Data Processing Addendum

(prior version of the Data Processing Addendum available to view here)

This Data Processing Addendum, including its annexes and the Standard Contractual Clauses, ("DPA") is made by and between Intercom (“Intercom”)¹, and Customer, pursuant to the Master SaaS Subscription Agreement, the Intercom Terms of Service or other written or electronic agreement between the parties (as applicable) ("Agreement").

This DPA forms part of the Agreement and sets out the terms that apply when Customer Personal Data is processed by Intercom under the Agreement. The purpose of the DPA is to ensure such processing is conducted in accordance with applicable laws and with due respect for the rights and freedoms of individuals whose Personal Data is processed.

1. Definitions

Any capitalized term used but not defined in this DPA has the meaning provided to it in the Agreement.

i."Account Data" means Personal Data that relates to Customer’s relationship with Intercom. This includes information used for Customer’s account and billing management, identity verification, investigating and preventing system abuse, or fulfilling Intercom’s legal obligations.

ii."Affiliate" means any entity controlled by, controlling or under common control by an entity, where "control" means ownership of or the right to control greater than 50% of the voting securities of such entity.

iii."Applicable Data Protection Legislation" refers to laws and regulations applicable to Intercom’s processing of personal data under the Agreement, including but not limited to (a) the GDPR, (b) in respect of the UK, the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK GDPR") and the Data Protection Act 2018 (together, "UK Data Protection Laws"), (c) the Swiss Federal Data Protection Act and its implementing regulations ("Swiss DPA"), (d) the CCPA & CPRA, (e) the Australian Privacy Laws; (f) the LGPD; and (g) PIPEDA; in each case, as may be amended, superseded or replaced.

iv."APPs" means the 13 Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 of Australia.

v."Australian Privacy Laws" means the Privacy Act 1988 of Australia, as amended, including the Australian Privacy Principles contained therein.

vi."CCPA" or "CCPA and CPRA" means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder, in each case, as may be amended from time to time. This includes but it is not limited to the California Privacy Rights Act of 2020.

vii."Controller" or "controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. It shall have the same meaning ascribed to “controller” under the GDPR and other equivalent terms under Applicable Data Protection Legislation (e.g., ”Business” as defined under the CCPA), as applicable.

viii."Customer Data" has the meaning set forth in the Agreement.

ix.“Customer Personal Data” means Personal Data that Intercom processes as a Processor on behalf of Customer in order to provide the Services under the Agreement.

x."Europe" means for the purposes of this DPA the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland, or another country which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of Personal Data, as determined by the European Commission in the case that EU Data Protection Law applies respectively as determined by the ICO in the case that UK Data Protection Law applies.

xi."GDPR" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

xii.“LGPD” means Law No. 13,709/2018 (Lei Geral de Proteção de Dados), Brazil's General Data Protection Law.

xiii."Personal Data" or "personal data" or "personal information" means any information, including personal information, relating to an identified or identifiable natural person (“data subject”) or as defined in and subject to Applicable Data Protection Legislation.

xiv."PIPEDA" means Canada’s Personal Information Protection and Electronic Documents Act (S.C. 2000, c 5).

xv.“Privacy Policy” means the current privacy policy for the Services available at https://www.intercom.com/legal/privacy.

xvi."Processor" or "processor" means the entity which processes Personal Data on behalf of the Controller. It shall have the meaning ascribed to “processor” under the GDPR and other equivalent terms under other Applicable Data Protection Legislation (e.g., “Service Provider” as defined under the CCPA), as applicable.

xvii."Processing" or "processing" (and "Process" or "process") means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, securing, organization, storage, adaptation or alteration, access to, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

xviii."Restricted Transfer" means: (i) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on an adequacy regulation by the UK government; (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner and (iv) where the LGPD applies, a transfer of personal data to a country outside of Brazil which is not included on the list of adequate jurisdictions published by the Brazilian Data Protection Authority; (v) where the Australian Privacy Laws apply, a cross-border disclosure of Personal Data to an overseas recipient in a country outside of Australia where the recipient is not subject to a law or binding scheme that provides substantially similar protection to the APPs; (vi) where PIPEDA applies, a transfer from Canada to a country outside of Canada.

xix."Security Breach" means a breach of security leading to any accidental, unauthorized or unlawful loss, disclosure, destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data transmitted, stored or otherwise processed by Intercom. For the avoidance of doubt, a Security Breach shall not include an unsuccessful attempt or activity that does not compromise the security of Customer Personal Data, including (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents.

