Exhibit 10.1
2022-11-16
Certain confidential information contained in this document, marked by brackets, has been omitted pursuant to Item 601(b)(10)(iv) of Regulation S-K.
ORDER NUMBER 644C364335B7365C8DF202F6 - RELATIVITYONE
This Order Number 644c364335b7365c8df202f6 (“Order”) is subject to and governed by the Master Terms and Conditions dated June 1, 2023 (“Master Terms”) executed between Relativity ODA LLC (“Relativity”), and KLDiscovery Ontrack, LLC (“Customer”). Capitalized terms used in this Order but not defined have the meanings set forth in the Master Terms.
ORDER DETAILS
Order Effective Date |
June 1, 2023 |
|
Software |
SaaS Product known as “RelativityOne,” plus the following additional products: [ ] [*] [ ] [*] [ ] [*] [X] [*]: [ X] [*] |
|
Documentation |
https://help.relativity.com/ |
|
Subscription |
Multi-Year Flex Commit |
|
Subscription Term |
36 months commencing on Order Effective Date, comprised of: June 1, 2023 to May 31, 2024 (“Period 1”) June 1, 2024 to May 31, 2025 (“Period 2”) June 1, 2025 to May 31, 2026 (“Period 3”) |
|
Customer Contacts |
Billing contact: Attn: Accounts Payable Email: ap@kldiscovery.com Bill To Address: Attn: Dawn Wilson, CFO, 9023 Columbine Road, Eden Prairie, MN 55347, United States |
Security contact: Attn: Jason Davison Email: jason.davison@kldiscovery.com |
1
2
Additional terms are set forth in the “Special Terms” section and “Order Terms” section below.
SPECIAL TERMS
Installment Payments. Notwithstanding the Prepay Amount due dates set forth above, Relativity permits Customer to pay Prepay Amounts in accordance with the installment schedule below provided that: (a) Customer will pay Relativity an additional installment premium of 0% on Relativity’s standard fees, which is reflected in the fees set forth above; (b) Customer is still required to pay all installment payments even if the Customer does not use the Software to the full extent permitted under this Order; (c) if the Agreement, this Order expires or is terminated when there are any remaining installment payments, those payments are due at that time; and (d) Relativity reserves the right to decline to permit installment payments for any subsequent Period or other Software. In any event, if Customer fails to pay any installment amount when due under this Order, any remaining installment payments will thereupon become due, and Relativity may decline to permit Customer to pay any other fees on an installment basis.
INSTALLMENT PAYMENT SCHEDULE |
||
Installment |
Installment Amount Due Date |
Installment Amount Due |
1 |
6/1/2023 |
$[*] |
2 |
1/1/2024 |
$[*] |
3 |
6/1/2024 |
$[*] |
4 |
1/1/2025 |
$[*] |
5 |
6/1/2025 |
$[*] |
6 |
1/1/2026 |
$[*] |
Hybrid User Modifications. User Access.
Customer and Relativity are parties to that certain Software License Agreement dated January 1, 2021, as amended from time to time (collectively, the “Software License Agreement”), which grants Customer a
3
License (as defined in the Software License Agreement) to Software known as “Relativity” (the “Server Product”) with a “Server User Cap” of a specified number of “Server Users” (the “Server User Subscription”) and a monthly fee per Server Users in excess of the Server User Cap. For so long as Customer has a license to use the SaaS Product: (a) Customer may enable any or all Server Users to access the Server Product and/or the SaaS Product; and (b) the reference to the “Software” in the definition of “Server User” as defined in the Software License Agreement shall refer to the Server Product and/or the SaaS Product. In addition to the Server User Subscription, Customer grants RelOne Users access to the SaaS Product as specified herein; provided, notwithstanding Section 2.2 of the Order Terms, RelOne Users shall be counted in accordance with the terms below.
Calculation of User Fees.
Notwithstanding Section 2.1 of the Order Terms, during the Subscription Term, Relativity will determine the monthly User Fees due for RelOne Users by identifying the total number of RelOne Users in all Geos during the preceding calendar month (“Monthly User Count”). If Customer has not fully used its Server User Subscription in a given calendar month, Relativity will first count RelOne Users as Server Users under the Server User Subscription until the Server User Cap has been fully satisfied in such month. Notwithstanding the foregoing: (i) Customer acknowledges that Relativity may not be able to determine whether a RelOne User should be considered a Server User in a calendar month where Customer does not properly submit billing and usage metrics; and (ii) accordingly, Relativity will count all RelOne Users towards the Monthly User Count in any calendar month where Relativity does not receive the billing and usage metrics (without limiting other remedies).
Relativity will use reasonable efforts to de-duplicate RelOne Users across all Geos and charge only for unique RelOne Users, however, if Customer alters any user profile in a calendar month, each profile will be counted as a RelOne User for that calendar month. If Customer determines that Relativity double charged for the same RelOne User, Customer may ask Relativity to review the charge and, if appropriate, provide a credit. For the sake of clarity, Relativity will de-duplicate Server Users as provided in the Software License Agreement.
Definition of RelOne Users.
Notwithstanding Section 2.2 of the Order Terms, “RelOne Users” means:
“any other Authorized Users who are (1) given access to the SaaS Products at any time during the month in question, regardless of whether the Authorized Users actually log into or use the SaaS Products or whether their access is disabled before the month ends, and (2) not also given access to the Server Products at any time during the same month.”
SIGNATURES
The parties have caused this Order to be executed by their respective duly authorized officers or representatives as of the Order Effective Date.
RELATIVITY ODA LLC |
KLDISCOVERY ONTRACK, LLC |
Signature: /s/ Sailesh Munagala |
Signature: /s/ Andrew Southam |
Name: Sailesh Munagala |
Name: Andrew Southam |
Title: CFO |
Title: General Counsel |
ORDER TERMS
Customer will pay the Prepay Amount for each period in the Subscription Term (each a “Period”). The Prepay Amount
4
will be used to offset the Period Subscription Fees and Monthly Subscription Fees incurred by Customer during each Period. Period Subscription Fees will be incurred in advance on the first day of the applicable Period and Monthly Subscription Fees will be incurred monthly in arrears.
When the Prepay Amount for a given Period has been reduced to $0, Customer will pay all Monthly Subscription Fees and Period Subscription Fees as incurred (each an “Interim Payment”). If Customer makes any Interim Payment during Period 1 or Period 2, the Prepay Amount for Period 3 will be reduced by the amount of the Interim Payments. If the Interim Payments made during Period 1 or Period 2 exceed the Prepay Amount for Period 3, then (a) there will be no Prepay Amount due for Period 3 (i.e., Customer will pay all Period 3 Monthly Subscription Fees and Period Subscription Fees as incurred); and (b) the Prepay Amount for Period 2 will be reduced by the amount of the excess Interim Payments. If the Interim Payments made during Period 1 exceed the Prepay Amount for Period 2 and Period 3, then there will be no Prepay Amounts due for Period 2 or Period 3 (i.e., Customer will pay all Period 2 and Period 3 Monthly Subscription Fees and Period Subscription Fees as incurred).
