Use & Processing · Context
A data processing addendum is incorporated, with transfer mechanisms for EEA, UK and Swiss personal data
The data processing addendum (DPA) posted at a Salesforce legal web page as of the Effective Date is incorporated by reference. When personal data from the European Economic Area, the United Kingdom or Switzerland is processed by SFDC, its Processor Binding Corporate Rules and/or the Standard Contractual Clauses apply as set out in the DPA. For those clauses the Customer and its applicable Affiliates are each the data exporter, and the Customer's acceptance of the Agreement, or an Affiliate's execution of an Order Form, counts as executing the clauses and their appendices.
Details
- What it covers
- Data processing addendum; Standard Contractual Clauses; Processor Binding Corporate Rules
- Where
- EEA, United Kingdom and Switzerland personal data
- When
- DPA as posted on the Effective Date
Supporting quotations
The terms of the data processing addendum at https://www.salesforce.com/company/legal/agreements/ (“DPA”) posted as of the Effective Date are hereby incorporated by reference.
To the extent Personal Data from the European Economic Area (EEA), the United Kingdom and Switzerland are processed by SFDC, its Processor Binding Corporate Rules,, and/or the Standard Contractual Clauses shall apply, as further set forth in the DPA.
For the purposes of the Standard Contractual Clauses, Customer and its applicable Affiliates are each the data exporter, and Customer's acceptance of this Agreement, and an applicable Affiliate's execution of an Order Form, shall be treated as its execution of the Standard Contractual Clauses and Appendices.
Qualifications & exceptions
- Applies to personal data from the EEA, UK and Switzerland that SFDC processes.
- The DPA version incorporated is the one posted as of the Effective Date.
Not stated here
- The DPA text is not supplied, so what it says about processing, sub-processors or onward transfers is unknown.
Also annotated in the same passage (7)
- SFDC commits to administrative, physical and technical safeguards for Customer Data
- After termination, Customer has 30 days to ask for its data; later SFDC will delete it
- Dealings and data exchange with third-party apps are between the Customer and the provider; SFDC is not responsible
- Each party must protect the other's Confidential Information with reasonable care and limit its use and access
- SFDC warrants accurate security descriptions, no material security or functionality decrease, and performance
- Free Services, fees, IP, confidentiality, disclaimers, indemnities and liability terms survive termination
- SFDC supports Deletion Requests as far as law permits, using the procedures and timeframes in its documentation