Rocket Software logo

Last Updated: October 21, 2024

This data processing agreement (the “Data Processing Agreement”) is by and between Rocket Software, Inc. and/or its affiliates (“Rocket Software”) and you, a provider of goods or services to Rocket Software (the “Vendor”) and is effective as of the effective date (the “Effective Date”) of that certain vendor services agreement, master services agreement or other similar agreement entered into by the parties (the “Agreement”). This Data Processing Agreement forms part of, and is incorporated into, the Agreement.

I. Definitions. Capitalised terms not defined herein have the meaning given to them in the Agreement. The following definitions apply to this Data Processing Agreement:

A. “Applicable Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under this Data Processing Agreement, in each case as amended from time to time, including without limitation the European Data Protection Laws, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA”), and Brazil’s General Data Protection Law, Lei Geral de Proteção de Dados.

B. “CCPA” means the California Consumer Privacy Act (CCPA), as amended.

C. “controller,” “data subject,” “personal data,” “personal data breach,” “processing,” “processor” and “supervisory authority” each has the meaning given to it in Applicable Data Protection Laws.

D. “European Data Protection Laws” means the EU’s General Data Protection Regulation 2016/679 (the “EU GDPR”), the EU GDPR in such form as incorporated into the law of England and Wales, Scotland and Northern Ireland and the UK Data Protection Act 2018 (the “UK GDPR”), and the Swiss Federal Act on Data Protection, and any other applicable law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding instrument implementing any of the foregoing (in each case as amended, consolidated, re-enacted or replaced from time to time).

E. “Services” means the services and/or products to be provided by Vendor to Rocket Software under the Agreement, including any required, usual, appropriate or acceptable methods to perform activities related to the Services, including (a) carrying out the Services or the business of which the Services are a part, (b) carrying out any benefits, rights and obligations related to the Services, (c) maintaining records relating to the Services, and (d) complying with any legal or self-regulatory obligations related to the Services.

F. “Sub-processor” means a third-party subcontractor which is engaged by or on behalf of the Vendor that will process personal data as part of the supply of the Services.

G. “Standard Contractual Clauses” means the European Commission’s Standard Contractual Clauses for the transfer of personal data from the European Union to processors established in third countries pursuant to Regulation (EU) 2016/679 as set out in the Annex to the European Commission’s Implementing Decision (EU) 2021/914 .

II. Nature of Processing, General Obligations, Sub-Processors and Cross-Border Transfers

A. Nature of Processing.

The parties acknowledge and agree that for the purposes of the Applicable Data Protection Laws, Rocket Software is the controller, and the Vendor is the processor, in relation to the following processing: (i) scope, nature and purpose of processing: processing carried out by the Vendor in the provision of the Services; (ii) duration: for the Term; and (iii) types of personal data and categories of data subjects: data subjects whose personal data is processed by the Vendor in performance of the Services.

B. General Obligations.

To the extent that the information disclosed by Rocket Software to Vendor in connection with the performance of the Services contains personal data, the Vendor (acting as processor) shall: (i) only act on the instructions of Rocket Software set out in this Data Processing Agreement or the Agreement or as otherwise documented by Rocket Software, unless any Applicable Data Protection Laws require otherwise, in which case, the Vendor shall notify Rocket Software of such legislative requirement before processing such personal data (unless the Vendor is barred from notifying Rocket Software under any Applicable Data Protection Laws); (ii) as soon as reasonably practicable (and in any event within two (2) Business Days) inform Rocket Software if, in its opinion, an instruction it receives from them infringes Applicable Data Protection Laws; (iii) take appropriate technical and organisational measures to protect such personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing; (iv) ensure any person that the Vendor discloses such personal data to has committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality in respect of such personal data; (v) provide reasonable cooperation as requested by Rocket Software with responding to any request from a data subject, and in ensuring compliance with their obligations under the Applicable Data Protection Laws with respect to security, breach notifications (including notifying Rocket Software without undue delay and in any event within forty-eight (48) hours, upon becoming aware of the occurrence of a personal data breach), data protection impact assessments and consultations with supervisory authorities; (vi) upon the termination or expiry of this Data Protection Agreement for any reason, (at Rocket Software’s election) delete, or return to Rocket Software all such personal data, unless it is necessary for the Vendor or its Sub-processors to retain certain copies of such personal data to comply with any Applicable Data Protection Laws in which case it shall comply with its back up and retention policies; and (vii) upon thirty (30) days advance written notice from Rocket Software (no more than once per calendar year): (a) make available to Rocket Software all information reasonably necessary to demonstrate the Vendor’s compliance with this Data Protection Agreement; and (b) allow for audits and inspections by Rocket Software or its designated auditor.

