Relay by Puppet Terms of Service

Relay by Puppet® Terms of Service
These Customer Terms of Service (“Terms”) describe your rights and responsibilities when using Relay by Puppet (the “Services”). These Terms are a legally binding contract between you and Puppet, so please read them carefully. If you do not agree with these Terms, do not register or use these Services. By using, accessing or browsing the Services, you are agreeing to be bound by these Terms for the Services provided by Puppet, Inc. (“Puppet” or “we”).
If you are using the Services on behalf of an organization, you are agreeing to these Terms for that organization and representing to Puppet that you have the authority to bind that organization to these Terms (in which event, “you” and “your” or “Customer” will refer to that organization) unless that organization has a separate paid contract in effect with us, in which event the terms of that contract will govern your use of the Services, provided that Puppet’s Privacy Policy and acceptable use policy (see Section 12 below) continue to apply to your use of the Services as an individual.

1. PRIVACY; EMAIL COMMUNICATIONS. In order to operate and provide the Services, we collect certain information about individuals who have registered for Services. We use and protect that information as described in our Privacy Policy. You acknowledge your use of the Services is subject to our Privacy Policy and understand that it identifies how Puppet collects, stores, and uses certain information. If an organization provided you with your account (e.g., an employer), or if you agree to have your account managed by an organization as the Customer, the Customer may: (a) manage your account (including suspending or canceling); (b) reset your password; (c) view your usage and profile data, including how and when your account is used; and (d) manage the Content in your account.
By registering for use of the Services, you understand that we may send you information regarding the Services, such as: (a) notices about your use of the Services, including notices of violations of use; (b) updates to the Services and new features or products; (c) administrative messages and other information; and (d) unless prohibited by applicable law, advertising, marketing, and other materials regarding Puppet’s products and services. Where required by law, Puppet will collect your consent to send any advertising and marketing materials and you may choose to opt-out of receiving advertising and marketing materials by unsubscribing from such communications by following the instructions in the message.

2. CHANGES TO TERMS. We reserve the right to modify these Terms. If we make material changes to these Terms, we will notify you via the Services and/or by email to the address associated with your account. If you do not accept the changes, you must stop using and cancel your account. Your continued use of our Services after we publish or send a notice about our changes to these Terms means that you are consenting to the updated terms.

3. SUBSCRIPTIONS
3.1 Provision of Service. During the applicable subscription term, Customer may access and use the Services in accordance with the terms of the Agreement. Customer is responsible for use of the Services by its users (“Users”) and any party who accesses the Services with the Customer’s the User’s account credentials.
3.2 Materials. Puppet may make additional materials, software, agents, extensions, documentation or data (including any improvements, enhancements or modifications thereto) (“Materials”) available in connection with the Services. Puppet hereby grants Customer a non-transferable, non-sublicensable and non-exclusive right and license to use the Materials, in each case solely in connection with use of the Services. No rights or licenses are granted by Puppet except as expressly set forth herein.

4. FEES AND PAYMENT. Puppet offers free and paid Services. If you subscribe to paid Services, you agree to pay the fees as quoted to you when you purchase the Services. Paid subscriptions are paid in advance, unless otherwise agreed by Puppet. All amounts payable shall be in U.S. dollars and exclude any taxes, levies or assessments including, for example, value-added, sales, use or withholding taxes accessible by any jurisdiction. Customer is responsible for paying all taxes associated with its purchases, except for those taxes based on Puppet’s net income. Any overdue amounts are subject to a late payment charge of the lower of 1.5% per month and the highest interest rate permitted by applicable law. All fees paid are non-refundable and payment obligations are non-cancelable. Full payment must be received within thirty (30) days from the invoice date. If we enable credit card payments via the Services interface, you authorize us to bill your credit card for the current subscription term and, unless you cancel in accordance with these Terms, any renewal term.

