This Data Processing Addendum (the “DPA”) is executed by and between you (“Customer”) and the GoDaddy legal entity that is a party to the Universal Terms of Service and any other agreements between you and GoDaddy (collectively, the "Agreement"). GoDaddy and Customer are referred to herein, individually, as a "Party", and collectively as the "Parties". This DPA is effective as of the effective date of the Agreement ("Effective Date") and governs all Processing of Customer Personal Data under the Agreement.
1. Definitions. Unless otherwise defined in applicable Data Protection Laws (as defined below), the capitalized terms listed in this Section have the following meanings:
1.1 “Affiliate” means any entity that controls or is under common control with a Party. “Control” means direct or indirect ownership or control of fifty percent (50%) or more of the voting interests of an entity.
1.2. “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing Customer Personal Data under the Agreement.
1.3 “Customer Personal Data” means any Personal Data (as defined below) processed by GoDaddy on Customer’s behalf in connection with Customer’s use of the Services. Customer Personal Data does not include GoDaddy Data.
1.4 “Data Protection Law” means any law or regulation applicable to processing of Customer Personal Data under the Agreement.
1.5 “Data Subject” means an identified or identifiable natural person to whom specific Personal Data relates.
1.6 “De-Identified Data” means data that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a specific Data Subject.
1.7 “GoDaddy Data” means (a) all information relating to GoDaddy’s business and delivery of the Services, including but not limited to Personal Data concerning Customer and its employees or representatives, (b) other data concerning or relating to Customer’s account, transaction history, use of the Services and identity verification, and (c) subject to any restrictions under any applicable Data Protection Laws, De-Identified Data.
1.8 “Personal Data” means information that relates to an identified or identifiable natural person, including any information defined as Personal Data, Personal Information, or Personally Identifiable Information (“PII”) in any applicable Data Protection Laws. Personal Data does not include De-Identified Data.
1.9 "Processor” means a natural or legal person, public authority, agency, or body that processes Customer Personal Data on behalf of a Controller under the Agreement.
1.10 "Processing” means any operation performed on Customer Personal Data, such as collection, use, storage, disclosure, analysis, deletion, or modification, whether by manual or automated means.
1.11 “Sensitive Personal Data” means (a) social security number, passport number, driver’s license number, or similar identifier; (b) credit or debit card information, financial information, bank account numbers, or account passwords; (c) employment, financial, genetic, biometric, or health information; (d) racial, ethnic, political or religious affiliation, trade union membership, or information about sexual life or orientation; (e) account passwords, mother’s maiden name, date of birth, and other similar information used to authenticate a user’s identity; (f) criminal history; (g) biometric data used to identify a specific person (e.g., fingerprints); or (h) any other information or combination of information that falls within the definitions of “special categories of data” under any applicable Data Protection Law.
1.12 "Services” means the products or services that GoDaddy has agreed to provide pursuant to the Agreement that involve processing of Customer Personal Data.
1.13 “Subprocessor” means any natural or legal person, public authority, agency, or body with whom GoDaddy contracts to process Customer Personal Data.
1.14 “Transfer” means (a) transfer of Customer Personal Data from Controller to Processor, whether by physical transfer or by granting access to Customer Personal Data held or otherwise controlled by Controller or (b) an onward transfer of Customer Personal Data from a Processor to a Subprocessor (and any subsequent onward transfer by a Subprocessor to another Subprocessor).
2. Scope of Data Processing and Relationship of Parties
2.1 Customer as Controller or Processor
2.1.1 Where Customer is a Controller, Customer (a) is solely responsible for determining the purposes and means of processing Customer Personal Data, (b) has all necessary authority, grounds, rights, and permissions to provide Customer Personal Data to GoDaddy, and (c) will comply with its obligations as a Controller under applicable Data Protection Laws.
2.1.2 Where Customer is a Processor, Customer (a) is solely responsible for complying with its agreement(s) with the data Controller(s) on whose behalf Customer is processing Customer Personal Data; (b) has all necessary permissions from the Controller to provide Customer Personal Data to GoDaddy, and (c) will comply with its obligations as a Processor under applicable Data Processing Laws.
2.1.3 Customer expressly acknowledges that GoDaddy is not responsible for determining which laws or regulations are applicable to Customer’s business. Customer is solely responsible for determining that the Services provided by GoDaddy and the terms of the Agreement and this DPA meet Customer’s business, contractual, and legal obligations. Customer also will ensure that Customer’s Processing instructions to GoDaddy do not violate any applicable Data Protection Laws.
