions of this DPA.

18. Data Protection Officer

18.1. The identity and contact information of the Data Protection Officer of Palo Alto Software is:

Palo Alto Software, Inc.
44 W. Broadway, STE 500
Eugene, OR 97401
USA
privacy@paloalto.com

19. EU and UK Representatives.

19.1. The European Union Representative of Palo Alto Software pursuant to Article 27 of the GDPR is:

VeraSafe Czech Republic s.r.o.
Rohanské nábřeží 678/23
Prague 8, 18600
Czech Republic
Databox ID: eicpabq

VeraSafe Ireland Ltd
Unit 3D North Point House,
North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland

Contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/

19.2. The United Kingdom Representative of Palo Alto Software pursuant to Article 27 of the UK GDPR is VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom.

Exhibit A — Details of the Processing

General terms (all Subscription Services)

1.1. The subject matter of the Processing of Personal Data pertains to the provision of Services, as requested by the Customer.

1.2. The duration of the Processing: Personal Data will be Processed for the duration of the Agreement, subject to Section 11 of this DPA and any deletion periods in the applicable Service Annex.

1.3. The nature and purpose of the Processing: Personal Data will be Processed for purposes of providing the Services set out and otherwise agreed to in the Agreement and any applicable Order. The nature of such Processing is related to these purposes and is elaborated on in this DPA, the Agreement, and the applicable Service Annex.

1.4. Frequency of transfer: continuous, for the duration of the Agreement.

1.5. Special categories of data: the Services are not designed to Process special categories of Personal Data or data relating to criminal convictions, and Customer shall not submit such data to the Services unless Palo Alto Software agrees in writing.

Annex A-1 — LivePlan

Categories of Personal Data:

(a) Biographical information, such as first and last name; (b) Contact information, such an email address; (c) Professional information; (d) Email messages and attachments; (e) Personal Data such as navigational data; (f) financial and accounting data imported from accounting software Customer connects, which may include the names of customers, vendors, and employees; and (g) Any other type of Personal Data captured through custom fields.

Categories of Data Subjects:

Any individual accessing and/or using the Service through the Customer’s account (“Users”); and any individual: (i) whose information is stored on or collected via the Services, or (ii) to whom Users send emails or otherwise engage or communicate with via the Services within the scope of the Agreement and this DPA, such as customers, business partners, or recipients of emails.

Contracted Processors: as listed at https://www.paloalto.com/policies/processors, including the third-party artificial intelligence processing services described in “LivePlan, AI, and Your Privacy.”

Annex A-2 — Docmunk

Subject matter and purpose: generating, updating, publishing, and hosting help center articles and screenshots for Customer’s software product, based on Customer’s source code repositories and application, and operating Customer’s hosted help center.

Nature of the Processing:

Categories of Data Subjects: (a) Users of Customer’s Docmunk account; (b) contributors to Customer’s repositories (for example, commit authors and pull request participants); (c) individuals whose information appears in Customer’s source code, configuration, test data, or application as displayed to Customer’s User States; (d) visitors to Customer’s hosted help center; and (e) individuals named in content Customer imports or publishes.

Categories of Personal Data: (a) Users’ names, email addresses, and account activity; (b) contributors’ names, usernames, email addresses, and commit and pull request messages; (c) any Personal Data contained in source code, comments, configuration files, or test fixtures; (d) login details for User States; (e) any Personal Data visible in screenshots of Customer’s application; (f) help center visitors’ IP addresses, browser and device information, pages viewed, search terms, questions submitted to AI answer features, and article feedback; and (g) any Personal Data in help center content or imported knowledge base content.

Customer instructions specific to Docmunk: Customer will provide test or demonstration accounts as User States, not accounts belonging to Customer’s end users, and is responsible for what Personal Data those accounts can display. Palo Alto Software will use repository content only to provide the Services to Customer.

Retention and deletion: repository data, including cached copies, is deleted within 30 days after Customer disconnects the repository or the Agreement ends; User State login details are deleted when Customer removes the User State; help center content and screenshots are retained for 90 days after the Agreement ends so Customer can export them, then deleted; help center visitor data is retained for [period] for analytics, then deleted or aggregated.