5 TERM; TERMINATION
5.1 Subscription term. A free subscription continues until terminated as set forth below. A paid subscription continues for the period set forth in your order. These Terms are effective during any subscription term. Unless otherwise agreed by Puppet, paid subscriptions automatically renew for additional periods equal to one (1) year, unless either party gives the other notice of non-renewal at least thirty (30) days before the end of the then-current subscription term.
5.2 Termination. Either party may terminate a free subscription at any time by providing notice to the other party. A paid subscription may be terminated (a) by either party if the other party materially breaches these Terms and does not cure the breach within 30 days after receiving written notice thereof from the non-breaching party, or (b) by Puppet at any time for any reason or no reason, as determined by Puppet in its sole discretion; if Puppet terminates under subsection (b) it will provide, as your sole remedy and Puppet’s sole liability, a pro-rata refund of any pre-paid fees for any unused portion of the subscription term. Customer is responsible for its Users, including for any breaches of these Terms caused by its Users.
5.3 Suspension. We reserve the right to suspend your access to the Services at any time in our sole discretion if (a) you are in breach of these Terms; or (b) your use of the Services could cause a risk of harm or loss to Puppet or our other users. When reasonable, Puppet will provide you reasonable advance notice of this change as well as an opportunity to correct any actions that led to Puppet’s decision.
5.4 Effect. Upon any termination of this these Terms, without prejudice to any other rights or remedies which the parties may have, (a) all subscriptions, rights and obligations hereunder shall immediately cease; provided that Sections 2, 3, 4, 5.2, 5.4, and 7-10 and any other provisions with express survival language shall survive termination, (b) Customer shall pay to Puppet any outstanding fees that have accrued prior to the date of termination, if any, and (c) Customer shall immediately delete any Materials in Customer’s possession or on Customer’s equipment. Except as set forth in these Terms, all fees paid are non-refundable.
5.5 Customer acknowledges and agrees that the ability to export or share Customer Content may be limited or unavailable. Following termination or expiration of a subscription term, we will have no obligation to maintain or provide any Customer Content and may thereafter, unless legally prohibited, delete all Customer Content in our systems or otherwise in our possession or under our control.