xx."Standard Contractual Clauses" or "SCCs" means (i) where the GDPR applies, the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN ("EU SCCs"); (ii) where the UK GDPR applies, the applicable standard data protection clauses adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR, including the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018, as such Addendum may be revised under Section 18 therein ("UK SCCs"); (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (the "Swiss SCCs"); and (iv) where the LGPD applies, the applicable standard protection clauses issued, approved or recognized by the Brazilian data protection authority (the “Brazil SCCs”), (in each case, as updated, amended or superseded from time to time).

xxi."Sub-processor" or "sub-processor" means (a) Intercom, when Intercom is processing Customer Personal Data and where Customer is itself a processor of such Customer Personal Data, or (b) any third-party Processor engaged by Intercom or its Affiliates to assist in fulfilling Intercom's obligations under the Agreement and which processes Customer Personal Data. Sub-processors may include third parties or Intercom Affiliates but shall exclude Intercom employees, contractors or consultants.

xxii."Third Party Request" means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.

xxiii."UK Addendum" means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018, as such Addendum may be revised under Section 18 therein. This is found in Schedule 4 below.

2. Applicability and Scope

i.Applicability. This DPA will apply only to the extent that Intercom processes, on behalf of Customer, Personal Data to which Applicable Data Protection Legislation applies.

ii.Scope and Duration. The subject matter of the data processing is the provision of the Services, and the processing will be carried out for the duration of the Agreement. Schedule 1 (Details of Processing) sets out the nature and purpose of the processing, the types of Personal Data Intercom processes and the categories of data subjects whose Personal Data is processed. This DPA will remain in effect until the later of (a) the expiration or termination of the Agreement and (b) the return or deletion of Customer Personal Data in accordance with Section 10.

iii.Intercom as a Processor. The parties acknowledge and agree that regarding the processing of Customer Personal Data, Customer may act either as a controller or processor and Intercom is a processor. Intercom will only process Customer Personal Data in accordance with Customer’s documented instructions as set forth in Section 3 (Customer Instructions).

iv.Intercom as a Controller of Account Data. The parties acknowledge that, regarding the processing of Account Data, Customer is a controller and Intercom is an independent controller, not a joint controller with Customer. Intercom will process Account Data as a controller (a) in order to manage the relationship with Customer; (b) carry out Intercom’s core business operations; (c) in order to detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services; (d) identity verification; (e) to comply with Intercom’s legal or regulatory obligations; and (f) as otherwise permitted under Applicable Data Protection Legislation and in accordance with Intercom’s Privacy Policy.

v.The parties agree that any notice or communication sent by Intercom to Customer shall also satisfy any obligation to send such notice or communication to Customer’s Affiliate.

3. Intercom as a Processor – Processing Customer Personal Data

i.Customer Instructions. Customer appoints Intercom as a processor to process Customer Personal Data on behalf of, and in accordance with (a) Customer’s instructions as set forth in the Agreement, this DPA, and as otherwise necessary to provide the Services to Customer (which may include investigating security incidents, and detecting and preventing exploits or abuse); (b) as necessary to comply with applicable law, including Applicable Data Protection Legislation; and (c) as otherwise agreed in writing between the parties (“Permitted Purposes”).

ii.Lawfulness of Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Legislation. Customer acknowledges that Intercom is neither responsible for determining which laws are applicable to Customer’s business nor whether Intercom’s Services meet or will meet the requirements of such laws. Customer will ensure that Intercom’s processing of Customer Personal Data, when done in accordance with Customer’s instructions, will not cause Intercom to violate any applicable law, including Applicable Data Protection Legislation. Intercom will inform Customer if it becomes aware, or reasonably believes, that Customer’s instructions violate applicable law, including Applicable Data Protection Legislation.

iii.Additional Instructions. Additional instructions outside the scope of the Agreement or this DPA will be mutually agreed to between the parties in writing.

4. Purpose Limitation

Intercom will process Customer Personal Data in order to provide the Services and in accordance with the Agreement. Schedule 1 (Details of Processing) of this DPA further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of Personal Data and categories of data subjects.

5. Compliance

Customer shall be responsible for ensuring that: (a) all such notices have been given, and all such authorizations have been obtained, as required under Applicable Data Protection Legislation, for Intercom (and its Affiliates and Sub-processors) to process Customer Personal Data as contemplated by the Agreement and this DPA; (b) it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Legislation; and (c) it has, and will continue to have, the right to transfer, or provide access to, Customer Personal Data to Intercom for processing in accordance with the terms of the Agreement and this DPA.