If Customer overutilizes its total commitment (i.e. the amounts offset against the Prepay Amounts are equal to or greater than the total of all Prepay Amounts due under this Order), the Subscription Term will not be reduced as a result, and Customer will continue to pay all Monthly Subscription Fees and Period Subscription Fees as incurred until the Subscription Term expires.
Any unused portion of the Prepay Amount paid with respect to one Period, will be rolled forward to the next Period. Notwithstanding the foregoing, any unused portion of the Prepay Amounts at the end of the Subscription Term, or upon any earlier termination of this Order or the Agreement, will be retained by Relativity and will not be refunded to Customer or rolled forward to any renewal subscription (except as expressly required under the Master Terms).
Relativity will determine the monthly User Fees due by identifying the total number of RelOne Users in all Geos during the preceding calendar month (“Monthly User Count”). During the Term, the number of RelOne Users in the Geo licensed under this Order will not be counted with: (a) RelOne Users in any other licensed Geo for purposes of determining the Monthly User Count; or (b) if applicable, the number of users in the Server Product for purposes of calculating the Monthly User Count or any additional user fees in the Server Product. Relativity will use reasonable efforts to de-duplicate RelOne Users across all Geos and charge only for unique RelOne Users, however, if Customer alters any user profile in a calendar month, each profile will be counted as a RelOne User for that calendar month. If Customer determines that Relativity double charged for the same RelOne User, Customer may ask Relativity to review the charge and, if appropriate, provide a credit.
“RelOne Users” means any Authorized Users who are given access to the Software at any time during the month in question, regardless of whether the Authorized Users actually log into or use the Software or whether their access is disabled before the month ends.
If Customer chooses to establish a link (“Connection”) between a Geo and a third party’s (“Connected Party”) Geo, Customer can grant the Connected Party’s Authorized Users (collectively “Connected Users”) access to Customer’s Geo. The Connected Users will not be counted and billed as RelOne Users in Customer’s Geo; provided, the Connected Users must access Customer’s Geo through the established Connection using a Connected Party-assigned email address (including the individual’s own name and Connected Party’s domain name). Customer will retain full responsibility for (a) the security and use of Connected Users' permissions within the Geo; and (b) all access to and
5
use of the Geo by such Connected Users. Customer may disable access to the Geo for any Connected User through the standard permission controls available in the Software. To terminate access for all Connected Users, Customer must disable the Connection.
The amount of Customer Data in each workspace type (except Trace Workspaces and the Staging Area) will be set as of the Monthly Count Date during each calendar month of the Subscription Term. The “Monthly Count Date” will be the highest data count point in all Standard Workspaces across all of Customer’s Geos. Relativity will determine the monthly Cloud Fees due for each workspace type (except Trace Workspaces and the Staging Area) in each Geo using the amount of Customer Data in such workspace type as of the Monthly Count Date (rounded up to the nearest GB). If any Geo is subject to minimum monthly Cloud Fees, the monthly Cloud Fees due for that Geo will be the greater of: (a) the actual Cloud Fees incurred; or (b) the minimum monthly Cloud Fees set forth above, regardless of actual usage.
Relativity will determine the monthly Cloud Fees due for the Staging Area using the highest data storage point (rounded up to the nearest GB) in the Staging Area during the preceding calendar month.
Repository Workspaces may only be used to store Customer Data and perform early case assessment. Customer may not use a Repository Workspace to perform any document review work or for any production purposes whatsoever, and Customer may not limit the default functionality on any Repository Workspace. Further, Repository Workspaces are subject to the limitations set forth in the Documentation, which include, for example, limits on the permitted number of records in any Repository Workspace, the allotted number of document views in any Repository Workspace, and the permitted number of Authorized Users that may access any Repository Workspace. Relativity will not change the limitations set forth in the Documentation without providing at least one (1) year’s notice. Customer may not circumvent limits on Repository Workspaces by dividing cases or investigations between multiple Repository Workspaces. A Repository Workspace will be considered a Standard Workspace for billing purposes in any calendar month where Customer violates any of the restrictions or limitations set forth in this Section or the Documentation.
Cold Workspaces may only be used to store Customer Data. A Cold Workspace will be considered a Standard Workspace for billing purposes in any calendar month in which Customer retrieves the Cold Workspace. Customer may retrieve a Cold Workspace by selecting “Retrieve” in the Cold Workspace. Customer’s Cold Workspace will be retrieved and restored within five (5) days. Notwithstanding the foregoing, the Cold Workspace will be considered an active Standard Workspace or Repository Workspace for billing purposes as soon as Customer selects the “Retrieve” option.
Data usage is measured by the size of the information, records and other data imported, stored and/or created in the Software. Where records have corresponding entries in the file table (including native files, images, and
production images), that data usage is based on the size of those files. Where records do not have corresponding file table entries, Relativity may elect to tally and convert the number of such records to a GB measurement by dividing the number of such records by 4,000. All data in the Staging Area is measured by the size of the files.
“Geo” means the installation of the SaaS Product. Geos are hosted in data centers in various countries around the
6
world (“Region”) and Relativity currently relies on the Microsoft Azure Platform as its underlying infrastructure.
During the Subscription Term, Customer may terminate one or more Geos as of the first day of the next Period (the “Anniversary Date”); provided: (a) Geos subject to minimum monthly Cloud Fees may not be terminated (although such Geos may be decommissioned or transferred to alternative Regions, as set forth below); (b) Customer must deliver written notice to Relativity at least 60 days prior to the Anniversary Date; and (c) all Customer Data must be removed from the terminated (or decommissioned) Geo on or before the Anniversary Date. For the sake of clarity, if Customer decommissions a Geo subject to minimum monthly Cloud Fees, Customer will not incur the minimum monthly Cloud Fees until such Geo has been reactivated.
During the Subscription Term, Customer may transfer one or more Geos to alternative Regions commencing as of the next Anniversary Date; provided: (a) Customer must deliver written notice to Relativity at least 60 days prior to the Anniversary Date and such notice must state the Region where the existing Geo is located and the Region where the new Geo should be activated (“New Region”); (b) all Customer Data must be removed from the existing Geo on or before the Anniversary Date; and (c) on the Anniversary Date, Relativity will decommission the existing Geo and provide Customer with access to a Geo in the New Region. For the sake of clarity, if the existing Geo was subject to any fees, Customer will continue to incur all such fees for the remainder of the Subscription Term.