6.0 STORAGE; ACCEPTABLE USE; PRIVACY
The Services are provided from the United States. By using and accessing the Services, you understand and agree to the storage of Customer Content and any other personal information in the United States. However, you understand that Puppet personnel (for example engineering or support) may access the Services (including Customer Content) from outside of the United States and that nothing prohibits the processing of other information outside of the United States.
Customer will comply with and will be responsible for its Users’ compliance with all applicable laws and regulations as well as this Agreement with respect to use of the Services. Customer is responsible for establishing and enforcing terms of use and privacy policies applicable to use of the Hosted Service by users as permitted under these Terms. Customer warrants that all content uploaded and displayed via the Services (“Customer Content”) was obtained and supplied to Puppet in compliance with applicable data protection legislation, including Customer having obtained all necessary consents and approvals from users that are necessary to permit Puppet to provide the Services.
Further, Customer shall not, and shall not permit a User to:
(i) use any robot, spider, script, scraper, deep link or other similar automated data gathering or extraction tools, programs, algorithm or methodology to access, acquire, copy or monitor the Services or a portion of the Services without Puppet’s prior written consent, which consent may be withheld for any reason;
(ii) upload content on the using any automated means or for you to develop, offer, market, sell, distribute or provide an automated means to perform any step of the uploading and sharing process (in whole or in part);
(iii) frame or reformat the Services in any way;
(iv) collect or attempt to collect information from third parties by using the Services;
(v) register to use the Hosted or create an account using any automated means or under false pretenses;
(vi) upload, post, transmit or otherwise make available any Customer Content that (a) is unlawful, harmful, threatening, abusive, harassing, tortuous, defamatory, vulgar, obscene, libelous, invasive of another’s privacy, hateful, or racially, ethnically or otherwise objectionable or (b) you do not have a right to make available under any law or under contractual or fiduciary relationships;
(vii) upload, post, transmit or otherwise make available any material that contains software viruses or any other computer code, files or programs designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment;
(viii) interfere with or disrupt the Services or servers or networks connected to the Services, or disobey any requirements, procedures, policies or regulations of networks connected to the Services;
(ix) intentionally or unintentionally violate any applicable local, state, national or international law; and/or collect or store personal data about other users in connection with the prohibited conduct and activities above; or
(x) exceed the recommended maximum workflows for the Services or otherwise use the Services in a manner that is reasonably likely to damage, disable, overload, or impair the Services, interfere with any third party’s use and enjoyment of the Services, or in any manner that Puppet deems excessive or abusive.
If we believe there is a violation of these Terms, we will, in most cases, notify you and ask you to cure the violation. However, we may take action (for example, we may remove Customer Content without notice) if you do not take appropriate action or if we believe there is a credible risk of harm to us, the Services, our other customers, or users. Puppet assumes no responsibility for monitoring the Services for inappropriate Customer Content or conduct. If at any time Puppet chooses, in its sole discretion, to monitor the Services, Puppet nonetheless assume no responsibility for the Services, no obligation to modify or remove any inappropriate Customer Content, and no responsibility for the conduct of the user submitting any such Customer Content.
To the extent the California Consumer Privacy Act (“CCPA”) applies to Puppet’s provision of the Services to Customer, the parties acknowledge and agree that Puppet is a service provider and receives personal information for the business purpose of providing the Services to Customer as set forth in this Agreement. Puppet shall not (i) sell personal information, (i) retain, use, or disclose personal information for any purpose other than the specific purpose of performing the Services, or (iii) retain, use or disclose personal information outside the business relationship between Puppet and Customer.
In relation to any personal data of Customer processed by Puppet as a processor in providing the Services and to which data protection requirements in the European Economic Area and/or the United Kingdom apply, Puppet will process such personal data in connection with the provision of Services and in accordance with Customer’s instructions as evidenced by this Agreement and as set out in Puppet’s Data Processing Addendum attached below and Puppet’s Privacy Policy.
Puppet may monitor, collect and use data pertaining to the use of the Services. See our Privacy Policy for more details.

7.0 PROPRIETARY RIGHTS.
As between the parties, Puppet and its suppliers will retain all ownership rights in and to the Puppet trademarks, the Services, Materials, and all intellectual property rights incorporated into or related to the foregoing. Customer acknowledges that the goodwill associated with the Puppet trademarks belong exclusively to Puppet. All rights not expressly licensed by Puppet under this Agreement are reserved. As between the parties hereto, Customer will retain all ownership rights in and to all Customer Content. By sending or submitting messages to Puppet about the Services, including but not limited to images, feedback, suggestions, ideas (“Feedback”), you automatically assign this Feedback to Puppet.

8.0 DISCLAIMERS.
TO THE EXTENT NOT PROHIBITED BY LAW, PUPPET AND ITS AFFILIATES (AND SERVICE PROVIDERS) (A) PROVIDE THE SERVICES “AS IS” AND “AS AVAILABLE”, (B) MAKE NO REPRESENTATIONS OR WARRANTIES WHETHER EXPRESS OR IMPLIED AND DISCLAIM ANY WARRANTY OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT), AND (C) DO NOT GUARANTEE THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR FREE OF HARMFUL COMPONENTS, OR THAT THE CONTENT WILL BE SECURE OR NOT OTHERWISE LOST OR DAMAGED.
IF YOU ARE DISSATISFIED WITH ANY PORTION OF THE SERVICE OR WITH THESE TERMS OF SERVICE, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USE OF THE SERVICES.