Docmunk-specific Contracted Processors (in addition to the general list at https://www.paloalto.com/policies/processors):

Contracted ProcessorPurposeDataLocation
Anthropic, PBCAI analysis and article draftingRepository content, screenshots, help center content, visitor questionsUnited States
Google LLC (Gemini)AI analysis and article draftingRepository content, screenshots, help center content, visitor questionsUnited States
OpenAI, L.L.C.AI analysis and article draftingRepository content, screenshots, help center content, visitor questionsUnited States

Each artificial intelligence Contracted Processor is bound by terms that prohibit using Customer content to train or improve its models. GitHub and other services Customer connects are not Contracted Processors (Section 7.5).

Exhibit B — Jurisdiction Specific Terms

1. Transfers of EU, UK, and Swiss Personal Data

1.1. “Data Privacy Framework” means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as administered by the U.S. Department of Commerce.

1.2. “Restricted Transfer” means any transfer of Personal Data (including data storage in foreign servers) that would be prohibited by the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection (“FADP”) in the absence of the Standard Contractual Clauses or another lawful data transfer mechanism.

1.3. “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

1.4. With regard to any Restricted Transfer from the Customer to Palo Alto Software within the scope of this DPA, one of the following transfer mechanisms shall apply, in the following order of precedence:

(a) Palo Alto Software’s certification under the Data Privacy Framework, for as long as it remains valid and applies to the transfer;

(b) the Standard Contractual Clauses, as set out in Section 1.5; or

(c) any other lawful basis, as laid down in Applicable Laws, as the case may be.

1.5. Where the Standard Contractual Clauses apply, they are incorporated into this DPA by reference and the Parties are deemed to have accepted and executed them, as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Clause 7 (docking clause) applies; (c) in Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 7.3 of this DPA; (d) the optional wording in Clause 11 does not apply; (e) in Clause 13, the competent supervisory authority is determined in accordance with that Clause; (f) in Clause 17, Option 1 applies and the governing law is the law of Ireland; (g) in Clause 18, the courts of Ireland have jurisdiction; (h) Annex I is completed with the information in this DPA and Exhibit A (Customer is the data exporter and Palo Alto Software is the data importer); (i) Annex II is completed with Exhibit C; and (j) Annex III is the list of Contracted Processors referenced in Section 7.2 and Annex A-2.

1.6. United Kingdom. For Restricted Transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022, as amended) is incorporated by reference. Tables 1 to 3 are completed with the information in Section 1.5 and Exhibits A and C, and either Party may end the Addendum as set out in its Section 19.

1.7. Switzerland. For Restricted Transfers subject to the FADP, the Standard Contractual Clauses apply as set out in Section 1.5, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; references to the GDPR are read as references to the FADP; and the term “member state” does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

1.8. In cases where the Standard Contractual Clauses apply, and there is a conflict between the terms of the DPA and the terms of the Standard Contractual Clauses, the terms of the Standard Contractual Clauses shall control.

2. California

2.1. “Applicable Laws” (as used in the DPA) includes the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (“CCPA”), as may be amended from time to time.

2.2. “Business Purpose” (as used in this Section) shall have the same meaning as in the CCPA;

2.3. “Commercial Purpose” (as used in this Section) shall have the same meaning as in the CCPA;

2.4. “Controller” (as used in the DPA) includes “Business” as defined under the CCPA.

2.5. “Data Subject” (as used in the DPA) includes “Consumer” as defined under the CCPA.

2.6. “Personal Data” (as used in the DPA) includes “Personal Information” as defined under the CCPA.

2.7. “Personal Data Breach” (as used in the DPA) includes “Breach of the Security of the System” as defined under the CCPA.

2.8. “Processor” (as used in the DPA) includes “Service Provider” as defined under the CCPA.

2.9. The Customer discloses Personal Data to Palo Alto Software solely for: (i) valid Business Purposes; and (ii) to enable Palo Alto Software to perform the Services under the Agreement.

