ScyllaDB powers real-time AI with low latency, high throughput, and billion-scale data.
Learn MoreLast Updated March 15, 2026
2. SCOPE & PARTIES’ ROLE
2.1. The parties agree and acknowledge that Customer Personal Data is Processed by ScyllaDB as the Processor on behalf of Customer, who may act as a Controller or a Processor on behalf of third-party Controllers. For the avoidance of doubt, it is hereby clarified that ScyllaDB is the Controller of the information collected in connection with the creation of Customer’s account enabling access to the Services, including for direct marketing purposes; data relating to the use of the Services and the account by the Customer and its users, and; records of technical or other support provided to Customer. Such data is processed by ScyllaDB as set forth and in accordance with ScyllaDB Privacy Policy.
2.2. The Customer shall be exclusively responsible to ensure its Instructions are compliant with applicable Data Protection Laws and enable a lawful Processing of Customer Personal Data, including by obtaining any required consent and providing any required disclosures under applicable Data Protection Laws.
2.3. The subject matter and duration of the Processing carried out by ScyllaDB on behalf of the Customer, the nature and purpose of the Processing, the type of Personal Data and categories of Data Subjects are described in Annex I attached hereto.
2.4. If any Customer Personal Data includes Sensitive Data or any Personal Data that is deemed by regulatory authorities as meriting sensitive treatment under Data Protection Laws, it is Customer’s responsibility to inform ScyllaDB prior to enabling Processing by ScyllaDB, and to determine if additional security measures are required. In such an event, the parties shall negotiate any needed adjustments and in the event ScyllaDB approves its ability to implement the measures required by Customer, such shall be implemented at Customer’s expense. For avoidance of doubt, ScyllaDB does not monitor, and review Customer Personal Data uploaded to the Services, thus, cannot be aware of any sensitivity within Customer Personal Data.
3. PROCESSING OF PERSONAL DATA
3.1. ScyllaDB represents and warrants that it shall Process Customer Personal Data, on behalf of the Customer, solely as reasonably needed to provide the Service, in accordance with Customer’s Instructions. Notwithstanding the above, in the event ScyllaDB is required under applicable laws, including Data Protection Law, to Process Customer Personal Data other than as instructed by Customer, ScyllaDB shall make reasonable efforts to inform the Customer of such requirement prior to Processing such Customer Personal Data, unless prohibited under applicable law.
3.2. The parties hereby acknowledge and agree that ScyllaDB does not receive or Process Customer Personal Data as consideration for the Services and that Processing of Customer Personal Data is and shall be made solely for a Business Purpose specified in the Agreement. ScyllaDB shall not: (i) Sell or Share Customer Personal Data; (ii) retain, use or disclose the Customer Personal Data for any purpose other than for a Business Purpose; or (iii) combine the Customer Personal Data with other Personal Data that it receives from, or on behalf of another customer.
3.3. ScyllaDB shall: (i) inform Customer in the event that according to ScyllaDB’s reasonable discretion, Customer’s Instructions infringe applicable Data Protection Laws, and ScyllaDB shall have the right to immediately cease and suspend any such Processing related to the infringing Instruction until such infringement is cured without liability to the Customer and without prejudice to any fees incurred by Customer; (ii) notify the Customer if it determines that it can no longer meet its obligations under this DPA or applicable Data Protection Law; (iii) comply with its respective obligations under applicable Data Protection Laws with regards to processing of de-identified data; and (iv) provide reasonable cooperation and assistance to the Customer in ensuring compliance with its obligation to carry out data protection impact assessments and prior consultations with Supervisory Authorities or other competent data privacy authorities to the extent required under applicable Data Protection Laws; (v) ensure the reliability of its staff and any other person acting under its supervision who have access to and Process Customer Personal Data; and ensure that persons authorized to Process the Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4. DATA SUBJECTS RIGHTS AND LEGAL REQUEST
4.1. It is agreed that where ScyllaDB receives a request from a Data Subject for exercising a data subject’s rights or an applicable authority in respect of Customer Personal Data, ScyllaDB will notify the Customer of such request and direct the Data Subject or the applicable authority to the Customer in order to enable the Customer to respond directly, unless prevented or otherwise required under applicable laws.