Translate is a translation tool that performs translation of document text in certain languages. Translate is offered to Relativity customers who subscribe to the SaaS Product and is subject to the terms of the Agreement and the Documentation.
Customer will be charged Translate Fees based on the Unit Price for Document Units after utilizing the Included Document Units. “Unit Price” in the Order is the price for each Document Unit. “Document Unit” means the translation of a document using Translate, up to a character limit of 25,000 characters (“Translation Character Limit”). If a document exceeds the Translation Character Limit, the excess number of characters translated will be counted as the next Document Unit, for up to the Translation Character Limit. “Included Document Units” means the number of included Document Units set forth in the Order. Included Document Units may not be available for any extension or replacement of the Subscription Term.
TRANSLATE IS PERFORMED ENTIRELY BY MACHINE LEARNING MADE AVAILABLE BY MICROSOFT ON MICROSOFT AZURE. SOME FILES AND DATA TYPES MAY BE INCAPABLE OF ACCURATE TRANSLATION USING TRANSLATE. TRANSLATE IS NOT INTENDED TO REPLACE HUMAN TRANSLATORS.
Intentionally Omitted.
Intentionally Omitted.
Intentionally Omitted.
For clarity, the Development Tool Terms incorporated by reference into this Order contain additional terms, including terms respecting any Sandboxes that Customer pays fees for under this Order. Such terms are accessible as specified below.
7
If applicable during the Term, Customer may appoint a “Provider of Record” to provide ongoing services to Customer in the SaaS Product, subject to the Provider of Record Terms. Customer must appoint such Provider of Record by sending an email to sales@relativity.com, which: (a) identifies the name of the Provider of Record, and (b) sets forth the appointment date of the Provider of Record. If Customer appoints a Provider of Record, Customer acknowledges that the Provider of Record may receive the benefits outlined in the Provider of Record Terms.
Intentionally Omitted.
Documents incorporated by reference (not modified without Customer’s consent) |
|
Support Terms |
https://kcura.my.salesforce.com/sfc/p/5000000072uY/a/1T000000T3bN/TSR1qP a8Q4khAZUAccLFnHrypQLxid2bko3xeIHwWsY |
Service Level Terms |
https://kcura.my.salesforce.com/sfc/p/5000000072uY/a/1T000000T3bI/PtC5_JW aC_MHLPlgSybyR48smTUCauV4KEU2ZDlIl9c |
Data Security Terms |
https://kcura.my.salesforce.com/sfc/p/5000000072uY/a/Hs0000018kLY/NNFh8M zRv3S_n.7N8RW32KRXL47tYSg8775hMZ9Pafk |
Development Tool Terms |
https://kcura.my.salesforce.com/sfc/p/5000000072uY/a/1T0000016TUt/Xjq1bale uqvvBdIRmEfTh2XEVtxwMpAa.t8DCwLJq3g |
Provider of Record Terms |
https://kcura.my.salesforce.com/sfc/p/5000000072uY/a/1T000000T6rZ/pBTj0RzD gAw3f5FRKAinDicD3DFkP6yW.K9fsClNHfwN/A |
8
2022-08-31
MASTER TERMS AND CONDITIONS
These Master Terms and Conditions (“Master Terms”) effective on June 1, 2023 (“Effective Date”) are by and between Relativity ODA LLC, a Delaware limited liability company (“Relativity”) and KLDiscovery Ontrack, LLC, a Delaware limited liability company (“Customer”).
Access Credentials Any username, password, license or security key, or other information used to verify an individual's identity and authorization to access and use the Software.
Affiliate With respect to any entity, any other entity that directly or indirectly controls, is controlled by, or is under common control with such entity, where “control” (including “controlled by” and “common control”) means the ability to, directly or indirectly, direct the management, operations or policies of such entity.
Agreement Collectively, these Master Terms and any Orders.
Authorized User Any person who accesses the Software using Access Credentials for or on behalf of Customer. Authorized Users may include Representatives, End User Customers and Affiliates of Customer, and their end users.
Claim Claim, action, cause of action, demand, lawsuit, arbitration, inquiry, audit, notice of violation, proceeding, litigation, citation, summons, subpoena, or investigation of any nature, whether civil, criminal, administrative, regulatory, or other, whether at law, in equity or otherwise.
Confidential Information Information, whether disclosed orally or in writing, that is identified by the disclosing party as confidential or that is of a nature that a reasonable person would suspect to be confidential or proprietary to the disclosing party or a third party, including information relating to a party’s business practices, products, product development, research, marketing plans, customer information, financial information, and pricing rates and methodologies. For purposes of clarity, Customer’s Confidential Information includes Customer Data and Relativity’s Confidential Information includes the Software and the terms of the Agreement.
Customer Data All documents, files and other data that Customer or its Authorized Users import into the Software and all work product results of all work that Customer and its Authorized Users perform respecting such data in the Software. For clarity, Customer Data does not include system and data usage metrics and billing information, Usage Data, or any systems’ operations, performance or security information.
Data Security Terms The Data Security Terms to the extent incorporated by reference into an applicable Order.
Derivative Works Every translation, portation, modification, correction, addition, extension, upgrade, improvement, compilation, abridgment or other form in which an existing work may be recast, transformed or adapted, including any
1
software, technology, methods or processes that a person skilled in the arts would consider to be derived from the existing work or from the existing
work owner’s technology, methods or processes protected by copyright, patent or trade secret laws.
Development Tools Tools by which Customer, or a third party acting on behalf of Customer, may add customizations, enhancements, or extensions to the Software, as further defined in the Development Tool Terms.
Development Tool Terms The Development Tool Terms incorporated by reference into an applicable Order.
Documentation The documentation for the Software referenced in the applicable Order.
End User Customer Any third party to which Customer provides services, either directly or indirectly.
Harmful Code Any software, hardware, or other technology, device, or means, including any virus, worm, malware, or other malicious computer code, the purpose or effect of which is to permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner any: (a) computer, software, firmware, hardware, system, or network; or (b) application or function of any of the foregoing or the security, integrity, confidentiality, or use of any data processed thereby.
Intellectual Property Rights Any and all rights arising from or under any of the following, whether protected, created or arising under the Laws of the United States of America or any other jurisdiction: patents (including any applications, extensions, divisions, continuations, continuations-in-part, reexaminations, reissues, and renewals related thereto), copyrights (including any applications, registrations and renewals related thereto), trademarks and service marks (including applications, registrations and renewals related thereto), trade dress, trade names, trade secret and know-how and any other intellectual property or proprietary rights of any nature, by whatever name or term known or however designated.
Laws Statutes, laws, ordinances, regulations, rules, codes, orders, constitutions, treaties, common laws, judgments, decrees, or other requirements of any federal, state, local, or foreign government, including any of the foregoing respecting the security and privacy of personal data, anti-bribery and anti- corruption, anti-terrorism, non-discrimination and non-harassment, and export restrictions.