9.0 LIMITATIONS ON LIABILITY; INDEMNITY.
TO THE EXTENT PERMITTED BY LAW AND EXCEPT WITH RESPECT TO (I) FAILURE TO PAY AMOUNTS PROPERLY OWED, (II) CUSTOMER’S INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, AND (III) VIOLATIONS OF PUPPET’S INTELLECTUAL PROPERTY RIGHTS, (A) IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY, WHETHER UNDER THEORY OF CONTRACT, TORT OR OTHERWISE, FOR ANY INDIRECT, INCIDENTAL, PUNITIVE, CONSEQUENTIAL, OR SPECIAL DAMAGES, ANY DAMAGE TO BUSINESS REPUTATION, LOST PROFITS OR LOST DATA, WHETHER FORESEEABLE OR NOT AND WHETHER PUPPET IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND (B) EACH PARTY’S AGGREGATE CUMULATIVE LIABILITY TO THE OTHER IN CONNECTION WITH THESE TERMS (INCLUDING ANY RELATED AGREEMENT) SHALL NOT EXCEED THE GREATER OF ONE HUNDRED US DOLLARS ($100), OR THE AMOUNTS PAID OR PAYABLE BY CUSTOMER TO PUPPET IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO LIABILITY. THESE LIMITS APPLY REGARDLESS OF THE FORM OF CLAIM (CONTRACT, TORT OR OTHERWISE) AND EVEN IF THIS SECTION IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR OTHER DAMAGES, SO THE ABOVE LIMITATIONS OR EXCLUSIONS MAY NOT APPLY. IN SUCH EVENT, LIABILITY WILL BE LIMITED TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW.
You agree to indemnify and hold Puppet, its subsidiaries, and affiliates, and their respective officers, agents, partners and employees, harmless from any loss, liability, cost, expense, claim, or demand, including without limitation, reasonable attorneys’ fees, due or relating to or arising out of your use of the Services in violation of the Agreement and/or arising out of or relating to any Customer Content that is uploaded or processed via the Services under your account.

10.0 MISCELLANEOUS.
10.1 The parties are independent contractors with respect to each other, and nothing in this Agreement shall be construed as creating an employer-employee relationship, a partnership, agency relationship or a joint venture between the parties.
10.2 Each party will be excused from any delay or failure in performance hereunder, other than the payment of money, caused by reason of any occurrence or contingency beyond its reasonable control, including but not limited to acts of God, earthquake, labor disputes and strikes, riots, war and governmental requirements (each a “Force Majeure Event“). The obligations and rights of the party so excused will be extended on a day to day basis for the duration of the Force Majeure Event.
10.3 This Agreement applies to each party’s users, representatives, officers, agents, employees and associated individuals. This Agreement shall be binding on the parties, and all successors to the foregoing. Neither party will assign, transfer or delegate its rights or obligations under this Agreement (in whole or in part) without the other party’s prior written consent except pursuant to a transfer of all or substantially all of such party’s business and assets, whether by merger, sale of assets, sale of stock, or otherwise. Any attempted assignment, transfer or delegation in violation of the foregoing shall be null and void.
10.4 All modifications to or waivers of any terms of this Agreement must be in a writing that is signed by the parties hereto and expressly references this Agreement.
10.5 This Agreement shall be governed by the laws of the State of Oregon, without regard to its conflict of laws rules. The exclusive venue and jurisdiction for any and all disputes, claims and controversies arising from or relating to this Agreement shall be the state or federal courts located in Multnomah County, Oregon. Each party waives any objection (on the grounds of lack of jurisdiction, forum non conveniens or otherwise) to the exercise of such jurisdiction over it by any such courts. The United Nations Convention on Contracts for the International Sale of Goods will not apply to the interpretation or enforcement of this Agreement. In the event that any provision of this Agreement conflicts with governing law or if any provision is held to be null, void or otherwise ineffective or invalid by a court of competent jurisdiction, (a) such provision shall be deemed to be restated to reflect as nearly as possible the original intentions of the parties in accordance with applicable law, and (b) the remaining terms, provisions, covenants and restrictions of this Agreement shall remain in full force and effect.
10.6 No waiver of any breach of any provision of this Agreement shall constitute a waiver of any prior, concurrent or subsequent breach of the same or any other provisions hereof, and no waiver shall be effective unless made in writing and signed by an authorized representative of the waiving party.
This Agreement, including any documents referenced herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements or communications, including, without limitation, any quotations or proposals submitted by Puppet. The terms on any purchase order or similar document submitted by Customer to Puppet will have no effect and are hereby rejected. Unless otherwise expressly stated, all legal notices, consents and approvals under this Agreement must be delivered in writing by courier, by facsimile, or by certified or registered mail, (postage prepaid and return receipt requested) to the other party at its official headquarters to the attention of the chief legal officer and are deemed delivered when received.
The Services are a “commercial item,” as that term is defined at 48 C.F.R. 2.101 (OCT 1995), and more specifically is “commercial computer software” and “commercial computer software documentation,” as such terms are used in 48 C.F.R. 12.212 (SEPT 1995). Consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4 (JUNE 1995), the Hosted Service is made available to U.S. Government End Users (i) only as a commercial end item and (ii) with only those rights as are granted to all other end users pursuant to the terms and conditions herein.

