Data processing agreement for partners

This Data Processing Agreement ("DPA") forms part of the agreement governing the provision of the Services (the "Partner Agreement") between:

• Varnish Software AB, reg. no. 556805-6203, Wallingatan 12, 111 60 Stockholm, Sweden ("Varnish", "Sub-processor"), and
• The partner entity identified in the Partner Agreement ("Partner", "Processor").

This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). It applies to the processing of Personal Data by Varnish as a Sub-processor on behalf of the Partner (acting as Processor) and the End-User (acting as Controller) in connection with the Services.

1. Definitions

Capitalised terms not defined in this DPA shall have the meaning set out in the GDPR.

• "Controller": means the End-User (Partner's customer) that determines the purposes and means of processing.
• "Processor": means the Partner who processes data on behalf of the Controller.
• "Sub-processor": means Varnish or any third party engaged by Varnish to process Personal Data.
• "Personal Data": means any information relating to an identified or identifiable natural person.
• "Administrative Data": means the categories of personal data processed by Varnish as an independent Controller for its own business purposes, as further described in Varnish's Privacy Policy, as updated from time to time.
• "Traffic Data": means Personal Data processed through the CDN services, including IP addresses, request headers, and traffic or security logs.
• "Varnish Sovereign Service Layer": means the subset of Varnish's infrastructure and sub-processors that process Traffic Data within the EU/EEA.

2. Roles of the Parties

2.1 Processing Chain: The parties acknowledge that for Traffic Data, the End-User is the Controller, the Partner is the Processor, and Varnish is the Sub-processor as summarized below.

2.2 Documented Instructions: Varnish processes Traffic Data solely on the Partner's documented instructions. The Partner warrants that all instructions provided to Varnish are consistent with the instructions received from the End-User Controller.

2.3 Independent Controller Processing: This DPA does not apply to Administrative Data processed by Varnish as an independent controller, which is governed by Varnish's Privacy Notice https://www.varnish-cdn.com/legal/privacy-policy.

3. Categories of Data Subjects and Personal Data

3.1 Data Subjects: Website users accessing the End-User's websites.

3.2 Categories of Personal Data:

• IP addresses
• Request headers
• Traffic and security logs
• Limited technical metadata required for routing and security
• Partner personnel contact and account data: name, business email address, and account or authentication credentials and tokens used to access Varnish's management portal or APIs.

Varnish does not intentionally process special categories of personal data under Article 9 GDPR.

4. Processing Overview

Processing is limited to what is necessary to provide the Services in accordance with the Partner Agreement. Given that, Varnish processes Traffic Data solely for the purpose of:

• delivering and routing content via the CDN,
• ensuring availability, performance, and resilience of the Services,
• detecting, preventing, and mitigating malicious traffic, and
• securing and maintaining the Services.

5. Partner Obligations

5.1 Warranty of Legal Basis and Transparency: The Partner represents, warrants, and covenants that it has, and will maintain throughout the term of the Agreement:

(a) a valid legal basis under applicable data protection laws (including the GDPR) for Varnish to process Traffic Data as a Sub-processor; and

(b) all necessary approvals, consents, and authorizations from the End-User Controller, and has provided all required transparency disclosures to End-Users regarding Varnish and its infrastructure sub-processors.

5.2 Compliance and flow-down: The Partner is solely responsible for flowing down all relevant data protection terms to its End-Users. The Partner shall immediately notify Varnish if it becomes aware of any withdrawal of consent by an End-User or any instruction from a Controller that would cause Varnish to violate applicable data protection laws.

6. Duration and Deletion of Data

Processing of Traffic Data shall continue for the duration of the Partner's use of the Services. Upon termination of the Services, Varnish shall delete Traffic Data that is no longer required for the provision of the Services or return Traffic Data upon Partner's written request within 15 days of termination. Notwithstanding the foregoing, Traffic Data retained for security, fraud prevention, auditing, or operational purposes may be retained for up to 12 months, after which it will be permanently deleted, unless a longer retention period is required by applicable law.