6. Confidentiality

i.Confidentiality Obligations of Intercom Personnel.

a.Security Policy and Confidentiality. Intercom requires all employees to acknowledge in writing, at the time of hire, they will adhere to terms that are in accordance with Intercom’s security policies and to protect Customer Personal Data at all times. Intercom requires all employees to sign a confidentiality statement at the time of hire.

b.Intercom will ensure that any person that it authorizes to process Customer Personal Data (including its staff, agents, and subcontractors) shall be subject to a duty of confidentiality (whether in accordance with Intercom's confidentiality obligations in the Agreement or a statutory duty).

c.Background Checks. When permitted by law, Intercom will conduct at its expense a criminal background investigation on all employees who are to perform material aspects of the Services under this Agreement.

ii.Responding to Third Party Requests. In the event any Third Party Request is made directly to Intercom in connection with Intercom’s processing of Customer Personal Data, Intercom will promptly inform Customer and provide details of the same, to the extent legally permitted. Intercom will not respond to any Third Party Request, without prior notice to Customer and an opportunity to object, except as legally required to do so or to confirm that such Third Party Request relates to Customer.

7. Sub-processors

i.Authorization for Sub-processing. Customer agrees that (a) Intercom may engage Sub-processors as listed at https://www.intercom.com/legal/subprocessors-list/update (the "Sub-processor Page") which may be updated from time to time and Intercom Affiliates; and (b) such Affiliates and Sub-processors respectively may engage third party processors to process Customer Personal Data on Intercom's behalf. Customer provides a general authorization for Intercom to engage additional third-party Sub-processors to process Customer Personal Data in accordance with the Agreement that is conditioned on the following requirements: (a) Intercom will restrict the onward Sub-processor’s access to Customer Personal Data only to what is strictly necessary to provide the Services and in accordance with the Agreement, and Intercom will prohibit the sub-processor from processing the Customer Personal Data for any other purpose. (b) Intercom agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Personal Data to the standard required by Applicable Data Protection Legislation; and (c) Intercom will remain liable and accountable for any breach of this DPA that is caused by an act or omission of its sub-processors.

ii.Current Sub-processors and Notification of Sub-processor Additions.

a.Customer understands that effective operation of the Services may require the transfer of Customer Personal Data to Intercom Affiliates, such as Intercom, Inc., or to Intercom's Sub-processors, see Schedule 3. Customer hereby authorizes the transfer of Customer Personal Data to locations outside Europe (Intercom’s primary processing facilities are in the United States of America), including to Intercom Affiliates and Sub-processors, subject to continued compliance with this DPA throughout the duration of the Agreement.

b.Intercom may, by giving reasonable notice to the Customer, add or replace Sub-processors to the Sub-processor Page. Intercom will notify Customer if it intends to add or replace Sub-processors from the Sub-Processor Page at least twenty (20) days prior to any such changes. To receive such notification, Customers can send an email to dataprotection@intercom.io to join Intercom’s distribution list. If Customer reasonably objects to the appointment of a new Sub-processor within twenty (20) days of receiving such notice, on reasonable grounds relating to the protection of the Customer Personal Data, then Intercom will work in good faith with Customer to find an alternative solution. In the event that the parties are unable to reach a mutually acceptable resolution within a reasonable time thereafter, Customer is permitted to terminate the Agreement between Intercom and Customer.

8. Impact Assessments and Consultations

Taking into account the nature of the Processing, Intercom shall, to the extent required by Applicable Data Protection Legislation, provide Customer with reasonable assistance with data protection impact assessments, or prior consultations with data protection authorities that Customer is required to carry out under such legislation. Information on Intercom’s data protection and security practices is available via its Trust Center https://trust.intercom.com/; additional assistance beyond this may be subject to a reasonable fee. Any assistance that goes beyond what is reasonably required to comply with Applicable Data Protection Legislation, or that requires resources beyond those reasonably necessary to provide such assistance, may be subject to a reasonable additional fee, to be agreed in advance.