4.2. ScyllaDB shall provide Customer with reasonable cooperation and assistance to enable Customer to respond to such Data Subject’s or applicable authority’s request, provided that the Customer cannot reasonably fulfill such obligations independently with the help of information available in the Services’ documentation or any other self-service feature provided by ScyllaDB.
5. SUB-PROCESSING
5.1. Customer acknowledges and agrees that ScyllaDB may engage third-party Processors (“Sub-Processors”) that will process Customer Personal Data to provide certain services. ScyllaDB shall enter into a written agreement with each Sub-Processor containing, in substance, data protection obligations no less protective than those in the Agreement with respect to the protection of Personal Data to the extent applicable to the nature of the Services provided by such Sub-Processor.
5.2. The Sub-Processors engaged in Processing of Personal Data (and depending on the Services, may Process Customer Personal Data), including a description of their processing activities and countries of location, are attached herein as Annex III, and are hereby approved by Customer. ScyllaDB may engage an additional Sub-Processor or replace an existing Sub-Processor at any time at its discretion, provided that any such addition or replacement shall be updated by ScyllaDB within a reasonable time on ScyllaDB’s website before the update enters into effect. The Customer may object to the new Sub-Processor, solely on reasonable grounds related to compliance with Data Protection Laws, by providing written notification to ScyllaDB at: [email protected], within up to 30 days as of ScyllaDB’s notice. In the event the Customer objects within the aforesaid period, ScyllaDB may, under ScyllaDB’s sole discretion, suggest the engagement of a different Sub-Processor or continues use of the Services without Processing by the new Sub-Processor, or otherwise enable the Customer to terminate the Agreement where the Services cannot be reasonably provided under such circumstances, without liability to Customer. In case the Customer has not objected during the aforesaid period, such Sub-Processor shall be deemed approved by the Customer.
5.3. ScyllaDB shall remain liable for the acts and omissions of its Sub-Processors in breach of this DPA to the same extent ScyllaDB would be liable if performing the services of each Sub-Processor directly under the terms of this DPA, in accordance and subject to its responsibility and liability under the Agreement.
6. TECHNICAL AND ORGANIZATIONAL MEASURES
6.1. ScyllaDB shall maintain appropriate technical and organizational measures for protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data, and the confidentiality and integrity of Customer Personal Data.
6.2. ScyllaDB’s current technical and organizational measures are described under Annex II to this DPA, as updated from time to time (provided that any such amendments will not materially decrease the overall security of the Services during an engagement term).
7. SECURITY INCIDENT
7.1. ScyllaDB shall notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. ScyllaDB shall take such steps as are reasonably necessary to contain, investigate, remediate and mitigate the effects of the Personal Data Breach and to identify its cause. Upon Customer’s written request, ScyllaDB shall reasonably cooperate with Customer and provide reasonable assistance and information in connection with the containment, investigation, remediation and mitigation of the Personal Data Breach and, where applicable, Customer’s obligations to notify the competent supervisory authority and affected Data Subjects, to the extent such information is available to ScyllaDB and may be disclosed under applicable law.
7.2. ScyllaDB’s notification of, or compliance with, its obligations under this Section shall not be construed as an admission of fault, liability, or wrongdoing with respect to the Personal Data Breach.