7. Security Measures

Details of such measures are set out in the Varnish Security Policy, which is provided in a separate document and available at: https://www.varnish-cdn.com/legal/security-and-compliance.

8. Confidentiality

Varnish ensures that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations and access such data only as necessary to perform the Services.

9. Sub-processing

9.1 Authorized Sub-processors: Varnish utilizes various affiliates and third-party infrastructure providers to support the CDN Services. The Partner provides general written authorization for Varnish to engage the Sub-processors listed in the Varnish Privacy Notice https://www.varnish-cdn.com/legal/privacy-policy.

9.2 Sub-processor Obligations: Varnish shall ensure all Sub-processors are bound by written agreements containing data protection terms no less protective than those established in this DPA. Varnish remains fully liable to the Partner for the performance of its Sub-processors' obligations.

10. Geographic Processing and Data Transfers

Traffic Data processed as part of Varnish's Sovereign Service Layer shall be stored and processed within the European Union (EU)/European Economic Area (EEA). Varnish shall not transfer Traffic Data outside the EU/EEA unless instructed by the Partner or required by applicable EU/EEA law. Where the Partner instructs Varnish to deploy nodes or process Traffic Data outside the EU/EEA, the transfer shall be governed as follows:

• Transfers to countries recognized by the European Commission as providing an adequate level of data protection pursuant to Article 45 GDPR shall rely directly on the applicable adequacy decision.
• Transfers to countries without an adequacy decision shall be governed by the EU Standard Contractual Clauses (Module 3: Processor-to-Processor), which are hereby incorporated into this DPA by reference and available at https://www.varnish-cdn.com/

11. Assistance

Varnish shall, taking into account the nature of processing and to the extent technically feasible, assist the Partner in complying with its obligations under the GDPR, including with respect to responding to data subject requests under Articles 12–23 GDPR and meeting obligations relating to security, personal data breaches, data protection impact assessments, and consultations with supervisory authorities, provided that such assistance will be performed at the Partner's cost.

12. Personal Data Breach

Varnish shall notify the Partner without undue delay, and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Traffic Data, and shall provide information reasonably necessary for the Partner to comply with its legal obligations. The Partner is solely responsible for notifying the End-User Controller of the breach.

13. Audit

Upon at least two (2) months' prior written notice from the Partner, Varnish shall make available relevant documentation, audit summaries, or certifications demonstrating compliance with this DPA. Audit shall be limited to processing of Traffic Data under this DPA and reasonably necessary to verify compliance. Audit shall be carried out by the Partner or an independent third-party auditor mandated by the Partner and bound by confidentiality, and shall not unreasonably interfere with Varnish's operations or service delivery. The Customer shall treat all non-public information obtained during the audit as confidential and shall only have access to the information that Varnish provides in relation to the audit. Any audit shall be conducted at the Partner's expense and shall not occur more than once per calendar year.

14. Liability

Liability arising under this DPA shall be subject to the limitations set out in the Partner Agreement.

15. Order of Precedence

In the event of conflict between this DPA and the Partner Agreement, this DPA shall prevail with respect to data protection matters.

16. Governing Law and Dispute Resolution

This DPA shall be governed by the laws and jurisdiction set out in the Partner Agreement, which contains all relevant provisions regarding governing law and dispute resolution.

17. Changes to this DPA

Varnish may update this DPA from time to time to reflect changes in applicable law (including data protection law), industry standards, or updates to the Services, with such changes taking effect upon publication. For material changes, including any material changes to its Sub-processors, Varnish will use reasonable efforts to provide at least 30 days' prior notice. What constitutes a material change shall otherwise be determined at Varnish's reasonable discretion. Any objections to proposed Sub-processor changes must be presented timely and based on reasonable, documented data-protection grounds.