9. Security

i.Intercom has in place and will maintain throughout the term of this Agreement appropriate technical and organizational measures designed to protect Customer Personal Data against Security Breaches.

ii.These measures shall at a minimum comply with applicable law and include the measures identified in Schedule 2 (Technical and Organizational Security Measures).

iii.Customer acknowledges that the security measures are subject to technical progress and development and that Intercom may update or modify the security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Customer.

iv.Upon becoming aware of a Security Breach involving Customer Personal Data processed by Intercom on behalf of Customer under this DPA, Intercom shall notify Customer without undue delay and shall provide such information as Customer may reasonably require, including to enable Customer to fulfil its data breach reporting obligations under Applicable Data Protection Legislation. Intercom has no liability for the consequences of a Security Breach caused by Customer or Permitted Users.

v.Intercom’s notification of or response to a Security Breach shall not be construed as an acknowledgement by Intercom of any fault or liability with respect to the Security Breach.

vi.Customer is solely responsible for its use of the Service, including (a) making appropriate use of the Service to ensure a level of security appropriate to the risk in respect of Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Service; and (c) backing up Customer Personal Data.

10. Return or Deletion of Customer Personal Data

Upon termination or expiry of this Agreement, Intercom will (at Customer's election) delete or return to Customer all Customer Personal Data (including copies) in its possession or control. Customer may request to Intercom to delete all Customer Personal Data, and Intercom will proceed to delete the data as soon as reasonably practicable and within a maximum period of 30 days from Customer’s written request. If Customer does not request deletion of Customer Personal Data, Intercom will automatically delete it from our systems 180 days after the termination or expiration of this Agreement. Customer Personal Data from our back-up systems will be deleted 14 days after deletion of the Customer Personal Data from our main/live system, except where Intercom is required by Applicable Data Protection Legislation to retain some or all of the Customer Personal Data, which Intercom will securely isolate and protect from any further processing, except to the extent required by applicable law.

11. Audits

i.The parties acknowledge that when Intercom is acting as a processor on behalf of Customer, Customer must be able to assess Intercom’s compliance with its obligations under Applicable Data Protection Legislation and this DPA.

ii.Upon written request and at no additional cost to Customer, Intercom shall provide Customer, and/or its appropriately qualified third-party representative (collectively, the "Auditor"), access to reasonably requested documentation evidencing Intercom's compliance with its obligations under this DPA in the form of the relevant audits or certifications found at https://trust.intercom.com.

iii.While it is the parties’ intention ordinarily to rely on the provision of the documentation to demonstrate Intercom’s compliance with this DPA and the provisions of Article 28 of the GDPR, Intercom shall permit Customer or its Auditor to carry out an audit, at Customer’s cost and expense, (including, without limitation, the costs and expenses of Intercom), of Intercom’s processing of Customer Personal Data under the Agreement upon Customer’s written request for an audit, subject to the terms of this Section. Following Intercom’s receipt of such request, Intercom and Customer shall mutually agree in advance on the details of the audit, including the reasonable start date, scope and duration of any such audit. Any such audit shall be subject to Intercom’s security and confidentiality terms and guidelines, may only be performed a maximum of once annually and will be restricted to only data relevant to Customer. Where the Auditor is a third-party, Intercom may object in writing to such Auditor, if in Intercom's reasonable opinion, the Auditor is not suitably qualified or is a direct competitor of Intercom. Any such objection by Intercom will require Customer to either appoint another Auditor or conduct the audit itself. Any expenses incurred by an Auditor in connection with any review of reports or an audit shall be borne exclusively by the Auditor. For clarity, the exercise of audit rights under the SCCs shall be as described in this Section 11 (Audits).

iv.Intercom uses external auditors to verify the adequacy of its security measures with respect to its processing of Customer Personal Data. A description of Intercom’s certifications and standards for audit can be found at https://trust.intercom.com.

12. Transfer Mechanisms

i.Location of Processing. Customer acknowledges that Intercom and its Sub-processors may transfer and process personal data to and in the United States of America and other locations in which Intercom, its Affiliates or its Sub-processors maintain data processing operations, as more particularly described in the Sub-processor Page. Intercom shall ensure that such transfers are made in compliance with Applicable Data Protection Legislation and this DPA.