Effective April 4, 2021


Puppet Relay Data Protection Addendum

This Data Processing Addendum (“DPA“) is incorporated into and forms part of the Relay by Puppet Terms of Service between Puppet, Inc., and Customer with respect to use of the Relay by Puppet Services (the “Agreement“). This DPA sets out the requirements for Puppet’s processing of Personal Data on behalf of Customer for the purposes of providing the Services.

1. Definitions
Adequate Country” means a country or territory recognised as providing an adequate level of protection for Personal Data under an adequacy decision made, from time to time, by (as applicable) (i) the Information Commissioner’s Office and/or under applicable UK law (including the UK GDPR), or (ii) the European Commission under the GDPR.
Data Protection Laws” means:

  • (a) in the European Union, the General Data Protection Regulation 2016/679 (the “GDPR“),
  • (b) in the UK, the UK General Data Protection Regulation 2016/679, as implemented by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (the “UK GDPR“), the Data Protection Act 2018, and the Privacy and Electronic Communications Directive 2002/58/EC (as the same may be superseded by the Regulation on Privacy and Electronic Communications,(“ePrivacy Regulation“)),

Data Subject Request” means a request from or on behalf of a data subject to exercise any rights in relation to their Personal Data under Data Protection Laws.
EEA” means the European Economic Area and Switzerland.
Model Clauses” means the model clauses for the transfer of personal data to processors established in third countries approved by the European Commission, the approved version of which is set out in the European Commission’s Decision 2010/87/EU of 5 February 2010 and at http://eur-lex.europa.eu/ and which along with the Appendices to the Model Clauses included in Schedule 1 to this DPA, form a part of this DPA (and as replaced or updated from time to time);
Personal Data” means all personal data which is uploaded into the Services by Customer and accessed, stored or otherwise processed by Puppet as a processor.
Security Breach” means any breach of security or other action or inaction leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data by any of Puppet’s staff or sub-processors, or any other identified or unidentified third party;
Supervisory Authority” means in the UK, the Information Commissioner’s Office (“ICO”) (and, where applicable, the Secretary of State or the government), and in the EEA, an independent public authority established pursuant to the GDPR.
UK” means the United Kingdom.
controller“, “data subject“, “personal data” and “processor” have the meanings ascribed to them in the Data Protection Laws.
Any defined terms which are not defined in this DPA are as defined in the Agreement.

2. Roles & compliance with Data Protection Laws. Customer is the controller of Personal Data, and Puppet is the processor of Personal Data. Each party will comply (and will procure that any of its personnel comply and use commercially reasonable efforts to procure that its sub-processors comply), with Data Protection Laws applicable to Personal Data. As between the parties, Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which the Personal Data was acquired.