Losses Losses, damages, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys' fees.
Order An order referencing these Master Terms, including (a) to the extent expressly referenced therein, any attachments thereto or documents incorporated therein, and (b) any amendments thereto.
Representatives (a) with respect to Relativity, Relativity’s employees, officers, directors, consultants, agents, independent contractors, service providers,
2
subcontractors, and legal advisors; (b) with respect to Customer, Customer’s employees, officers, directors, consultants, agents, independent contractors, service providers, subcontractors, and legal
advisors; and (c) with respect to Affiliates, the Affiliate’s employees, officers, directors, consultants, agents, independent contractors, service providers, subcontractors, and legal advisors.
SaaS Product Relativity Software accessed and used as a software-as-a-service platform.
Server Product Relativity Software deployed and used behind Customer’s firewall, at Customer’s site, in a cloud data center or in a colocation facility managed by Customer or any other party on behalf of Customer (other than Relativity), for Customer’s benefit.
Server License means the license to the software granted under the Software License Agreement between Customer and Relativity dated January 1, 2021, amended from time to time.
Service Level Terms The Service Level Terms incorporated by reference into an applicable Order.
Software All technology components incorporated in or made available in connection with a SaaS Product, the Development Tools and any other software products, each as identified in any Order, along with any Documentation relating thereto and any know-how provided by Relativity in connection with the provision of the Software or related services designed to assist Customer with the operation of the Software. For clarity, the term “Software” in any documents incorporated by reference into any Order refers only to the Software described in that Order.
Support Terms The Support Terms incorporated by reference into an applicable Order.
Relativity hereby grants Customer a worldwide, non-exclusive, non-transferable (except in compliance with Section 15.3) right of access to and use of the Software during the Subscription Term (as set forth in the applicable Order). The right granted in this Section 2.1 includes permission to import, process, review, use, copy, store, and transmit Customer Data to, in and from the Software, subject to the terms of the Agreement.
Customer may provide access to the Software to any of its Affiliates, End User Customers, and their end users, to enable them to be Authorized Users. Access to and use of the Software by any Authorized User will be considered access to and use of the Software by Customer for purposes of the Agreement. For purposes of clarity: (a) all Authorized Users’ billable items will be aggregated with Customer’s billable items for purposes of determining fees due under the applicable Order; (b) Customer will be responsible for payment of all fees due under the Agreement; (c) Customer shall cause all Authorized Users to comply with the Agreement; and (d) Customer will be responsible for the acts and omissions of each Authorized User, including any failure by any Authorized User to comply with the Agreement, as though they were the acts and omissions of Customer.
3
Customer may not host or sub-host the Software, administer the Software or provide or enable any functions of the Software on behalf of any End User Customer under any white label or private label re- hosting arrangement. Without limiting the generality of the foregoing, Customer shall: (i) not permit any End User Customer’s website to link to the Software; (ii) prominently display Customer’s name and logo
on all landing pages and log-in screens; (iii) except as otherwise authorized by Relativity in writing, not use any End User Customer’s name in any URL used, directly or indirectly, to access the Software; and (iv) except as otherwise authorized by Relativity in writing, not provide any of Relativity’s materials or other property to any End User Customer. If Relativity notifies Customer that it has violated any of the foregoing restrictions, Customer will take all steps reasonably identified by Relativity to remedy the violation. Relativity has no obligation to accept or respond to communications from any End User Customer or its customers.
Customer will require each Authorized User to have separate Access Credentials. Neither Customer nor any Authorized User will share or repurpose Access Credentials, regardless of whether the sharing occurs at the same or different times. The username of each Authorized User must be a unique working email address. Customer will be responsible for all access to and use of the Software utilizing Customer Access Credentials. Customer will promptly notify Relativity of any known or reasonably suspected unauthorized use of any Access Credentials.
Relativity will provide the maintenance and support services as set forth in the Support Terms identified in the applicable Order (“Services”). Upon Customer’s request and at Relativity’s discretion, Relativity may provide additional services relating to the Software, pursuant to written documentation between the parties and payment of Relativity’s then-current hourly rates.
Customer acknowledges that in connection with any services provided in connection with the Agreement (including Services), neither Relativity nor any Relativity Representative is providing legal advice or interpretation of legal documents. Services provided by Relativity and Relativity Representatives are not intended to be, and should not be construed as, legal advice. Customer is solely responsible for its use of the Software, including deciding whether, to what extent, and how to use particular features of the Software for any given use case.
Relativity may make changes to the Software at its discretion, including to enhance the quality, delivery or performance of the Software, and to provide Corrections (as defined in the Support Terms identified in the applicable Order). The timing of any updates to a SaaS Product shall be at Relativity’s discretion. Relativity will not make any changes to the Software during the Subscription Term (as set forth in the applicable Order) that materially degrade the overall functionality of the Software, unless: (a) the changes are to comply with applicable Laws; (b) the changes are required to resolve a defect or security issue; or
(c) Relativity provides a functional equivalent.
From time to time, Relativity may make additional products available. At Relativity’s discretion, such additional products may be: (i) included with the Software at no additional charge, in which case such products are subject to the terms of the Agreement unless stated otherwise in the Documentation; or (ii) made available for additional fees, in which case Customer may choose to subscribe to such products by signing an additional Order.
4
Customer will not, and will not permit any third party to:
(ii) attempt to gain unauthorized access to other deployments of the SaaS Product or any shared systems, products or networks;
Relativity and its third-party vendors own and will continue to own the entire title and interest in and to the Software and all Intellectual Property Rights related to the Software, including all Derivative Works thereof, and any know-how, methodologies or other materials Relativity provides. Nothing in the Agreement, or the negotiation or performance thereof, grants any right, title or interest in or to the Software or any such Intellectual Property Rights, whether expressly, by implication, estoppel, or otherwise. Customer has no right to access any source code.
Relativity may make available certain Development Tools. Any access to and use of the Development Tools by Authorized Users is subject to the Development Tool Terms identified in the applicable Order. As between Relativity and Customer, Customer is free to claim ownership of all Intellectual Property Rights in Custom Applications (as defined in the Development Tool Terms) created by Customer or any third
5
party on behalf of Customer through use of the Development Tools, provided: (a) the Custom Application shall not include any portion of the Software or the Development Tools, or any Derivative Works thereof; and (b) Customer (or any third party acting on behalf of Customer) will not acquire any ownership interest in any portion of the Software or the Development Tools, or any Derivative Works thereof, either by
express or implied agreement or by operation of Law. To the extent that Customer writes any scripts or source code that modify the Software or the Development Tools, such scripts or source code shall be deemed Derivative Works of the Software, and Relativity will own such Derivative Works.