C. Sub-processors

Rocket Software consents to the Vendor engaging a third-party Sub-processor to process personal data on behalf of Rocket Software to the extent necessary to provide the Services and in accordance with the Agreement, provided that: (i) Vendor shall inform Rocket Software of any new Sub-processors engaged after the date of this Agreement and obtain Rocket Software’s written authorisation to do so; and (ii) the subcontract imposes on the Sub-processor substantially the same obligations that the Vendor is subject to under this Data Processing Agreement. Vendor shall provide a list of Sub-processors to Rocket Software at [email protected] upon request.

D. Cross-Border Transfers of Personal Data

Where the Vendor transfers personal data to any recipient not covered by a framework recognised by the Applicable Data Protection Laws as providing an adequate level of protection for personal data, the Vendor shall ensure that such transfer of personal data complies with applicable Data Protection Laws.

E. Cross-Border Transfers of Personal Data – EU

i. With respect to the transfer of personal data from Rocket Software to Vendor under the European Data Protection Laws where such transfer occurs from a European Union country to any third country not covered by a framework recognised by the Applicable Data Protection Laws as providing an adequate level of protection for personal data, the parties agree to comply with the general clauses of this Data Processing Agreement and “Module Two” (Transfer Controller to Processor) of the Standard Contractual Clauses shall apply to the Vendor’s processing of such personal data, which are incorporated herein by reference

ii. In furtherance of the foregoing, the parties agree that, for purposes of the Standard Contractual Clauses:

a. Rocket Software shall act and comply with the obligations as the "data exporter", and Vendor shall act and comply with the obligations as the "data importer";

b. Clause 7 (Docking Clause) of the Standard Contractual Clauses shall apply;

c. Option 1 in Clause 9(a) (Use of sub-processors) shall apply, the list of Sub-processors not already authorised by the data exporter shall be notified to [email protected] (which shall be provided with any proposed updates as well) and the relevant time period shall be 45 days;

d. the optional wording in Clause 11(a) (Redress) of the Standard Contractual Clauses shall not apply;

e. for the purposes of Clause 17 of the Standard Contractual Clauses, the Standard Contractual Clauses shall be governed by the laws of the Netherlands; and

f. for the purposes of Clause 18(b) of the Standard Contractual Clauses, the parties agree to submit to the jurisdiction of the courts of the Netherlands. 

iii. Annex I to the Standard Contractual Clauses shall be completed as follows:

a. For the purposes of Section A (List of Parties) of Annex I, the identity and contact details of Rocket Software as data exporter and controller and the Vendor as data importer and processor and, where applicable, information about their respective data protection officer and/or representative in the European Union are those set forth in the Agreement, or as otherwise communicated by each party to the other party;

b. Section B (Description of Transfer) of Annex I is hereby deemed to be completed with the information set out in Clause II.A of this Data Processing Agreement, where the frequency of the of the transfer will be on a continuous basis, and, subject to Clause II.B(vi) of this Data Processing Agreement, the personal data will be retained for the period of time required for the purposes of processing.

c. For the purposes of Section C (Competent Supervisory Authority) of Annex I, the competent supervisory authority identified in accordance with Clause 13 is the Netherlands.

iv. The parties have agreed on the technical and organisational measures provided by Vendor to Rocket Software for purposes of Annex II to the Standard Contractual Clauses.

v. Annex III of the Standard Contractual Clauses (List of Sub-processors) is hereby deemed completed by reference to the list provided by the Vendor to Rocket Software under Clause II.E(ii)(c) above, as updated in accordance with that clause.