3. Description of Processing

3.1 Subject Matter of the Processing: Puppet’s provision of the Services to Customer.

3.2 Nature and Purposes of the Processing. The nature and purposes of the processing is the collection and storage of Personal Data pursuant to providing the Services to Customer.

3.3 Duration of Processing. Puppet will process the Personal Data for the duration of the Agreement, or until the processing is no longer necessary for the purposes.

3.4 Types of Data. Any Personal Data that Customer in its discretion uploads into the Services will be processed under this DPA.

3.5 Categories of Data Subjects. Data Subjects may include any end users (including without limitation employees, customers, or suppliers) about whom Personal Data is provided to Puppet via the Services by, or at the direction of, Customer.

3.6 Processing by Puppet. As a processor, Puppet will only process Personal Data (i) in order to provide the Services to Customer or (ii) per Customer’s instructions in writing or via the Services. Puppet will notify Customer (unless prohibited by applicable law) if it is required under applicable law to process Personal Data other than pursuant to Customer’s instructions. As soon as reasonably practicable upon becoming aware, inform the Customer if, in Puppet’s opinion, any instructions provided by the Customer under clause 3 infringe applicable Data Protection Laws. Upon termination of the Agreement and upon written request of the Customer, return or delete the Personal Data, unless required by law to continue to store a copy of the Personal Data.

4. Technical and organisational security measures
4.1 Puppet will implement appropriate technical and organizational measures of security appropriate to the risks that are presented by the processing of Personal Data, in particular protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data as set out in Schedule 2.

4.2 Puppet will take reasonable steps to ensure that only authorised personnel have access to Personal Data and that any persons whom it authorizes to access the Personal Data are under obligations of confidentiality.

 

5. Security Breaches, Data Subject Requests & Further Assistance

5.1 Security Breaches. Puppet will notify Customer of any Security Breach without undue delay.

5.2 Data Subject Requests. To the extent legally permitted, Puppet will promptly notify Customer if it receives a Data Subject Request. Puppet will not respond to a Data Subject Request, provided that Customer agrees Puppet may at its discretion respond to confirm that such request relates to Customer. Customer acknowledges and agrees that the Services may include features which will allow Customer to manage Data Subject Requests directly through the Services without additional assistance from Puppet. If Customer does not have the ability to address a Data Subject Request, Puppet will, upon Customer’s written request, provide reasonable assistance to facilitate Customer’s response to the Data Subject Request to the extent such assistance is consistent with applicable law; provided that Customer will be responsible for paying for any costs incurred or fees charged by Puppet for providing such assistance.

5.3 Further Assistance. Taking into account the nature of processing and the information available to Puppet, Puppet will provide such assistance as Customer reasonably requests in relation to Customer’s obligations under Data Protection Laws with respect to (i) data protection impact assessments, (ii) notifications to the Supervisory Authority under Data Protection Laws and/or communications to data subjects by the Customer in response to a Security Breach, or (iii) Customer’s compliance with its obligations under the GDPR or UK GDPR (as applicable) with respect to the security of processing. Customer will pay any costs or fees charged by Puppet for providing the assistance in this Section 5.3.

6. Sub-processing
6.1 Customer grants a general authorisation to Puppet to appoint its Affiliates or third parties as sub-processors to support the performance of the Services, including data centre operators, cloud-based software providers, and other outsourced support and service providers. Puppet will maintain a list of sub-processors, will provide Customer with such list promptly on request and will add the names of new and replacement sub-processors to the list prior to them starting sub-processing of Personal Data. If Customer has a reasonable objection to any new or replacement sub-processor, it shall notify Puppet of such objections in writing within 15 days of the notification and the parties will seek to resolve the matter in good faith. If Customer is not reasonably satisfied that the sub-processor meets the security and privacy protections set forth in this Addendum then Customer as its sole remedy may, within such 15 day period, terminate the Relay Terms of Service. Puppet may use a new or replacement sub-processor whilst the objection procedure in this clause 6.1 is in process.