2.2 GoDaddy as Processor or Subprocessor.
2.2.1 GoDaddy will take all steps reasonably necessary to enable Customer to comply with Customer’s obligations as a Controller and/or Processor under the Data Protection Laws consistent with the character, nature, scope, and purpose of the Services provided by GoDaddy. For the avoidance of doubt, GoDaddy is not required to undertake any steps to alter or make GoDaddy's Services compliant for Customer’s specific use. Customer’s sole remedy in the event the Services are determined to be not compliant for Customer’s specific use is termination of any portion of the Agreement that relates to processing of Customer Personal Data.
2.2.2 GoDaddy will process Customer Personal Data only upon documented instructions for the limited and specific purposes described in the Agreement, this DPA, or as required by law.
2.2.3 GoDaddy will not sell, retain, use, or disclose Customer Personal Data for a commercial purpose other than providing the Services.
2.2.4 GoDaddy will not Process Customer Personal Data outside of the Parties’ direct business relationship described in the Agreement and this DPA.
2.2.5 GoDaddy will not combine Customer Personal Data with any other data GoDaddy collects (directly or via any third party) other than as expressly permitted under the Agreement.
2.2.6 GoDaddy will stop all Processing and will notify Customer within three (3) business days if GoDaddy: (a) believes that a Customer instruction violates any applicable Data Processing Laws or (b) determines GoDaddy is unable to comply with any applicable Data Processing Laws or its obligations under this DPA.
2.3 Affiliates.
2.3.1 Customer Affiliates. For purposes of this DPA, any Personal Data provided to GoDaddy or GoDaddy's Affiliates by a Customer Affiliate for processing on Customer’s and/or Customer’s Affiliate’s behalf shall be deemed to be Customer Personal Data and to have been provided by Customer. Customer represents that it will take all measures reasonably necessary to ensure its Affiliates comply with all Customer obligations with respect to this DPA. Customer is responsible for its Affiliates’ compliance with all terms of this DPA.
2.3.2 GoDaddy Affiliates. For purposes of this DPA, any Customer Personal Data received by GoDaddy's Affiliates shall be deemed to have been received by GoDaddy. GoDaddy represents that it will take all measures reasonably necessary to ensure that its Affiliates comply with GoDaddy's obligations with respect to processing of Customer Personal Data under this DPA. GoDaddy is responsible for GoDaddy's Affiliates’ compliance with all terms of this DPA.
3. GoDaddy’s Use of Subprocessors
3.1 Customer provides general authorization for GoDaddy to engage subprocessors.
3.2 GoDaddy maintains information concerning its current Subprocessors in the following Subprocessor List
3.3 Before transferring Customer Personal Data to a Subprocessor, GoDaddy will: (a) enter into a written agreement with the Subprocessor that is at least as protective of Customer Data as this DPA; (b) conduct due diligence to confirm the Subprocessor can comply with the material terms of this DPA and the Data Protection Laws as they relate to GoDaddy’s processing of Customer Data, including the information security requirements of Sections 5, 6, and 8, and of Schedule 2 of this DPA.
3.4 GoDaddy is liable for its Subprocessors’ acts and omissions, including any acts or omissions of its Subprocessors’ subprocessors.
3.5 New Subprocessors; Right to Object.
3.5.1 GoDaddy will exercise reasonable efforts to notify Customer in writing at least sixty (60) days in advance if GoDaddy intends to appoint new a Subprocessor; provided, however, that sixty (60) days’ advance notice is not required and GoDaddy will notify Customer without undue delay after the appointment of a new Subprocessor if immediate appointment is required to maintain the security of Customer Personal Data or to comply with applicable law.
3.5.2 If Customer reasonably objects to a new Subprocessor, Customer must notify GoDaddy in writing within thirty (30) days after the Subprocessor’s appointment. In GoDaddy's sole discretion, GoDaddy may use commercially reasonable efforts to address Customer’s objection. If the Parties are unable to resolve Customer’s objection within thirty (30) days, Customer may terminate this DPA and any portion of the Agreement relating to the processing of Customer Personal Data.
3.5.3 If Customer does not object to a new Subprocessor within thirty (30) days of notice of Subprocessor’s appointment, Customer will be deemed to have accepted the new Subprocessor.
3.5.4 Notice of a new Subprocessor may be provided by updating the Subprocessor list described in Section 3.2.
4. Legal Process and Other Third Party Requests for Customer Personal Data
4.1 GoDaddy will not respond to any informal request for any Customer Personal Data from a government body, law enforcement agency, or other person except in response to a subpoena, search warrant, court order, or other similar legal process (collectively, “Legal Process”), unless such disclosure is determined by GoDaddy in its reasonable discretion to be (a) required by law, (b) necessary to protect GoDaddy's systems or data from harm or misuse, or (c) necessary to protect GoDaddy or any other person from damage or physical harm.