F. Cross-Border Transfers of Personal Data – Rest of World

With respect to the transfer of Personal Data from Rocket Software to Vendor under other Applicable Data Protection Laws:

i. The parties agree to comply with the requirements above to the extent standard contractual clauses are required to meet legal obligations regarding cross-border transfers under the relevant Applicable Data Protection Laws. In such case, (i) references in the Standard Contractual Clauses to the GDPR shall hereby be deemed to have the same meaning as the equivalent reference in the Applicable Data Protection Laws; (ii) references in the Standard Contractual Clauses to “Member State” or “Union” shall hereby be deemed to refer to the relevant jurisdiction where the Applicable Data Protection Laws are in force; and (iii) any other obligation in the Standard Contractual Clauses determined by the Member State in which the data exporter is established shall hereby be deemed to refer to an obligation under the Applicable Data Protection Laws.

ii. Where the processing of Personal Data is subject to Applicable Data Protection Laws in the UK, Template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022 (“UK Addendum”) shall apply alongside the Standard Contractual Clauses. For the purpose of Part 1 of the UK Addendum, the parties agree that:

a. Table 1. The “start date” will be the effective date of the Agreement. The “Parties” are Rocket Software as exporter and the Vendor as importer.

b. Table 2. Module Two of the Standard Contractual Clauses applies.

c. Table 3. The “Appendix Information” is the information set out in Clause II.E(ii)-(iii) of this Data Processing Agreement.

d. Table 4. The party that may end the UK Addendum in accordance with Section 19 of the UK Addendum is Rocket Software.

ii. To the extent necessary to comply with Applicable Data Protection Laws, the parties agree to execute such additional documents (including updates to the Annexes of the Standard Contractual Clauses) and apply additional protections, as may be necessary for the transfer and storage of personal data transferred pursuant to the Standard Contractual Clauses, UK Addendum or other equivalent requirements under Applicable Data Protection Laws.

G. CCPA

In some instances, pursuant to the Agreement, Vendor will act as a Business under the CCPA, and in others, Vendor will act as a Service Provider under the CCPA. The Personal Data that Rocket Software disclosed to Vendor is provided to Vendor for a Business Purpose, Vendor shall not Sell or Share the Personal Data, as those terms are defined in the CCPA and the transfer of the Personal Data to Vendor shall not be considered a “sale” as defined in the CCPA.

Where Vendor acts as a Service Provider, Vendor shall not sell Personal Data nor shall it retain, use, or disclose Personal Data (a) for any purpose other than for the specific purpose of providing the Services; (b) outside of the direct business relationship between Rocket Software and Vendor; or (c) combine the Personal Data received from Rocket Software with Personal Data that Vendor receives from, or on behalf of, another person or company, except as permitted under Applicable Data Protection Laws; or (d) as otherwise prohibited by the CCPA.

III. General

The terms and conditions included in this Data Processing Agreement shall supersede and replace any and all prior data protection agreements or prior versions of the Standard Contractual Clauses or data privacy or data protection terms included in any other agreements between the parties relating to the subject-matter covered by this Data Processing Agreement. Rocket Software may modify this Data Processing Agreement as required for purposes of complying with Applicable Data Protection Laws or the decision of a competent authority under Applicable Data Protection Laws, including in connection with (a) changes in corporate structure, and (b) the release of new features, functions, products or services or changes to any of the existing Services. For the avoidance of doubt, Rocket Software may freely assign the Agreement and this Data Processing Agreement.