2.10. Palo Alto Software shall not: (i) sell or share (for cross-context behavioral advertising) Personal Data; (ii) retain, use or disclose Personal Data for a Commercial Purpose other than providing the Services specified in the Agreement or as otherwise permitted by the CCPA; (iii) retain, use, or disclose Personal Data outside the direct business relationship between Customer and Palo Alto Software, or except where permitted under the Agreement between the Customer and Palo Alto Software; or (iv) combine Personal Data received from Customer with personal information it receives from or on behalf of another person, except as permitted by the CCPA. Palo Alto Software certifies that it understands these restrictions and will comply with them.

2.11. Palo Alto Software will provide the same level of privacy protection to Personal Data as required of businesses by the CCPA, will notify Customer if it determines it can no longer meet its obligations under the CCPA, and grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.

3. United Kingdom

3.1. “Applicable Laws” (as used in the DPA) includes the UK GDPR and the Data Protection Act 2018.

4. Switzerland

4.1. “Applicable Laws” (as used in the DPA) includes the Swiss Federal Act on Data Protection of 25 September 2020.

Exhibit C — Technical and Organizational Security Measures

a. Access Control

i. Preventing Unauthorized Product Access

Outsourced Processing: Palo Alto Software hosts its Service with outsourced cloud infrastructure providers. Additionally, Palo Alto Software maintains contractual relationships with Contracted Processors in order to provide the Services in accordance with our DPA. Palo Alto Software relies on contractual agreements, privacy policies, and Contracted Processors compliance programs in order to protect Personal Data Processed or stored by these Contracted Processors.

Physical and environmental security: Palo Alto Software hosts its product infrastructure with multi-tenant, outsourced infrastructure providers. The physical and environmental security controls are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.

Authentication: Palo Alto Software implemented a uniform password policy for its customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public Personal Data.

Authorization: Personal Data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of Palo Alto Software’s products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.

Application Programming Interface (API) access: Public product APIs may be accessed using an API key or through OAuth authorization.

ii. Preventing Unauthorized Product Use

Palo Alto Software implements industry standard access controls and detection capabilities for the internal networks that support its products.

Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.

Network scanning: Palo Alto Software contracts with third-party vulnerability scanners to regularly review the Services for common vulnerabilities and to maintain PCI compliance.

Penetration testing: Palo Alto Software maintains relationships with industry recognized penetration testing service providers for annual penetration tests. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.

iii. Limitations of Privilege & Authorization Requirements

Product access: A subset of Palo Alto Software’s employees have access to the products and to Personal Data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective Customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security.

b. Transmission Control

In-transit: Palo Alto Software makes HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces. Palo Alto Software’s HTTPS implementation uses industry standard algorithms and certificates.

At-rest: Palo Alto Software stores user passwords following policies that follow industry standard practices for security.

c. Input Control

Detection: Palo Alto Software designed its infrastructure to log extensive information about system behavior, traffic received, system authentication, and other application requests. Palo Alto Software personnel, including security, operations, and support personnel, are responsive to known incidents.

Response and tracking: Palo Alto Software maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Palo Alto Software will take appropriate steps to minimize product and Customer damage or unauthorized disclosure.

Communication: If Palo Alto Software becomes aware of unlawful access to Personal Data stored within its products, Palo Alto Software will: 1) notify the affected Customers of the incident; 2) provide a description of the steps Palo Alto Software is taking to resolve the incident; and 3) provide status updates to the Customer contact, as Palo Alto Software deems necessary. Notification(s) of incidents, if any, will be delivered to one or more of the Customer’s contacts in a form Palo Alto Software selects, which may include via email or telephone.

d. Availability Control

Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.95% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services.

Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Personal Data is backed up to multiple durable data stores and replicated across multiple availability zones.

Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry standard methods.

Palo Alto Software’s products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists Palo Alto Software operations in maintaining and updating the product applications and backend while limiting downtime.

e. Additional Measures for Docmunk