4.2 Unless prohibited by law, GoDaddy will notify Customer promptly if it receives any Legal Process that requires GoDaddy to provide access to or disclose Customer Personal Data.
4.3 Unless otherwise required by law, GoDaddy will cooperate with Customer (at Customer’s reasonable expense) in any efforts by Customer to prevent disclosure of Customer Personal Data in response to Legal Process.
5. Data Security
5.1 GoDaddy maintains an information security program that includes appropriate and documented technical and organizational measures to ensure a level of security appropriate to the risk of Processing Customer Personal Data under the Agreement, including any specific measures required by applicable Data Protection Laws.
5.2 Customer expressly acknowledges that GoDaddy provides security features and functionality that Customer can use to protect Customer Personal Data. Customer is solely responsible for taking appropriate risk-based steps to protect the security of Customer’s account and Customer Personal Data within Customer’s control, including by using security features and functionality provided by GoDaddy. Customer also is solely responsible for ensuring that all content that Customer places or causes to be placed within the Services is free of vulnerabilities that could result in the compromise of Customer Personal Data and GoDaddy’s systems, including but not limited to malicious software. GoDaddy is not responsible for backing up Customer Personal Data.
5.3 Customer is required to comply with all Payment Card Industry Data Security Standard Requirements (“PCI-DSS”) and may only provide GoDaddy with Customer Personal Data containing credit, debit or other payment cardholder information (“PCI-DSS Data”) in connection with GoDaddy Services specifically designed to Process such PCI-DSS Data. Customer is solely responsible for any violation of PCI-DSS requirements if Customer uses GoDaddy Services to process or store PCI-DSS Data outside of GoDaddy's PCI-DSS compliant Service offerings.
5.4 In addition to any measures required for GoDaddy to comply with its obligations under applicable Data Protection Laws and PCI-DSS Requirements for GoDaddy's PCI-DSS complaint Services, GoDaddy will implement the specific technical and organizational measures identified in Schedule 2 of this DPA.
6. Data Security Incidents
6.1 GoDaddy offers Customer extensive opportunities to access and control Customer Personal Data Processed on Customer’s behalf. GoDaddy is not responsible for any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data that does not result from a compromise of GoDaddy’s systems. Examples of Security Incidents for which GoDaddy is not responsible include Customer’s failure to maintain the secrecy of its passwords, downloading of malicious content, or any other security vulnerability caused by or introduced into the Services and Customer’s hosted environment by Customer.
6.2 GoDaddy will use commercially reasonable efforts to notify Customer of a breach of security of GoDaddy’s systems leading to the accidental or unlawful, destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (“Security Incident”) within the time period required under applicable law.
6.3 GoDaddy will take appropriate, risk-based steps that are reasonably necessary to contain, mitigate, and remediate a Security Incident without unreasonable delay.
6.4 GoDaddy will provide information reasonably requested by Customer to assess the impact of a Security Incident on Customer Personal Data and for Customer to provide notice of the Security Incident to governmental authorities, affected Data Subjects, or any other person.
6.5 GoDaddy’s acknowledgement of a Security Incident or decision to notify Customer of a Security Incident is not an admission of fault or liability.
7. Data Subject Rights
7.1 Customer is solely responsible for responding to any request to exercise a Data Subject’s rights under the Data Protection Laws, Customer’s privacy policies, or Customer’s terms of service, including but not limited to requests to know, access, correct, or delete Customer Personal Data (“Data Subject Requests”).
7.2 GoDaddy will not respond to a Data Subject Request except on documented instructions from Customer or as otherwise required under applicable law.
7.3 GoDaddy will notify Customer of any Data Subject Request. Customer is solely responsible for responding to any Data Subject request. If Customer has exhausted all means available to respond to a Data Subject Request – subject to Customer’s agreement to pay GoDaddy’s reasonable expenses in advance – GoDaddy will provide Customer with assistance reasonably necessary to allow Customer to respond to a Data Subject Request.
8. Data Protection Impact Assessments, Prior Consultation, and Compliance Inquiries
8.1 Data Protection Impact Assessments; Prior Consultation. At Customer’s expense, GoDaddy will provide reasonable assistance to Customer in conducting any data protection impact assessments and consultations with government authorities or regulators concerning processing of Customer Personal Data.
8.2 Compliance Inquiries. Customer may periodically request information reasonably necessary to confirm GoDaddy’s compliance with its obligations under applicable Data Protection Laws. If GoDaddy fails to respond to Customer’s request within forty-five (45) days, Customer may terminate the Agreement. For the avoidance of doubt, nothing in this DPA gives Customer the right to conduct an audit of GoDaddy’s business, systems, or services. GoDaddy’s obligation under this section is limited to providing Customer with information reasonably necessary to confirm that GoDaddy is in compliance with its obligations under applicable Data Protection Laws.