8. AUDIT RIGHTS
8.1. ScyllaDB shall maintain records of the Processing activities carried out under this DPA and its compliance with its obligations under this DPA, and shall make such records available to the Customer, upon Customer’s thirty (30) days prior written request, however no more than once per twelve (12) months of engagement (“Audit Reports”). For the purpose of this section, a summary of the SOCII report or similar certification, as well as information provided through Customer’s questionnaire shall be defined as a sufficient Audit Report. The Audit Report provided shall be constructed as ScyllaDB’s Confidential Information and shall be subject to the corresponding confidentiality obligations under the Agreement or require signed a non-disclosure agreement.
8.2. In the event the Audit Report provided subject to Section 8.1 above are reasonably determined as not sufficient for the purpose of demonstrating compliance, ScyllaDB shall make available, subject to a thirty (30) days prior written request and no more than once per twelve (12) months of engagement, to a reputable auditor nominated by the Customer, information necessary to reasonably demonstrate compliance with this DPA, and shall allow for audits, including inspections, by such reputable auditor solely in relation to the Processing of the Customer Personal Data (“Audit”) in accordance with the terms and conditions hereunder. The auditor shall be subject to standard confidentiality obligations (including towards third parties). ScyllaDB may object to an auditor appointed by the Customer in the event ScyllaDB reasonably determines the auditor is not suitably qualified or is a competitor of ScyllaDB. The Customer shall bear all expenses related to the Audit and shall (and ensure that each of its auditors shall) over the course of such Audit, avoid causing any damage, injury or disruption to ScyllaDB, including its business operation and personnel. Audit documentations and results shall remain confidential by the Customer.
8.3. Nothing in this DPA will require ScyllaDB to disclose or to allow access to: (i) any data of any other ScyllaDB’s customer or ScyllaDB’s internal data including without limitation data processed in ScyllaDB’s role as a Controller, internal accounting or financial information; (ii) any trade secret of ScyllaDB or its affiliates; (iii) any information that, in ScyllaDB’s reasonable opinion, could compromise the security of any systems or cause any breach of its obligations under applicable law or its security, privacy or confidentiality obligations to any third party; or (iv) any information that the Customer or its third-party auditor seeks to access for any reason other than the good faith fulfillment of Customer’s obligations under the Data Protection Laws. No access to any part of ScyllaDB’s IT systems or infrastructure (including, without limitation, any hands-on or intrusive testing) will be permitted.
9. CROSS BORDER PERSONAL DATA TRANSFERS
9.1. ScyllaDB participates in and certifies compliance with the Data Privacy Framework. As required by the Data Privacy Framework, ScyllaDB (i) provides at least the same level of privacy protection as is required by the Data Privacy Framework Principles; (ii) will provide notification if ScyllaDB makes a determination it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Framework Principles, and (iii) will, upon written notice, take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.
9.2. Customer acknowledges and agrees that for the provisions of the Services, ScyllaDB may Process, including transfer, Customer Data on various jurisdictions where ScyllaDB or Sub-Processors operate. ScyllaDB will ensure that transfers are made in compliance with Data Protection Laws.
9.3. Where European Data Protection Laws apply ScyllaDB will not transfer Customer Personal Data originating from the EEA, the UK or Switzerland, unless it takes all such measures as are necessary to ensure the transfer is in compliance with European Data Protection Laws. Such measures may include (without limitation): (i) transferring such Customer Personal Data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, including to an Adequate Country or data privacy and transfer frameworks; (ii) to a recipient that has achieved binding corporate rules authorization in accordance with applicable Data Protection Law; or (iii) to a recipient that has executed the Standard Contractual Clauses.