Customer is solely responsible for procuring and maintaining its network connections and telecommunications links from its systems to the data centers, and Relativity will not be responsible for resolving any problems, conditions, delays, or delivery failures, or liable for any loss or damage arising from or relating to Customer’s network connections or telecommunications links or caused by the Internet.
Customer will pay Relativity the fees set forth in the applicable Order in accordance with the payment terms in this Section 3 and in the applicable Order.
Relativity will invoice Customer for fees set forth in the applicable Order. Invoices will be sent electronically to the email address set forth in the applicable Order. Unless otherwise set forth in the applicable Order, all payments will be made in US dollars, without adjustment for changes in exchange rates. Customer will pay all undisputed amounts within 30 days after Customer’s receipt of the invoice (the “Payment Due Date”). Relativity has the right to apply any payments made by Customer to offset any past or future amounts due.
Customer will notify Relativity of any disputed amounts prior to the Payment Due Date, setting forth the source of the dispute in reasonable detail, and the parties will work promptly and in good faith to resolve the dispute. If it is determined that all or any portion of the previously disputed amount is owed to Relativity, Customer will promptly pay that amount to Relativity.
All fees are exclusive of applicable taxes. Without limiting the foregoing, Customer is responsible for all sales, use, excise, value-added, or other tax, fee, tariff, or other duty of any kind imposed under applicable Laws on any amounts payable by Customer hereunder, other than any taxes imposed on Relativity's income (collectively, “Taxes”). Customer will self-report and pay all Taxes directly to the taxing body, unless Relativity is legally required to collect and remit any Taxes, in which case Relativity will invoice Customer for those Taxes. If Customer is required to withhold and remit any Taxes from amounts payable under the Agreement, Relativity will gross-up each invoice to include the total amount due plus any applicable withholding. Customer will indemnify and hold Relativity harmless from and against any Losses incurred by Relativity in connection with any failure by Customer to remit any Taxes. Applicable tax rates and requirements will be determined by Customer’s shipping address set forth in the applicable Order.
6
If Customer fails to pay any undisputed amount by the Payment Due Date, then in addition to all other remedies that may be available, Relativity may (a) charge interest on the past due amount at the rate of 1% per month or, if lower, the highest rate permitted under applicable Laws; and (b) decline to permit Customer to add products. If Customer fails to pay undisputed amounts more than 30 days after the Payment Due Date, Relativity may suspend Customer’s access to the Software and/or performance of
Services until all past due amounts and interest thereon have been paid. Customer will reimburse all costs and fees incurred by Relativity in connection with collection of unpaid fees.
Customer’s billing and usage metrics will be delivered to Relativity through the Software as set forth in the Documentation. Relativity provides an optional feature by which Customer may choose to obfuscate case, client or matter names, and the personal name portion of the email address used for Access Credentials. If Customer uses the obfuscation feature and has more than one deployment of the Software, Relativity may require that Customer consistently use the obfuscation feature across all deployments to allow Relativity to bill consistently. Customer will provide any requested information as may be reasonably necessary for Relativity’s billing and auditing purposes, and reasonably cooperate in: (a) running and providing the results of usage and billing scripts; (b) providing Relativity with certifications respecting usage metrics; and (c) granting Relativity remote, supervised, secure access to Customer’s account to verify billing and usage metrics.
As between Customer and Relativity, Customer is responsible for the content and use of Customer Data, and will remain the sole and exclusive owner of all right, title and interest in and to Customer Data, including all Intellectual Property Rights relating thereto.
Customer grants Relativity a non-exclusive, non-transferable (except in compliance with Section 15.3) right to access and use Customer Data for the purpose of providing the Software and performing Relativity's obligations under the Agreement.
Relativity will use commercially reasonable efforts to safeguard Customer Data as set forth in: (a) the Data Security Terms; and (b) any Data Processing Agreement attached hereto as Exhibit A.
Relativity may collect, reproduce, distribute, modify, and otherwise use and publish data and other information that Relativity compiles or derives, relating to or arising from the performance or use of the Software by Customer and its Authorized Users, including statistics, metrics and analytic data, and any data and other information derived therefrom (collectively, “Usage Data”); provided, however, that, Usage Data shall be anonymized and aggregated, and shall never contain any information by which any person would reasonably be able to identify the Confidential Information of Customer, Customer, or any other person or party. As between Relativity and Customer, Relativity shall be the sole and exclusive owner of all right, title and interest in and to Usage Data, including all Intellectual Property Rights relating thereto.
7
Relativity represents and warrants to Customer that:
representation and warranty set forth in this Section 5.1(b), is termination in accordance with Section 7.2(b));
Customer represents and warrants to Relativity that:
The representation and warranty set forth in Section 5.1(b) will not apply to the extent of any non- conformance arising from abuse, misapplication, or other user errors by Customer, or any use of the Software not in conformance with the Documentation, or use of the Software in combination or operation with any software, hardware, service, or data not provided by Relativity or identified as a specific technical requirement in the Documentation, to the extent the nonconformity would not have occurred in the absence of such combination or operation. Relativity does not warrant that the functions or the results of using the Software will be suitable for Customer’s intended use (including sufficiency, accuracy, reliability or legal compliance), that the operation of the Software will be timely, uninterrupted or error-free, or that the Software will be secure from unauthorized access or hacking or free of Harmful Code. The express warranties made herein are in lieu of, and to the exclusion of, all other warranties, conditions or representations of any kind, express or implied, statutory or otherwise, relating to the Software or Services. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, RELATIVITY EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY IMPLIED WARRANTIES OR OTHER OBLIGATIONS ARISING FROM COURSE OF PERFORMANCE, COURSE OF DEALING OR USAGE OF TRADE,
8
AND ALL SUCH WARRANTIES, CONDITIONS AND REPRESENTATIONS ARE EXCLUDED FROM THE AGREEMENT AND WAIVED TO THE FULLEST EXTENT NOT PROHIBITED BY LAW.
In connection with the Agreement, each party may disclose or make available Confidential Information to the other party. A party receiving or having access to the Confidential Information of the other party will:
If a party or any of its Representatives or Affiliate Representatives is compelled by applicable Laws to disclose any Confidential Information of the other party then, to the extent permitted by applicable Laws, the party will promptly, and prior to such disclosure, notify the other party in writing of such requirement so that the other party can seek a protective order or other remedy and will provide reasonable assistance to the other party, at the other party’s sole cost and expense, in opposing such disclosure or seeking a protective order or other limitations on disclosure. For purposes of clarity, the party being compelled to disclose Confidential Information of the other party is not required to suffer any legal detriment or penalty to comply with this Section 6.2 and shall be entitled to disclose Confidential Information of the other party to the extent required by applicable Laws without incurring any liability to the other party thereby.