9. Jurisdiction Specific Requirements and International Transfers of Personal Data
9.1 Processing of Customer Personal Data under this DPA may involve Processing regulated by one or more Data Protection Laws and/or may involve the international transfer of Customer Personal Data.
9.2 If Customer Personal Data originates from the United States, the terms relating to the U.S. Data Protection Laws specified in Schedule 3 (Section 1) to this DPA apply.
9.3 If Customer Personal Data originates from the European Union/European Economic Area (“EU/EEA”), the United Kingdom (“UK”), or Switzerland, or if Customer is established in one or more of those jurisdictions, the terms relating to applicable EU/EEA, UK and/or Swiss Data Protection Laws specified in Schedule 3 (Sections 2 to 4) to this DPA apply.
9.4 If a valid international data transfer mechanism (“Mandatory Transfer Mechanism”) is required to lawfully Transfer Customer Personal Data, the terms specified in Schedule 4 to this DPA apply.
10. General
10.1 Complete Agreement; Interpretation. This DPA constitutes the entire agreement between the Parties concerning the subject matter of this DPA and supersedes all prior or contemporaneous representations, understandings, agreements, and communications between the Parties, whether written or verbal, regarding the subject matter of this DPA. In the event of a conflict between this DPA and the Agreement (or any other agreement between the Parties), this DPA will govern and control with respect to the subject matter of this DPA. If there is a conflict between any terms of this DPA and the Mandatory Transfer Provisions described in Schedule 4, those Mandatory Transfer Provisions shall prevail.
10.2 Amendment. This DPA may be modified or amended by GoDaddy in its sole discretion pursuant to the procedures set forth in the Agreement. If Customer disagrees with such amendment, Customer’s sole remedy is to terminate that portion of the Agreement relating to the Processing of Customer Personal Data on thirty (30) days’ notice. Unless expressly agreed by the Parties in writing, any amendment of this Agreement is effective only with respect to Processing that occurs after the date of such amendment.
10.3 Waiver. The waiver of any breach of this DPA is effective only if in writing by an authorized representative of the Party waiving such breach and no such waiver will be construed as a waiver of any subsequent breach.
10.4 Severance. If any provision of this DPA is found to be unenforceable, then that provision shall be modified to the extent necessary to make it enforceable and the remainder of this DPA shall remain in effect as written. However, if modifying any unenforceable provision would result the failure of the essential purpose of this DPA, the entire DPA shall be considered null and void unless amended pursuant to Section 10.2.
10.5 Notices. Except as expressly stated herein, notices required under this DPA will be provided in accordance with the Notice requirements set forth in the Agreement.
10.6 Liability. This DPA does not provide any basis for either Party or any other person to recover damages of any type other than those set forth in the Agreement and subject to all limitations set forth therein.
10.7 Enforcement. The terms of this DPA may only be enforced by the Parties on behalf of themselves and their respective Affiliates in accordance with the dispute resolution provisions set forth in the Agreement. This restriction on enforcement has no effect, however, on an individual Data Subject’s ability to enforce their rights under the Data Protection Laws.
10.8 Termination. Unless terminated earlier pursuant to the Agreement or any other applicable provision of this DPA or any applicable Data Protection Laws, this DPA shall terminate upon the completion of Processing or termination of the Agreement, whichever is later. Following termination of this DPA, GoDaddy will return, delete, or de-identify Customer Personal Data pursuant to the terms of the Agreement and this DPA, unless GoDaddy is required to maintain Customer Personal Data pursuant to applicable law. If GoDaddy is required to retain Customer Personal Data following termination of the Agreement, GoDaddy will continue to comply with its obligations relating to the Processing of Customer Personal Data under this DPA and will promptly return or delete any such Customer Personal Data after retention is no longer legally required.
10.9 Governing Law and Jurisdiction. This DPA is governed by the laws stipulated in the Agreement, except to the extent otherwise required by the Data Protection Laws, in which case the laws of the jurisdiction prescribed by the Data Protection Laws apply. No provision of this DPA shall be deemed to limit any person’s rights or obligations under any applicable Data Protection Laws.
Schedule 1: Details of Processing of Customer Personal Data
This Schedule 1 includes details of Processing Customer Personal Data Required under the Data Protection Laws.
Subject matter and duration of Processing of Customer Personal Data:
The subject matter and duration of Processing of Customer Personal Data are described in the Agreement.
The nature and purpose of Processing of Customer Personal Data:
Processing of Customer Personal Data by GoDaddy is reasonably required to provide the Services as described in the Agreement.