9.4. When Customer and ScyllaDB rely on the Standard Contractual Clauses to facilitate a transfer to a third country the following shall apply:
(i) For transfers of Customer Personal Data from the EEA, the EU SCC shall apply and completed as follows: (1) Module II (Controller to Processors) will apply; (2) in Clause 7 the optional docking clause will not apply; (3) in Clause 9, option 2 (general written authorization) shall apply for the Sub-Processors, and the method for appointing Sub-Processor shall be as set forth in the Sub-Processing Section of the DPA; (4) in Clause 11, the optional language will not apply, and Data Subjects shall not be able to lodge a complaint with an independent dispute resolution body; (5) in Clause 17, option 1 shall apply, and the EU SCC shall be governed by the law of the Republic of Ireland; (6) in Clause 18(b) the parties choose the competent courts of the Republic of Ireland, as their choice of forum and jurisdiction; (7) Annex I(A) of the EU SCC is completed as follows: Customer is the Data Exporter, ScyllaDB is the Data Importer, the parties’ contact details are as completed under the Agreement; (8) Annex I(B) of the EU SCC is completed as set out in Annex I of this DPA; (9) Annex I(C) of the EU SCC shall identify the competent supervisory authority/ies as the supervisory authority of Republic of Ireland; (10) Annex II of the EU SCC is deemed completed with the information set out in Annex II of this DPA; (11) Annex III of the EU SCC shall be completed with the Sub-Processors.
(ii) For transfer of Customer Personal Data from the UK, the UK SCC shall apply and completed as follows: (1) Table 1 shall be completed as set forth in section (i)(7) above; (2) Table 2 shall be completed as set forth in Section (i)(1) – (i)(4) above; (3) Tables 3 shall be completed as follows: Annex 1A shall be completed with relevant information as set out in Section (i)(7) above; Annex 1B shall be completed with relevant information as set out in Annex I of this DPA; Annex II shall be completed with relevant information as set out in Annex II of this DPA; Annex III shall be completed with the Sub-Processors; (4) Table 4 shall be completed with the “neither party” option; and (5) Any conflict between the terms of the EU SCC and the UK SCC will be resolved in accordance with Section 10 and Section 11 of the UK SCC.
(iii) For transfer of Customer Personal Data from Switzerland, the Swiss SCC shall apply in accordance with the terms as set forth in Section (i) above with the following modifications (1) references to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss DPA; (2) references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and (3) references to the “competent supervisory authority” and “competent courts” will be replaced with the “the Swiss Federal Data Protection and Information Commissioner” and the “relevant courts in Switzerland”.
10. TERM, TERMINATION AND DELETION
10.1. DPA shall be effective as of the Agreement’s effective date and terminate upon expiration or earlier termination of the Agreement.
10.2. During the term of the Services the Customer has full control, self-service features available through the Services to delete, correct, access the Customer Personal Data at any time. Following the termination or expiration of this DPA, ScyllaDB shall delete Customer Personal Data Processed in accordance with its standard backup or record retention policies. Notwithstanding the foregoing, ScyllaDB may retain Customer Personal Data in the event as required under applicable laws. In any event, ScyllaDB will maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to retained Customer Personal Data and not further Process it except as required by Data Protection Law.
11. CONFLICT; ORDER OF PRECEDENCE
In the event of any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of such conflict with respect to its subject matter. Where the parties have executed Standard Contractual Clauses, the Standard Contractual Clauses shall prevail over this DPA to the extent of any inconsistency. Except as expressly set forth herein, all terms and conditions of the Agreement remain in full force and effect.
ANNEX I
DETAILS OF PROCESSING
This Annex I include certain details of the Processing of Customer Personal Data as required under Data Protection Laws.
Categories of Data Subjects:
Customer may submit Personal Data to the Service, the extent of which is determined and controlled by Customer in its sole discretion.
Categories of Personal Data:
Customer may submit Personal Data to the Service, the extent of which is determined and controlled by Customer in its sole discretion.
Special Categories of Personal Data:
Customer is specifically prohibited from providing ScyllaDB any Sensitive Data or Special Categories of Data, unless agreed in writing by ScyllaDB.
Nature of the Processing:
Storage, organization, transfer, host and other types of Processing for the purpose of providing the Services as set out in the Agreement.
Purpose(s) of Processing:
To provide the Services.