6.2. Puppet will enter into a written contract with each sub-processor which imposes on such sub-processor terms no less protective of Personal Data than those imposed on Puppet in this DPA (the “Relevant Terms“). Puppet shall be liable to Customer for any breach by such sub-processor of any of the Relevant Terms to the extent required under Data Protection Law.

7. International Transfers
7.1 Customer agrees that its use of the Services will involve the transfer of Personal Data to, and processing of Personal Data in, locations outside of the UK and/or EEA from time to time, such as for purposes of providing support to Customer, including processing in the United States.

7.2 To the extent Puppet processes Personal Data outside the UK or EEA (except if in an Adequate Country), the parties agree that the Model Clauses will apply and are incorporated into this DPA, and Puppet is the ‘data importer’ and will comply with the obligations of the ‘data importer’ in the Model Clauses accordingly and Customer is the ‘data exporter’ and will comply with the obligations of the ‘data exporter’ accordingly. The following terms shall apply to the Model Clauses: (a) Annexes 1 & 2 in Schedule 1 of this DPA contain the information required by Annexes 1 & 2 of the Model Clauses; (b) Customer may exercise its right of audit under clause 5(f) of the Model Clauses as set out in, and subject to the requirements of, clause 8 of this DPA; (c) Puppet may appoint sub-processors as set out, and subject to the requirements of, clause 6 of this DPA; and (d) Puppet may (i) replace the Model Clauses generally or in respect of the UK and/or the EEA only (as appropriate) with any alternative or replacement transfer mechanism in compliance with applicable Data Protection Laws, including any further or alternative standard contractual clauses approved from time to time and (ii) make reasonably necessary changes to this clause 7 by notifying Customer of the new transfer mechanism or content of the new standard contractual clauses (provided their content is in compliance with the relevant decision or approval), as applicable.

8. Audit and Records
Puppet shall make available to the Customer such information in Puppet’s possession or control as Customer may reasonably request with a view to demonstrating Puppet’s compliance with the obligations of data processors under Data Protection Law in relation to its processing of Personal Data.

9. General
9.1 Conflicts. This DPA is without prejudice to the rights and obligations of the parties under the Agreement which shall continue to have full force and effect. In the event of any conflict between the terms of this DPA and the terms of the Agreement, the terms (including definitions) of this DPA shall prevail so far as the subject matter concerns the processing of Personal Data. This DPA sets out all of the terms that have been agreed between the parties in relation to the subjects covered by it. Other than in respect of statements made fraudulently, no other representations or terms shall apply or form part of this DPA.

9.2 Limitation of Liability. Puppet’s maximum aggregate liability to Customer under or in connection with this DPA shall not under any circumstances exceed the maximum aggregate liability of Puppet to the Customer as set out in the Agreement. Nothing in this DPA will limit Puppet’s liability in respect of personal injury or death in negligence or for any other liability or loss which may not be limited by agreement under applicable law.

9.3 Governing Law; Venue. Without prejudice to the provisions of the Model Clauses addressing the law which governs them, this DPA shall be governed by and construed in accordance with the laws which govern the Agreement and the venue(s) for disputes and claims under the Agreement shall also apply to disputes and claims under this DPA.

SCHEDULE 1 -Appendices to the Model Clauses
Appendix 1 to the Model Clauses

This Appendix forms part of the Clauses and must be completed by the parties.

Data exporter: The data exporter is the Customer. Data importer: The data importer is Puppet who provides the Services as part of which it processes Personal Data in accordance with Customer’s instructions. Description of data processing: Section 4 of this DPA describes the categories of data subjects, categories of data, special categories of data and processing operations.

Appendix 2 to the Model Clauses

This Appendix forms part of the Clauses and must be completed by the parties.
Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Please see Schedule 2 of this DPA.

SCHEDULE 2 – SECURITY MEASURES

Please see Puppet’s Relay Security Overview https://relay.sh/security/.

Puppet sites use proprietary and third-party cookies. By using our sites, you agree to our cookie policy.