Type of Personal Data and Categories of Data Subjects:
The types of Customer Personal Data and categories of Data Subjects are controlled by Customer and/or the Controller who provided Customer Personal Data to Customer in its/their sole discretion.
Sensitive Data or Special Categories of Data:
Sensitive Data may, from time-to-time, be Processed pursuant to the Agreement. The types of Sensitive Data Processed under the Agreement are determined by Customer and/or the Controller who provided Sensitive Data to Customer in its/their sole discretion.
Obligations and Rights of the Controller:
The obligations and rights of Customer are described in the Agreement and this DPA.
Schedule 2: Technical and Organizational Security Measures
Pursuant to Section 5.3 of the DPA, GoDaddy will implement and maintain the following specific technical and organizational measures to protect Customer Personal Data.
1. Applicability
1.1 The requirements of this Schedule 2 apply to GoDaddy and any Subprocessor (including but not limited to any cloud service provider) used by GoDaddy to provide the Services and/or Process Customer Personal Data.
1.2 If GoDaddy uses any Subprocessor to provide the Services and/or Process Customer Personal Data, GoDaddy shall ensure that such Subprocessor complies with each of the requirements of this Schedule.
2. Information Privacy and Data Security Management
2.1 Risk Management Process. GoDaddy shall maintain an appropriate risk management process to frame, assess, respond to and monitor risk to Customer Personal Data, consistent with GoDaddy’s obligations under the Agreement, the DPA, and applicable law.
2.2 Information Security Program Scope. At a minimum, GoDaddy’s information security program, including all applicable privacy and data protection policies, shall be designed to:
2.2.1 Protect the confidentiality, integrity and availability of Customer Personal Data in GoDaddy’s possession or control or to which GoDaddy has access; and
2.2.2 Protect against reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of Customer Personal Data.
2.3 Information Security Program Updates. GoDaddy will regularly review and update its information security program in accordance with industry standard practices and frameworks appropriate to the type, volume, and sensitivity of Customer Personal Data processed by GoDaddy.
2.4 Risk Assessments and Testing. GoDaddy will regularly conduct risk assessments for all systems processing Customer Personal Data and will periodically conduct third-party penetration testing on applications and infrastructure used to provide the Services as reasonably deemed necessary by GoDaddy.
2.5 Continuity and Resiliency. GoDaddy will implement appropriate measures to protect the integrity and availability of its systems that process Customer Personal Data.
3. Organizational Security
3.1 Accountability. GoDaddy will develop and implement written information security policies and procedures that clearly define responsibility for protection of Customer Personal Data within GoDaddy, including designation of one or more specific individuals to be responsible for the administration of GoDaddy’s information security program and protection of Customer Personal Data.
3.2 Asset Management and Controls. GoDaddy will maintain an asset management policy and asset controls, including asset classification and an inventory of devices and systems that are used to provide the Services and/or process Customer Personal Data.
3.3 Physical Security. GoDaddy also shall implement risk-based controls to maintain the physical security of its facilities, including implementing reasonable measures to ensure that only authorized users have access to GoDaddy’s electronic devices, network, critical systems, applications, server room, communication rooms, and work environments. Measures that GoDaddy may employ, where appropriate, include but are not limited to alarms, CCTV monitoring, visitor access management, and destruction of Personal Data on physical devices before disposal/recycling.
4. Security Operations
4.1 Secure System Configuration. GoDaddy will establish controls to ensure that systems used to provide the Services and/or Process Customer Personal Data are securely configured.
4.2 Vulnerability and Patch Management. GoDaddy will establish and maintain a vulnerability and patch management system that ensures all systems used to provide the Services and/or Process Customer Personal Data are patched against known security vulnerabilities in a reasonable time period based on the criticality of the patch and sensitivity of the Customer Personal Data.
4.3 Malware Prevention. GoDaddy will implement detection, prevention, and remediation controls to protect against malicious software (including appropriate user awareness programs).
4.4 Logging and Auditing. GoDaddy will employ a log management program that defines the scope, creation, storage, analysis, and disposal of logs using risk-based industry standards.
4.5 Security Incident Detection and Response. GoDaddy will maintain risk-based systems for detecting Security Incidents as required by Section 6 of the Agreement, including use of intrusion detection and intrusion prevention systems.
5. Training
GoDaddy will ensure that its personnel receive regular training regarding their confidentiality and data protection obligations as they relate to Customer Personal Data.
6. Access Controls
6.1 Unique Identification. GoDaddy will assign individual unique user credentials to personnel with access to Customer Personal Data, including but not limited to personnel with administrative access.
6.2 Password Management. GoDaddy will implement policies and procedures for password management, including centralized password management and password policies.
6.3 Multi-Factor Authentication. GoDaddy will implement multi-factor authentication for remote access to networks, systems, or applications used to Process and/or store Customer Personal Data.