Retention Period:
For as long as is necessary to provide the Service by ScyllaDB; provided there is no legal obligation to retain the Customer Personal Data post termination or unless otherwise requested or independently deleted by the Customer.
Process Frequency:
Continuous basis
ANNEX II
TECHNICAL AND ORGANIZATIONAL MEASURES
The following description reviews the technical and organizational measures implemented by ScyllaDB to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the Processing, and the risks for the rights and freedoms of natural persons.
1. System Control
Access to the ScyllaDB’s database is highly restricted in order to ensure that only the relevant personnel who have received prior approval can access the database. ScyllaDB has also implemented appropriate safeguards related to remote access and wireless computing capabilities. Employees are required to choose unique and complex passwords that allow strict access or use, all in accordance with such an employee’s position, and solely to the extent such access or use is required. There is constant monitoring of access to the Personal Data and the passwords used to gain access. ScyllaDB is using automated tools to identify non-human login attempts and rate-limiting login attempts to minimize the risk of a brute force attack, in addition multi-factor authentication is enforced.
2. Data Access Control
User authentication measures have been put in place to ensure that access to Customer Personal Data is restricted solely to those employees who have been given permission. Any access requires a password and a second authentication factor, as well as blocked when applicable. Each employee is able to perform actions solely in accordance with the permissions granted to him by ScyllaDB. ScyllaDB revokes access immediately upon termination of employment.
3. Physical Access Control
ScyllaDB recognizes the significance of physical security controls as a key component in its overall security program. Physical access methods, procedures and controls have been implemented to help prevent unauthorized access to data, assets and restricted areas. Processes are in place to remove access to physical resources when an individual no longer requires access. Physical access to ScyllaDB office does not provide any privileges to the production environment.
4. Organizational and Operational Security
ScyllaDB puts a lot of effort and invests a lot of resources into ensuring that ScyllaDB’s security policies and practices are being complied with, including by continuously providing its staff members with training with respect to such security policies and practices. ScyllaDB strives to raise awareness regarding the risks involved in the processing of Personal Data. In addition, ScyllaDB has implemented applicable safeguards for its hardware and software, including by installing firewalls and anti-virus software on applicable ScyllaDB hardware and software, in order to protect against malicious software.
5. Availability Control
ScyllaDB maintains backup policies and associated measures. Such backup policies include permanent monitoring of operational parameters as relevant to the backup operations. Furthermore, ScyllaDB’s servers include an automated backup procedure. ScyllaDB also conducts regular controls of the condition and labelling of data storage devices for data security. ScyllaDB ensures that regular checks are carried out to determine whether it is possible to undo the backup, as required and applicable.
6. Penetration Testing
External penetration test is performed on an annual basis. The penetration tests include, among others, procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own. The penetration tests and security scans are performed by a reputable third-party vendor. In addition, ScyllaDB conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment. Actions are taken to remediate identified deficiencies on a timely basis.
7. Encryption
ScyllaDB implements encryption at rest of Customer Personal Data as well as encryption in transit of all communication on and to the service, as well as communication between elements in the Services. In some cases, encryption is based on underlying cloud provider services, in some cases it is implemented as part of ScyllaDB Enterprise. Encryption between ScyllaDB customers and the ScyllaDB application is enabled using a minimum HTTPS TLS 1.2 authenticated tunnel.
8. Compliance and Certification
ScyllaDB operations, policies and procedures are audited regularly to ensure ScyllaDB meets all standards expected as a cloud system provider. Compliance certifications and attestations are assessed by a third-party, independent auditor and result in a certification, audit report, or attestation of compliance. ScyllaDB is SOC2 certified, as well as ISO 27001:2013, ISO 27017:2015 and ISO 27018:2019. For more information please see our SOC2 webpage here.