The obligations of this Section 6 do not apply to information that:
9
Each party acknowledges and agrees that a breach or threatened breach by it of its obligations under this Section 6 may cause the other party irreparable harm for which monetary damages would not be an adequate remedy. Accordingly, in the event of such breach or threatened breach, the other party will be entitled to seek equitable relief, including a restraining order, an injunction, specific performance, and any other relief that may be available from any court, without any requirement to post a bond or other
security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity or otherwise.
These Master Terms commence on the Effective Date and will remain in effect for as long as any Order is in effect. For purposes of clarity, termination of the Agreement under Section 7.2 will automatically terminate all Orders then in effect.
A party may terminate the Agreement (or any particular Order which is the subject of the breach or failure) immediately upon written notice:
Relativity may terminate the Agreement if Customer fails to pay any undisputed amount within 30 days of the Payment Due Date, and such failure continues for 15 days after Relativity has provided written notice of such failure.
Immediately following the early termination of an Order (other than a termination based on Customer’s breach of the Agreement or any Order, or a termination based on bankruptcy), Customer may elect to continue using the Software under the Agreement for a period of 30 days (the “Transition Period”) by delivering notice to Relativity within ten (10) days of the termination date. During the Transition Period, the Agreement will remain in full force and effect and Customer will pay all fees and charges for access to and use of the Software during the Transition Period at the rates set forth in the applicable Order.
Upon any expiration or termination of the Agreement (or specific Order), or expiration of any Transition Period:
10
period commencing on the date of the event giving rise to the right to terminate, and Customer will be relieved of any obligation to pay any further fees under any terminated Order; and
Upon any expiration or termination of the Agreement, or expiration of any Transition Period, each party will promptly return to other party, or at the other party’s request, destroy all documents and tangible materials containing, reflecting, incorporating, or based on Confidential Information of the other party and, except as set forth below, permanently erase all Confidential Information of the other party from all systems it directly or indirectly controls. Customer will export or otherwise delete all Customer Data in any SaaS Product. If Customer fails to export or delete any Customer Data in a SaaS Product by the expiration date of the Agreement, within ten (10) days of any early termination of the Agreement, or by the expiration date of any Transition Period, Relativity may (a) continue charging Customer for access to and use of the SaaS Product at the rates set forth in the applicable Order or (b) delete such Customer Data. Notwithstanding anything to the contrary in this Section 7.5 or elsewhere in the Agreement, a party may retain Confidential Information of the other party, including Customer Data, in its then current state and solely to the extent and for so long as required for the receiving party to comply with Laws applicable to its business. In addition, for SaaS Customers, Relativity may retain Customer Data in its backups, archives and disaster recovery systems until such Customer Data is deleted in the ordinary course. Any Confidential Information retained under this Section 7.5 will remain subject to all confidentiality, security and other applicable requirements of the Agreement.
The provisions set forth in the following Sections, and any other rights or obligations of the parties in the Agreement that, by their nature, survive expiration or termination of the Agreement, will survive any expiration or termination of the Agreement: Section 2.7 (Reservation of Rights in the Software), Section 3 (Fees, Invoicing and Payment) (for so long as any fees remain unpaid), Section 6 (Confidential Information), Section 7.4 (Effect of Termination or Expiration), Section 7.5 (Return of Confidential Information), this Section 7.6, Section 8 (Indemnification), Section 9 (Limitation of Liability), Section 11 (Feedback), Section 12 (Governing Law, Jurisdiction and Related Matters), Section 13 (Notices), and Section 15 (Miscellaneous).
Relativity will indemnify, defend and hold harmless Customer, its Affiliates and its and their Representatives (“Customer Indemnified Parties”) from and against any Losses incurred in connection with any third-party Claim against the Customer Indemnified Parties to the extent that such Losses arise out of or result from:
11
Customer will indemnify, defend and hold harmless Relativity, its Affiliates and its and their Representatives (“Relativity Indemnified Parties”) from and against any Losses incurred in connection with any third-party Claim against Relativity Indemnified Parties to the extent that such Losses arise out of or result from:
Relativity will have no liability or obligation for any IP Claim or Losses to the extent that such IP Claim arises out of or results from any: (a) access to or use of the Software other than as authorized under the Agreement; (b) alteration or modification of the Software by Customer or any Authorized User, including any Custom Application or Other Product (each as defined in the Development Tool Terms) (for purposes of clarity, IP Claims respecting the Development Tools themselves are covered by Relativity’s obligations under Section 8.1); or (c) use of the Software in combination or operation with any other software, hardware, service, or data not provided by Relativity or identified as a technical requirement in the Documentation, to the extent the IP Claim could have been avoided in the absence of such combination or operation.
If the Software is, or Relativity believes the Software is likely to be, the subject of an IP Claim, Relativity may, at its option and expense: (i) obtain for Customer a license to continue using the Software; (ii) modify the Software, without materially affecting the functionality; (iii) obtain for Customer a license to use other software which is marketed to compete with the Software; or (iv) terminate the applicable Order and refund a pro-rated portion of any fees prepaid by Customer for access to and use of the relevant Software or any related Services, with the pro-rated period commencing on the date Customer discontinued use of the Software due to the IP Claim.
This Section 8 contains the only liability and obligations of Relativity, and the only remedies of Customer, for IP Claims.
If a party receives notice of a Claim for which it is indemnified, it will forward the notice to the other party within 15 days (provided that any failure to notify will relieve the indemnifying party of its indemnification obligations only to the extent that such failure actually prejudices its defense of the Claim). The indemnifying party will: (a) promptly assume sole control of the defense of the Claim and will employ counsel of its choice to handle and defend the Claim; and (b) not settle any Claim without the prior written consent of the indemnified party (which will not be unreasonably withheld, delayed or conditioned), unless such settlement is solely for money damages, includes an unconditional release of the indemnified party from all liability for claims that are the subject matter of the Claim, and does not impose any obligations upon, or prejudice the rights of, the indemnified party. The indemnified party will: (i) provide cooperation and assistance to the indemnifying party, at the indemnifying party’s expense; and (ii) not
12
settle or compromise the Claim or make any admission or substantive response relating to the Claim that materially prejudices the indemnifying party’s ability to defend the Claim, so long as the indemnifying party is defending or seeking to settle or compromise the Claim through qualified counsel. Subject to the foregoing, except in the case of an IP Claim, the indemnified party may participate in and observe the proceedings, at its own expense, with counsel of its own choosing.