6.4 Least Privilege. GoDaddy will restrict access to Customer Personal Data to those personnel who are bound by appropriate confidentiality obligations and have a “need to know” or “need to access” for purposes of providing the Services.
7. Data Security Controls
7.1 Data Segregation. GoDaddy will maintain Customer Personal Data in logically separate and secure environments.
7.2 Encryption and other Measures. GoDaddy will employ appropriate risk-based measures to protect Customer Personal Data, including encryption, pseudonymization, and other appropriate measures such as employing algorithms for hashing secrets, including passwords and API tokens used for accessing systems containing Customer Personal Data.
Schedule 3: Jurisdiction Specific Terms
1. United States
1.1 California.
1.1.1 Definitions.
1.1.1.1 The following terms are specifically defined according to the definitions set forth in the California Data Protection Laws: “Business”, “Commercial Purpose”, “Service Provider”, “Sell”, “Share”, and “Third-Party”.
1.1.1.2 The term “Customer Personal Data” includes Personal Information of an identified or identifiable natural person or household.
1.1.2 The Parties’ Roles.
1.1.2.1 If Customer is deemed to be a Business under applicable California Data Protection Laws, all references to Customer’s rights and obligations as Controller under this DPA shall also be deemed to refer to Customer’s rights and obligations as a Business. If Customer is deemed to be a Service Provider under applicable California Data Protection Laws, all references to Customer’s rights and obligations as Processor under this DPA shall also be deemed to refer to Customer’s rights and obligations as a Service Provider.
1.1.2.2 If GoDaddy is deemed to be a Service Provider or Third-Party under the California Data Protection Laws, all references to GoDaddy’s rights and obligations as a Processor or Subprocessor under this DPA shall also be deemed to refer to GoDaddy’s rights and obligations as a Service Provider or Third Party, as applicable.
1.2 All U.S. States (including California).
1.2.1 GoDaddy may not (a) sell or share Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, or (c) retain, use, or disclose any Customer Personal Data outside of the direct business relationship between GoDaddy and Company.
1.2.2 GoDaddy’s access to Customer Personal Data is not part of the consideration exchanged by the Parties under the Agreement.
1.2.3 Customer shall have the right to take reasonable steps to: (a) verify GoDaddy processes Customer Personal Data in a manner consistent with this DPA, including exercising the rights set forth in Section 8 of the DPA; (b) requiring stopping and remediation of GoDaddy’s Processing activities conducted in violation of the DPA’s terms, and (c) taking any other reasonable steps (as determined in Customer’s sole discretion) to ensure GoDaddy’s compliance with this DPA. If GoDaddy is unable or unwilling to comply with Customer’s reasonable requests pursuant to this Section 1.2.3, Customer’s sole remedy is to terminate this DPA and that portion of the Agreement that relates to processing of Customer Personal Data.
1.2.4 GoDaddy certifies that it understands and will comply with the obligations under the Data Protection Laws and this DPA, including all restrictions on Processing Customer Personal Data.
2. European Union/European Economic Area
2.1 Subprocessors
2.1.1 When GoDaddy engages a Subprocessor, it will:
2.1.1.1 Require the Subprocessor to comply with those technical and organizational measures set forth in Sections 5, 6, and 8 of the DPA, and Schedule 2 of the DPA that are appropriate to the nature of processing by the Subprocessor, including but not limited to all technical and organizational measures required by Article 28 of the EU General Data Protection Regulation (“GDPR”); and
2.1.1.2 Require the Subprocessor to agree in writing to only process Customer Personal Data (a) in the EU/EEA, (b) in a country that the European Commission has declared to have an “adequate” level of data protection, or (c) on terms set forth in Schedule 4 regarding international Transfers of Customer Personal Data.
2.2 Liability for Regulatory Penalties. Notwithstanding any other term set forth in this DPA or the Agreement (including either Party’s indemnification obligations under the Agreement), neither Party will be responsible for any fines issued or levied by any regulatory authority or government body on the other Party, including any fines under Article 83 of the EU GDPR.
3. Switzerland
3.1 When GoDaddy engages a Subprocessor, it will:
3.1.1 Require the Subprocessor to comply with those Technical and Organizational Measures set forth in Sections 5, 6, and 8, and Schedule 2 of the DPA that are appropriate to the nature of processing by the Subprocessor, including but not limited to all Technical and Organizational Measures required by Article 28 of the GDPR; and
3.1.2 Require the Subprocessor to agree in writing to only process Customer Personal Data (a) in Switzerland, (b) in the EU/EEA, (c) in another country that the European Commission has declared to have an “adequate” level of data protection, or (d) on terms set forth in Schedule 4 regarding international Transfers of Customer Personal Data.