ANNEX III
LIST OF SUB-PROCESSORS
| Name | Processing region | Description of the Processing | Transfer mechanism |
| Microsoft Azure | USA | Cloud Services | SCC, or Data Privacy Framework, as applicable |
| Google Could Platform LLC | USA | Cloud Services | SCC, or Data Privacy Framework, as applicable |
| Amazon Web Services Inc. | USA and Ireland | Cloud Services | SCC, or Data Privacy Framework, as applicable |
Last Updated – March 2026
ANNEX IV
EU INTERNATIONAL TRANSFERS AND SCC
1. The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to transfer of Personal Data from the EEA to other countries that are not deemed as Adequate Countries.
2. Module Two (Controller to Processor) of the Standard Contractual Clauses shall apply where the transfer is effectuated by Customer as the Controller of the Customer Data and ScyllaDB is the Processor of the Customer Data.
3. The Parties agree that for the purpose of transfer of Personal Data between Customer (as Data Exporter) and the ScyllaDB (as Data Importer), the following shall apply:
a) Clause 7 of the Standard Contractual Clauses shall not be applicable.
b) In Clause 9, option 2 (general written authorization) shall apply and the method for appointing and time period for prior notice of Sub-processor changes shall be as set forth in the Sub-Processing Section of the DPA.
c) In Clause 11, the optional language will not apply, and data subjects shall not be able to lodge a complaint with an independent dispute resolution body.
d) In Clause 17, option 1 shall apply. The parties agree that the Standard Contractual Clauses shall be governed by the laws of the EU Member State in which the Customer is established (where applicable).
e) In Clause 18(b) the parties choose the courts of the Republic of Ireland, as their choice of forum and jurisdiction.
4. Annex I.A of the Standard Contractual Clauses shall be completed as follows:
4.a.1. “Data Exporter“: Customer
4.a.2. “Data Importer“: ScyllaDB
4.a.3. Roles: (A) With respect to Module Two: (i) Data Exporter is a data controller and (ii) the Data Importer is a data processor.
4.a.4. Data Exporter and Data Importer Contact details: As detailed in the Agreement.
4.a.5. Signature and Date: By entering into the Agreement and DPA, Data Exporter and Data Importer are deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
5. Annex I.B of the Standard Contractual Clauses shall be completed as follows:
a) The purpose of the processing, nature of the processing, categories of data subjects, categories of personal data and the parties’ intention with respect to the transfer of special categories are as described in Annex I (Details of Processing) of this DPA.
b) The frequency of the transfer and the retention period of the personal data is as described in Annex I (Details of Processing) of this DPA.
c) The sub-processor which personal data is transferred are listed in Annex III.
6. Annex I.C of the Standard Contractual Clauses shall be completed as follows: the competent supervisory authority in accordance with Clause 13 is the supervisory authority in the Member State stipulated in Section 3 above.
7. Annex II of this DPA (Technical and Organizational Measures) serves as Annex II of the Standard Contractual Clauses.
8. Annex III of this DPA (List of Sub-processors) serves as Annex III of the Standard Contractual Clauses.
9. Transfers to the US: Measures and assurances regarding US government surveillance (“Additional Safeguards”) are further detailed in Annex II.
ANNEX V
UK INTERNATIONAL TRANSFERS AND SCC
1. The parties agree that the terms of the Standard Contractual Clauses as amended by the UK Standard Contractual Clauses, and as amended in this Annex V, are hereby incorporated by reference and shall apply to transfer of Personal Data from the UK to other countries that are not deemed as Adequate Countries.
2. This Annex V is intended to provide appropriate safeguards for the purposes of transfers of Personal Data to a third country in reliance on Article 46 of the UK GDPR and with respect to data transfers from controllers to processors or from the processor to its sub-processors.
3. Terms used in this Annex V that are defined in the Standard Contractual Clauses, shall have the same meaning as in the Standard Contractual Clauses.
4. This Annex V shall (i) be read and interpreted in the light of the provisions of UK Data Protection Laws, and so that if fulfils the intention for it to provide the appropriate safeguards as required by Article 46 of the UK GDPR, and (ii) not be interpreted in a way that conflicts with rights and obligations provided for in UK Data Protection Laws.
