Data Processing Addendum

This DPA reflects the parties’ agreement with respect to the processing of Personal Data by ClearAnts on behalf of Customer in connection with the Platform, in accordance with the requirements of applicable Data Protection Laws, including the Singapore Personal Data Protection Act 2012 (“PDPA”), Indonesia’s Law No. 27 of 2022 on Personal Data Protection (“UU PDP”), and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”).

In the event of any conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA shall prevail.

• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by ClearAnts on behalf of Customer under the Agreement.
• “Processing” means any operation performed on Personal Data, whether or not by automated means.
• “Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under this DPA, including the PDPA, UU PDP, and GDPR where applicable.
• “Sub-processor” means any third party engaged by ClearAnts to process Personal Data on behalf of Customer.

As between the parties, Customer is the data controller (or equivalent role under applicable Data Protection Laws) of Personal Data submitted to the Platform, and ClearAnts is the data processor (or equivalent role) acting on Customer’s documented instructions.

With respect to Personal Data, ClearAnts shall:

• process Personal Data only on documented instructions from Customer, including regarding international transfers, unless required to do otherwise by applicable law;
• ensure that personnel authorized to process Personal Data are bound by confidentiality obligations;
• implement appropriate technical and organizational measures as described in Section 6;
• engage Sub-processors only in accordance with Section 5;
• assist Customer, to the extent reasonably possible, in responding to data subject requests and in meeting Customer’s obligations under Data Protection Laws; and
• at Customer’s choice, delete or return all Personal Data at the end of the provision of the Platform, except where retention is required by applicable law.

Customer authorizes ClearAnts to engage the Sub-processors listed in Annex 2 to support the delivery of the Platform (for example, cloud hosting and infrastructure providers). ClearAnts will impose data protection terms on each Sub-processor that are no less protective than those in this DPA and will remain liable for each Sub-processor’s performance.

ClearAnts will provide reasonable advance notice before adding or replacing a Sub-processor, and Customer may object on reasonable data protection grounds by contacting us at the address in Section 12.

ClearAnts implements technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk, including measures such as: encryption of data in transit, access controls restricting Personal Data to authorized personnel on a need-to-know basis, and logging and monitoring of systems that process Personal Data. Further detail on our security practices is available on our Security page.

Taking into account the nature of the processing, ClearAnts will provide reasonable assistance to Customer, at Customer’s expense where the assistance requires material additional effort, to enable Customer to respond to requests from data subjects exercising their rights under applicable Data Protection Laws.

ClearAnts will notify Customer without undue delay after becoming aware of a Personal Data breach affecting Customer’s Personal Data, and will provide reasonably available information to help Customer meet any obligation to notify supervisory authorities or affected individuals under applicable Data Protection Laws.

On Customer’s reasonable written request, and no more than once per year, ClearAnts will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable confidentiality restrictions and advance notice.

ClearAnts is headquartered in Singapore and operates a team in Indonesia. Where Personal Data is transferred outside of the jurisdiction in which it was collected, ClearAnts will ensure that the transfer is subject to appropriate safeguards required under applicable Data Protection Laws, such as the transfer requirements under the PDPA or, where GDPR applies, EU Standard Contractual Clauses.

This DPA remains in effect for as long as ClearAnts processes Personal Data on behalf of Customer under the Agreement. Upon termination of the Agreement, ClearAnts will delete or return Customer’s Personal Data in accordance with Section 4.

• Subject matter: Provision of the ClearAnts DevSecOps platform to Customer.
• Duration: For the term of the Agreement, unless otherwise agreed in writing.
• Nature and purpose of processing: Hosting, storage, and processing of data submitted by Customer to the Platform for the purpose of delivering security testing and DevSecOps functionality.
• Categories of data subjects: Customer’s authorized users (e.g. employees, contractors) who access the Platform.
• Types of Personal Data: Account and contact information of authorized users (name, work email, role) and any Personal Data that may be incidentally contained within data submitted by Customer to the Platform.

ClearAnts’ current list of Sub-processors is available upon request by contacting us at the address in Section 12. We will make reasonable efforts to keep an up-to-date list available to Customers under an active subscription to the Platform.

Questions about this DPA can be directed to our Data Protection Officer at info@clearants.io.