3.2 To the extent Customer Personal Data Transfers from Switzerland are made subject to the EU Standard Contractual Clauses (as defined in Schedule 4), the following amendments apply:
3.2.1 References to “Member State” will be interpreted to include Switzerland; and
3.2.2 To the extent Transfers are subject to the Federal Act on Data Protection (“FADP”) references to “Regulation (EU) 2016/679” will be deemed to be references to the FADP.
4. United Kingdom
4.1 References to “GDPR” will be deemed to be references to the corresponding laws and regulations of the United Kingdom, including, without limitation the UK GDPR and UK Data Protection Act of 2018.
4.2 When Company engages a Subprocessor, it will:
4.2.1 Require the Subprocessor to comply with those technical and organizational measures set forth in Sections 5, 6, and 8, and Schedule 2 of the DPA that are appropriate to the nature of processing by the Subprocessor, including but not limited to all technical and organizational measures required by Article 28 of the UK GDPR; and
4.2.2 Require the Subprocessor to agree in writing to only process Customer Personal Data in (a) the UK, (b) the EU/EEA, (c) another country that the United Kingdom has declared to have an “adequate” level of data protection, or (d) on terms set forth in Schedule 4 regarding international Transfers of Customer Personal Data.
Schedule 4: International Mandatory Cross Border Transfer Mechanisms
1. Definitions
1.1 The “Data Privacy Framework (‘DPF’)” means the EU-US, Swiss-US, or UK-US Data Privacy Framework certification programs operated by the U.S. Department of Commerce (https://www.dataprivacyframework.gov).
1.2 The “UK-US Data Bridge” means the UK Extension to the EU-US Data Privacy Framework.
1.3 The “EU Standard Contractual Causes” mean the standard contractual clauses approved by the European Commission and attached in the annex to decision 2021/914 of June 2021.
1.4 The UK International Data Transfer Agreement (“UK IDTA”) issued by the UK Information Commissioner, Version B1.0, is deemed to be executed by the Parties as of the Effective Date of the Agreement, and the EU Standard Contractual Clauses are deemed amended as specified by the UK IDTA in relation to data transfers from the UK.
2. Order of Precedence
2.1 No Mandatory Transfer Mechanism is used if a transfer is made to a country that has been deemed to offer an adequate level of data protection by the Data Protection Laws of the country from which such Customer Personal Data is transferred.
2.2 If a Transfer is required and such Transfer is covered by more than one Mandatory Transfer Mechanism, the Transfer will be subject to a single Mandatory Transfer Mechanism in accordance with the following order of precedence: (a) the applicable EU or Swiss DPF; (b) the UK-US Data Bridge; (c) the EU Standard Contractual Clauses; (d) the UK IDTA; or (e) any other applicable Mandatory Transfer Mechanism permitted under the applicable Data Protection Law.
2.3 If a Mandatory Transfer Mechanism is deemed invalid after execution of this Agreement, all future Transfers will be deemed made by the next applicable valid Mandatory Transfer Mechanism.
3. Data Privacy Framework
3.1 Self-Certification.
3.1.1 GoDaddy’s Certification. GoDaddy represents that it is self-certified under the DPF. GoDaddy agrees (a) to provide at least the same level of protection to any Customer Personal Data as required under the DPF’s Data Privacy Principles; (b) to notify Customer in writing without undue delay, if GoDaddy’s certification to the DPF is withdrawn, terminated, revoked, or otherwise invalidated; and (c) upon written notice from Customer to take reasonable and appropriate steps to stop and remediate any unauthorized processing of Customer Personal Data.
3.1.2 Company’s Certification. To the extent Company is certified under the DPF, Company agrees (a) to provide at least the same level of protection to any Personal Data as required under the DPF’s Data Privacy Principles; (b) to notify GoDaddy in writing without undue delay, if Company’s certification to the DPF is withdrawn, terminated, revoked, or otherwise invalidated; and (c) upon written notice to GoDaddy to take reasonable and appropriate steps to stop and remediate any unauthorized processing of Customer Personal Data.
3.2 Status
3.2.1 EU-US DPF. The EU-US DPF has been deemed to provide an adequate level of data protection by the European Commission pursuant to a 10 July 2023 adequacy decision and is in effect as of 10 October 2023.
3.2.2 UK-US Data Bridge. The UK-US Data Bridge has been deemed to provide an adequate level of data protection by the UK Secretary of State for Science, Innovation, and Technology who has laid adequacy regulations in Parliament as of 21 September 2023. The UK-US Data Bridge regulations went into effect on 12 October 2023.
3.2.3 Swiss-US DPF. The Swiss-US DPF has been approved by the Swiss Federal Council and is in effect as of 15 September 2024.