TO THE EXTENT PERMITTED BY LAW, AND EXCEPT AS SET FORTH IN SECTION 9.4, IN NO EVENT WILL EITHER PARTY BE LIABLE UNDER OR IN CONNECTION WITH THE AGREEMENT FOR ANY: (A) LOSS OF USE, BUSINESS, REVENUE OR PROFIT OR DIMINUTION IN VALUE; (B) IMPAIRMENT OF, INABILITY TO USE OR LOSS, INTERRUPTION OR DELAY OF THE SOFTWARE (OTHER THAN AS SET FORTH IN ANY SERVICE LEVEL TERMS), OR LOSS OR BREACH OF INFORMATION OR DATA; (C) COST OF REPLACEMENT GOODS OR SERVICES; (D) LOSS OF GOODWILL OR REPUTATION; OR (E) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED OR PUNITIVE DAMAGES.
EXCEPT AS SET FORTH IN SECTION 9.3 AND SECTION 9.4, IN NO EVENT WILL THE AGGREGATE LIABILITY OF ONE PARTY TO THE OTHER PARTY ARISING IN EACH 12 MONTH PERIOD EXCEED THE TOTAL AMOUNT PAID OR PAYABLE TO RELATIVITY UNDER THE AGREEMENT FOR THAT 12 MONTH PERIOD.
SECTION 9.2 WILL NOT APPLY TO LIABILITY ARISING OUT OF OR RELATING TO EITHER PARTY’S BREACH OF THE DATA SECURITY TERMS RESULTING IN A DATA BREACH (AS DEFINED IN THE DATA SECURITY TERMS) (A “DATA BREACH CLAIM”). IN NO EVENT WILL THE AGGREGATE LIABILITY OF ONE PARTY TO THE OTHER PARTY ARISING IN EACH 12 MONTH PERIOD EXCEED THREE (3) TIMES THE TOTAL AMOUNT PAID PAYABLE TO RELATIVITY UNDER THE APPLICABLE ORDER FOR THAT 12 MONTH PERIOD WHERE SUCH LIABILITY ARISES OUT OF OR RELATES TO A DATA BREACH CLAIM. FOR CLARITY, A DATA BREACH CLAIM SHALL NOT BE TREATED AS A BREACH OF CONFIDENTIALITY (I.E., A DATA BREACH CLAIM IS NOT AN UNCAPPED CLAIM UNDER SECTION 9.4).
SECTION 9.1 AND 9.2 WILL NOT APPLY TO LIABILITY ARISING OUT OF OR RELATING TO A PARTY’S BREACH OF SECTION 6 (CONFIDENTIAL INFORMATION), CUSTOMER’S BREACH OF SECTION 2.6 (RESTRICTIONS ON ACCESS TO AND USE OF THE SOFTWARE), A PARTY’S OBLIGATIONS UNDER SECTION 8 (INDEMNIFICATION), A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR A PARTY’S VIOLATION OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.
THE LIMITATIONS OF LIABILITY SET FORTH IN THIS SECTION 9 WILL APPLY, TO THE EXTENT PERMITTED BY LAW, (A) WHETHER THE APPLICABLE CLAIM ARISES UNDER BREACH OF CONTRACT, TORT, STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY, (B) WHETHER THE CLAIMANT WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES, OR SUCH LOSSES WERE OTHERWISE FORESEEABLE, AND (C) EVEN IF EVERY OTHER REMEDY FAILS OF ITS ESSENTIAL PURPOSE.
Neither party will issue or release any announcement, statement, press release, or other publicity or marketing materials relating to the Agreement or, unless expressly permitted under the Agreement, otherwise use the other party's trademarks, service marks, trade names, logos, domain names, or other
13
indicia of association, in each case, without the prior written consent of the other party. Notwithstanding the foregoing, either party may use the name and logo of the other party in lists of other current clients or vendors and Customer may list on its controlled websites, in a professional and reasonable manner, the Relativity name, logo and trademark while this Agreement is in effect. Any permitted use of a party’s name and logo shall be in compliance with any written guidelines provided by the party regarding use of
its name and logo, and each party agrees to remove the name and logo promptly after the other party’s written request which provides a reasonable basis for objecting to continued use.
Subject to the obligations set forth in the Agreement, including Section 6, Relativity may use any suggestions, ideas, enhancement requests, recommendations or other feedback relating to Relativity or to the Software (collectively, “Customer Feedback”) for purposes of modifying the Software, creating Derivative Works, or creating new products or services (collectively, the “Improvements”). Relativity will own exclusively all Improvements including those based upon or incorporating Customer Feedback, without any obligation to pay Customer any royalty or other compensation. Relativity’s use of Customer Feedback will be at Relativity’s sole risk without any representations, warranties or liability of Customer.
The Agreement will be governed by and interpreted in accordance with the Laws of the State of New York USA, without regard to any choice of law or conflicts of laws provisions. All claims and disputes under the Agreement will be litigated, at the election of the party initiating litigation, exclusively in any jurisdiction where Relativity has a registered place of business. The parties irrevocably submit to the jurisdiction and venue of the federal and state courts located in such jurisdiction and agree that such courts are convenient forums. Under no circumstances will the “Uniform Computer Information Transactions Act,” the American Law Institute's "Principles of the Law of Software Contracts," as model laws or as adopted in any jurisdiction, or the United Nations Convention on Contracts for the International Sale of Goods, or similar acts, laws and conventions have any bearing on the interpretation or enforcement of the Agreement and the parties hereby elect to opt out of all such acts, laws and conventions.
Each party irrevocably and unconditionally waives any right it may have to a trial by jury in any court action, proceeding or counterclaim by either party against the other party arising out of or relating to the Agreement.
The Software is subject to U.S. export control laws (regardless of Customer’s domicile or location) and may be subject to export or import requirements in other countries. Without limiting any other Section of the Agreement relating to compliance with applicable Laws, each party will comply with, and take all action necessary to effect its compliance with, all applicable export, re-export, and import laws, including the U.S. Export Administration Regulations. Customer will not permit access to the Software or transfer, export or re-export of the Software, or the underlying information or technology, by or to any person or other party in violation of US legal restrictions, including any party who is a national or resident of, or located in, any country on the United States Department of Treasury's List of Specially Designated Nationals and Blocked Parties or the U.S. Department of Commerce's Table of Denial Orders, or similar lists identifying parties sanctioned by the U.S. government or any locally applicable denied party lists.
14
Any notice, request, consent, or other communication under the Agreement intended to have a legal effect will have legal effect only if in writing and addressed to a party as follows (or to such other address or such other person that such party may designate from time to time in accordance with this Section 13):
Customer: KLDiscovery Ontrack, LLC
Attn: Dawn Wilson, CFO, 9023 Columbine Road, Eden Prairie, MN 55347
Attn: Andrew Southam
Email: andew.southam@kldiscovery.com
Relativity: Relativity ODA LLC
231 South LaSalle St., 8th Floor Chicago, Illinois USA 60604 Attn: Legal Department Email: legal@relativity.com
Notices sent in accordance with this Section 13 will be deemed effectively given: (a) if delivered by hand, with signed confirmation of receipt, when received; (b) if sent by a nationally recognized overnight courier, signature required, when received; or (c) if sent by email, in each case, at the time receipt thereof has been acknowledged by electronic confirmation or otherwise. Written notices which are not given pursuant to the requirements in this Section 13 shall be effective if and when specifically acknowledged by the other party in writing.