ii.The parties agree that when the transfer of personal data from Customer (as “data exporter”) to Intercom (as “data importer”) is a Restricted Transfer, Applicable Data Protection Legislation requires that appropriate safeguards are put in place. For the purposes of such Restricted Transfers from Customer to Intercom, the parties rely, where applicable, on Intercom’s certification under the EU-U.S Data Privacy Framework, the Swiss-US Data Privacy Framework and the UK-US Data Privacy Framework (together, the “DPF”) operated by the U.S. Department of Commerce. To the extent that the DPF is invalidated or ceases to be an appropriate safeguard under Applicable Data Protection Legislation for transfers to the United States, or if the transfer is made to a country other than the United States that is not recognized as providing an adequate level of protection by the relevant data protection authority, such transfer shall be subject to the appropriate Standard Contractual Clauses, which shall be deemed incorporated into and form part of this DPA, as follows:

a.In relation to transfers of Customer Personal Data that is protected by the GDPR, the EU SCCs shall apply, completed as follows:

b.In relation to transfers of Account Data protected by the GDPR and processed in accordance with Section 2.iv of this DPA, the EU SCCs shall apply, completed as follows:

c.In relation to transfers of personal data protected by the Swiss DPA, the EU SCCs as implemented under sub-paragraphs (a) and (b) above will apply with the following modifications:

d.The UK SCC Addendum included at Schedule 4 to the DPA shall apply to the transfer of personal data originating in the UK to a third country.

e.In relation to transfers of Customer Personal Data and Account Data that is protected by the LGPD, the Brazilian SCCs shall apply and be deemed incorporated into and form part of this DPA, completed as follows:

f.In relation to transfers of personal data protected by PIPEDA, the international transfers will be conducted in accordance with PIPEDA, and Customer shall provide any required notice regarding cross-border transfers and safeguards to data subjects as required by PIPEDA.

g.In relation to Customer Personal Data and Account Data subject to the APPs that are transferred to Intercom or Sub-processors outside Australia, the APP 8 cross-border disclosure obligations under the Australian Privacy Act shall apply.

h.It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict

iii.Alternative Transfer Mechanism. To the extent that Intercom adopts an alternative data export mechanism (including any new version of or successor to the DPF or Standard Contractual Clauses adopted pursuant to Applicable Data Protection Legislation) ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall upon notice to Customer and an opportunity to object, apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with Applicable Data Protection Legislation applicable to Europe and extends to territories to which Customer Personal Data and Account Data is transferred).

iv.Transfers Outside the European Economic Area. In providing the Services, Intercom and its Sub-processors may transfer Customer Personal Data to countries outside the European Economic Area, including the United States and Australia. Such transfers include remote access to Customer Personal Data by Intercom personnel located in these countries.

v.Non-European Legislation Permitting Access to Customer Personal Data. Intercom and its Sub-processors are subject to laws in the United States and Australia that may require disclosure of, or access to, Customer Personal Data, including laws relating to national security, law enforcement, and telecommunications interception. Further detail on the applicable legislation is set out in Intercom's Transfer Impact Assessment, available upon request.

vi.Residual Risk for Transfers to Countries Without an Adequacy Decision. For transfers to countries for which no adequacy decision has been adopted by the European Commission, residual risk remains that government authorities in those countries could seek access to Customer Personal Data under local law. Intercom considers this risk to be low given the transfer mechanisms and technical and organisational security measures described in this Section 12 and Schedule 2.

13. Cooperation and Data Subject Rights

i.Data Subject Rights. Intercom provides Customer with a number of self-service features via the Services, including the ability to delete or obtain a copy of Customer Personal Data. Customer may use such self-service features to assist in complying with its obligations under Applicable Data Protection Legislation with respect to responding to Third Party Requests from data subjects via the Services at no additional cost. Upon Customer’s request, Intercom shall, taking into account the nature of the processing, provide reasonable assistance to Customer where possible and at Customer’s cost and expense, to enable Customer to respond to requests from a data subject seeking to exercise their rights under Applicable Data Protection Legislation. In the event that such request is made directly to Intercom, if Intercom can, through reasonable means, identify the Customer as the controller of the Customer personal data of a data subject, Intercom shall promptly inform Customer of the same. As between the Parties, Customer shall have sole discretion and responsibility in responding to the rights asserted by any individual in relation to Customer Personal Data.

ii.Cooperation. In the event that either party receives (a) any request from a data subject to exercise any of its rights under Applicable Data Protection Legislation or (b) any Third Party Request relating to the processing of Account Data or Customer Personal Data conducted by the other party, such party will promptly inform the other party in writing. The parties agree to cooperate, in good faith, as necessary to respond to any Third Party Request and fulfill their respective obligations under Applicable Data Protection Legislation.