3.3 Company and Company’s Subprocessors will take all steps necessary to enable GoDaddy to comply with its obligations as a Controller and/or Processor under the DPF, including but not limited to assisting GoDaddy and/or the Controller in responding to requests from individuals to exercise their Data Subject rights.
4. The EU Standard Contractual Clauses
4.1 For Personal Data Transfers from the EU/EEA and Switzerland that are subject to the EU Standard Contractual Clauses, Module Two (Controller to Processor) or Module Three (Processor to Processor) applies depending on whether GoDaddy is a Controller or Processor with respect to the Customer Personal Data to be Transferred.
4.2 With respect to Modules Two and Three of the EU SCCs:
4.2.1 In Clause 7, the optional docking clause will not apply.
4.2.2 In Clause 9, Option 2 will apply and the process for providing notice and the time period for objections to Subprocessor changes will be as set forth in Section 3 of the DPA.
4.2.3 In Clause 11, the optional language will not apply.
4.2.4 In Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by the internal laws of Germany.
4.2.5 In Clause 18(b), disputes relating to the DPA shall be resolved in the Federal Republic of Germany.
4.3 For purposes of Annex I, Part A:
4.3.1 Data Exporter
4.3.1.1 The Data Exporter will be Company.
4.3.1.2 Company may be contacted at the addresses set forth in the notice provision of the Agreement.
4.3.1.3 By entering into this DPA, Company is deemed to have signed these EU Standard Contractual Clauses, including their Annexes, as of the Effective Date of the Agreement.
4.3.2 Data Importer
4.3.2.1 The Data Importer will be GoDaddy and/or authorized affiliates of GoDaddy.
4.3.2.2 GoDaddy may be contacted at the addresses set forth in the notice provision of the Agreement or at privacy@GoDaddy.com.
4.3.2.3 By entering into this DPA, GoDaddy is deemed to have signed these EU Standard Contractual Clauses, including their Annexes, as of the Effective Date of the Agreement.
4.4 For purposes of Annex I, Part B:
4.4.1 The categories of Data Subjects are described in Schedule 1
4.4.2 The sensitive data (if any) Transferred is described in Schedule 1.
4.4.3 The frequency of Transfer is the duration of the Agreement and DPA.
4.4.4 The nature of Processing is described in Schedule 1.
4.4.5 The purpose of Processing is described in Schedule 1.
4.4.6 The period of Processing is described in Schedule 1.
4.5 For purposes of Annex I, Part C, in accordance with clause 13, the competent supervisory authority is defined as follows:
4.5.1 For transfers of Personal Data from the EU/EEA, the Supervisory Authority is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information.
4.5.2 The Swiss Federal Data Protection and Information Commissioner shall act as the competent supervisory authority insofar as the relevant Transfer or Onward Transfer is governed by Swiss Data Protection Laws and Regulations.
4.6 In Annex II of the EU Standard Contractual Clauses, Schedule 2 contains the technical and organizational measures implemented by Company as Data Importer under the DPA.
4.7 In Annex III of the EU Standard Contractual Clauses, view a list of Company’s Subprocessors.
5. United Kingdom International Data Transfer Agreement
5.1 The UK IDTA applies to Transfers of Customer Personal Data transferred from the United Kingdom to any country outside the United Kingdom that is not recognized by the competent United Kingdom regulatory authority or government body as providing an adequate level of Personal Data protection.
5.2 For Transfers subject to the UK IDTA, the UK IDTA is deemed entered into by the Parties and completed as follows:
5.2.1 In Table 1 of the IDTA, the Parties’ details and key contact information is located in Section 4.3 of this Schedule 4.
5.2.2 In Table 2 of the IDTA, information about the version of the EU Standard Contractual Clauses, modules and selected clauses to which the UK IDTA is appended is located in Section 4 of this Schedule.
5.2.3 In Table 3 of the UK IDTA:
5.2.3.1 The list of Parties is located in Section 4.3 of this Schedule 4.
5.2.3.2 The description of the transfer is set forth in Schedule 1.
5.2.3.3 Annex II is located in Schedule 2.
5.2.3.4 Company’s list of Subprocessors is located in Schedule 5.
5.2.3.5 In Table 4 of the UK IDTA, both GoDaddy and Company may end the UK IDTA in accordance with its terms.
5.3 The UK Information Commissioner shall act as the competent supervisory authority insofar as the relevant Transfer is governed by UK Data Protection Laws and Regulations.
5.4 Conflict. To the extent there is any conflict or inconsistency between the EU Standard Contractual Clauses or the UK IDTA and any other terms in this Data Processing Addendum, the provisions of the EU Standard Contractual Clauses or the UK IDTA, as applicable, will prevail.