5. Amendments to the UK Standard Contractual Clauses:
5.1. Part 1: Tables
5.1.1. Table 1 Parties: shall be completed as set forth in Section 4 within Annex IV above.
5.1.2. Table 2 Selected SCCs, Modules and Selected Clauses: shall be completed as set forth in Section 2 and 3 within Annex IV above.
5.1.3. Table 3 Appendix Information:
Annex 1A: List of Parties: shall be completed as set forth in Section 2 within Annex IV above.
Annex 1B: Description of Transfer: shall be completed as set forth in Annex I above.
Annex II: Technical and organizational measures including technical and organizational measures to ensure the security of the data: shall be completed as set forth in Annex II above.
Annex III: List of Sub processors: shall be completed as set forth in Annex III above.
5.1.4. Table 4 Ending this Addendum when the Approved Addendum Changes: shall be completed as “neither party”.
ANNEX VI
SUPPLEMENTARY TERMS FOR SWISS DATA PROTECTION LAW TRANSFERS ONLY
The following terms supplement the Clauses only if and to the extent the Clauses apply with respect to data transfers subject to Swiss Data Protection Law, and specifically the FDPA:
ANNEX VII
1. CCPA Specifications:
1.1. For the purpose of the CCPA, Customer is the Business and ScyllaDB is the Service Provider.
1.2. ScyllaDB shall Process Customer Data on behalf of the Customer as a Service Provider under the CCPA and shall not: (i) Sell or Share the Customer Data; (ii) retain, use or disclose the Customer Data for any purpose other than for a Business Purpose specified in the Agreement; or (iii) combine the Customer Data with other Personal Data that it receives from, or on behalf of, another customer, or collects from its own interaction with California residents, expect as otherwise permitted by the CCPA.
1.3. If, and to the extent applicable, ScyllaDB shall assist Customer in respect of a Consumer request to limit the use of its Sensitive Personal Information (“SPI”) by ScyllaDB.
1.4. ScyllaDB certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from Selling any Customer Data.
2. U.S. Applicable States Specifications:
2.1. For the purpose of this U.S. Addendum ”Applicable States” shall mean Virginia, California, Colorado, Utah and Connecticut.
2.2. ScyllaDB agrees to notify the Customer if ScyllaDB makes a determination that it can no longer meet its obligations under this U.S. Addendum or U.S. Data Protection Law.
2.3. ScyllaDB shall provide information necessary to enable Customer to conduct and document any data protection assessments required by U.S. Data Protection Laws. Notwithstanding the above, ScyllaDB is responsible for only the measures allocated to it.
2.4. ScyllaDB shall provide assistance and procures that its subcontractors will provide assistance, as Customer may reasonably request, where and to the extent applicable, in connection with any obligation by Customer to respond to Consumer’s requests for exercising their rights under the U.S. Data Protection Laws. Including without limitation, by taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s respective obligation. ScyllaDB acknowledges and confirms that it does not receive any monetary goods, payments or discounts in exchange for Processing the Customer Data.
2.5. Each party shall, taking into account the context of Processing, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The parties are hereby establishing a clear allocation of the responsibilities between them to implement these measures. ScyllaDB technical measures are detailed in the DPA and Annexes above.
2.6. The Processing instructions, including the nature of Processing, purpose of Processing, the duration of Processing, the type of Personal Data and categories of Data Subjects, are set forth in Annex I above.
2.7. Each party will comply with the requirements set forth under US Data Protection Laws with regards to processing of de-identified data; as such term is defined under the applicable U.S. Data Protection Law.
3. When Processing Customer Data or Usage Data (as defined in the Agreement) for the permitted purposes under U.S. Data Protection Laws, ScyllaDB shall ensure it complies with applicable laws and shall be liable for such Processing activities.