14. No sale or Sharing

To the extent that the processing of Customer Personal Data is subject to U.S. data protection laws, Intercom will comply with the provisions of U.S. data protection laws to the extent required. Intercom will notify Customer promptly if it makes the determination that it can no longer meet its obligations under applicable U.S. data protection laws.

15. Miscellaneous

i.If there is a conflict between the Agreement and this DPA, the terms of this DPA will prevail. The order of precedence will be: (a) this DPA; and (b) the Agreement. To the extent there is any conflict between the Standard Contractual Clauses, and any other terms in this DPA, or the Agreement, the provisions of the Standard Contractual Clauses will prevail.

ii.The parties agree that this DPA shall replace and supersede any prior data processing addendum that Intercom and Customer may have previously entered into in connection with the Services.

iii.Any claims brought in connection with this DPA will be subject to the terms and conditions, including, but not limited to, the exclusions and limitations set forth in the Agreement.

iv.In no event does this DPA restrict or limit the rights of any data subject or of any competent supervisory authority.

v.In the event (and to the extent only) of a conflict (whether actual or perceived) among Applicable Data Protection Legislation, the parties (or relevant party as the case may be) shall comply with the more onerous requirement or standard which shall, in the event of a dispute in that regard, be solely determined by Intercom.

vi.Notwithstanding anything else to the contrary in the Agreement and without prejudice to Sections 2(iii) and 2(iv), Intercom reserves the right to make any modification to this DPA as may be required to comply with Applicable Data Protection Legislation. Intercom will provide Customer with at least twenty (20) days’ notice of such amendments, during which time the Customer may reasonably object. The parties will work together in good faith to agree on any measures required to ensure compliance with the law.

vii.Notwithstanding anything in the Agreement or any order form entered in connection therewith, the parties acknowledge and agree that Intercom access to Customer Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement.

viii.In no event shall this DPA benefit or create any right or cause of action on behalf of a third party (including a Third-Party Controller), but without prejudice to the rights or remedies available to Data Subjects under Data Protection Laws or this DPA (including the DPF and SCCs).

Schedule 1

DETAILS OF PROCESSING

Annex I

A. LIST OF PARTIES

Data exporter(s): [Identity and contact details of the controller(s) /data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

Data importer(s): [Identity and contact details of the processor(s) /data importer(s), including any contact person with responsibility for data protection]

B. DESCRIPTION OF PROCESSING/ TRANSFER

Schedule 2

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Annex II

Further details of Intercom’s technical and organizational security measures to protect Customer Data are available at:

• https://trust.intercom.com
• https://www.intercom.com/help/en/articles/1385437-how-intercom-complies-with-gdpr
• https://www.intercom.com/legal/privacy

Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following table provides more information regarding the technical and organizational security measures set forth below.

Schedule 3

LIST OF SUB-PROCESSORS

Annex III

In Clause 9 of the 2021 Standard Contractual Clauses, Option 2 will apply and the time period for prior notice of sub-processor changes and procedure for reasonable objection to such an appointment will be as set forth in Section 7.ii (Current Sub-processors and Notification of Sub-processor Changes) of this DPA.

Schedule 4

UK Addendum to the EU Commission Standard Contractual Clauses

Date of this Addendum: This Addendum is effective from the same date as the DPA.

Part 1: Tables

Part 2: Mandatory Clauses

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.

5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.

6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws apply.

7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.

8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.

10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

a.together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;

b.Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and

c.this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.

14. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.

15. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:

a.References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;

b.In Clause 2, delete the words:

“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

c.Clause 6 (Description of the transfer(s)) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B1 and B2 where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

d.Clause 8.7(i) of Module 1 is replaced with:

“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

e.Clause 8.8(i) of Modules 2 and 3 is replaced with:

“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

f.References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

g.References to Regulation (EU) 2018/1725 are removed;

h.References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

i.The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

j.Clause 13(a) and Part C of Annex I are not used;

k.The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

l.In Clause 16(e), subsection (i) is replaced with:

“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

m.Clause 17 is replaced with:

“These Clauses are governed by the laws of England and Wales.”;

n.Clause 18 is replaced with:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

o.The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

18. From time to time, the ICO may issue a revised Approved Addendum which:

a.makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or

b.reflects changes to UK Data Protection Laws;

The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

19. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:

a.its direct costs of performing its obligations under the Addendum; and/or

b.its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

20. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

---

¹ For purposes of this DPA and the Agreement, Intercom is used in order to reflect the legal name of the contracting entity, but any references to Intercom should be interpreted as referring to Fin as one and the same. ↩