If the performance of any part of the Agreement by a party is prevented, hindered or delayed by circumstances beyond such party's reasonable control, including acts of God, flood, fire, earthquake or explosion, war, terrorism, invasion, riot or other civil unrest, or general outage or shortage of adequate power or telecommunications services (a “Force Majeure Event”), the affected party will be excused from such performance and will not be liable or in breach of the Agreement, but only to the extent that and only for so long as the party’s performance is actually prevented, hindered or delayed by the Force Majeure Event. Either party may terminate the Agreement if the affected party is prevented from performing all or a substantial portion of its obligations under the Agreement due to a Force Majeure Event for a period of 30 consecutive days or more, by delivering notice to the other party at any time while the Force Majeure Event is continuing. If Customer terminates the Agreement pursuant to this Section 14, Relativity will promptly refund to Customer a pro-rated portion of any fees prepaid by Customer, with the pro-rated period commencing on the date the Force Majeure Event commenced.
The relationship between the parties is that of independent contractors. Nothing in the Agreement will be construed as creating any agency, partnership, joint venture, or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party will have authority to contract for or bind the other party in any manner whatsoever.
Relativity has various licensing and contractual relationships with independent third parties which may be referred to as “Relativity Developer Partners” or “Relativity Certified Partners,” and Relativity may periodically award various third parties or persons a “Best in Service” or other designation, including through Relativity’s certification program (each, a “Third Party with a Relativity Designation” or “TPRD”).
15
Third Parties with Relativity Designations are not Relativity Representatives, TPRDs have no authority to bind or act on behalf of Relativity, and Relativity will have no liability for any actions or omissions of TPRDs. No awards, communications or actions of Relativity or any TPRD, nor any statements referring to TPRD with the word “partner” on any website or in any other material or communication, should be interpreted to mean that there is any actual or implied partnership in any legal sense. Relativity’s award of any designation should not be interpreted as an endorsement or guarantee of any particular level, quality or timeliness of services.
Neither party may assign its rights or obligations under the Agreement without the prior written consent of the other party, which will not be unreasonably withheld, conditioned or delayed. Any Change in Control will be considered an assignment for purposes of this provision. “Change in Control” means any change resulting from a merger, consolidation or stock transfer, or similar change. Notwithstanding the foregoing, either party may assign the Agreement to an Affiliate or to any third party into which the assigning party is merged, consolidated or reorganized, or to which all or substantially all of the assigning party's assets are sold, upon written notice to the other party, so long as the transferee expressly assumes all obligations of the assigning party under the Agreement; provided, however, that, Customer may not assign this Agreement to any Competitor without Relativity’s prior written consent.
“Competitor” means any person or entity that provides software for use in connection with eDiscovery, document review, case management, internal investigations or communications surveillance. The Agreement will be binding upon and inure to the benefit of the parties’ successors and permitted assigns.
All reservations of proprietary rights and disclaimers and limitations of liability in the Agreement will inure to the benefit of Relativity’s in-bound software vendors. Otherwise, the parties hereby expressly disclaim any intention to create any third-party beneficiaries of the Agreement. For purposes of clarity, Authorized Users are not third-party beneficiaries of the Agreement.
The Agreement may only be modified in writing signed by an authorized Representative of each party. No waiver by any party of any provision in the Agreement will be effective unless explicitly set forth in writing and signed by an authorized Representative of the waiving party. Except as otherwise set forth in the Agreement, no failure to exercise, or delay in exercising, any right, remedy, power, or privilege arising from the Agreement, including any failure or delay in billing Customer for taxes or any other amounts that
16
Customer is required to pay, will operate or be construed as a waiver thereof; nor will any single or partial exercise of any right, remedy, power, or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege.
If any provision of the Agreement is invalid, illegal or unenforceable in any jurisdiction, such invalidity, illegality or unenforceability will not affect any other provision of the Agreement or invalidate or render unenforceable such provision in any other jurisdiction. Upon any determination that any provision is
invalid, illegal or unenforceable, then that provision will be reasonably reformed (by modifying, adding, or deleting text) to the minimum extent required to carry out the parties’ intent that the Agreement and all provisions be valid and enforceable to the fullest extent permitted by Law.
Capitalized terms not defined in these Master Terms shall have the meanings set forth in the Orders or any exhibits or other documents attached thereto or incorporated therein by reference, as applicable. For purposes of the Agreement: (a) the words "include," "includes," and "including" are deemed to be followed by the words "without limitation"; (b) the word "or" is not exclusive; and (c) words denoting the singular have a comparable meaning when used in the plural, and vice-versa. The Agreement will be construed without any presumption against the party drafting the Agreement. Headings are for reference only and are not intended to affect interpretation of the Agreement. The Agreement is drafted in the English language; if translated, the English version of the Agreement will govern and control.
These Master Terms and any Orders may be executed in counterparts, each of which is deemed an original, but all of which together are deemed to be one and the same agreement. Counterparts may be delivered via electronic mail or other transmission method, and any counterpart so delivered will be deemed to have been duly authorized, executed and delivered for all purposes.
SIGNATURES
The parties have caused these Master Terms and Conditions to be executed by their respective duly authorized officers or representatives as of the Effective Date.
RELATIVITY ODA LLC |
KLDISCOVERY ONTRACK, LLC |
Signature: /s/ Sailesh Munagala |
Signature: /s/ Andrew Southam |
Name: Sailesh Munagala |
Name: Andrew Southam |
Title: CFO |
Title: General Counsel |
17
September 8, 2022
DPA-UK SCCs
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) is entered into effective as of May 1, 2023 (“Effective Date”) by and between RELATIVITY ODA LLC, a Delaware limited liability company (“Relativity”), and KLdiscovery Ontrack, LLC, a(n) Delaware limited liability company (“Customer”).
Background
Whereas, Relativity and Customer are parties to, or are concurrently entering into, one or more agreements (collectively, “Underlying Agreement”), pursuant to which Customer accesses and uses Relativity’s software-as-a-service products (collectively, “Cloud Product”), as deployed in one or more data centers located in various countries.
Whereas, due to applicable legal and regulatory requirements, the parties mutually desire to supplement the Underlying Agreement with this DPA to set forth the parties’ respective obligations respecting the processing of personal data as contained in Client Data.
NOW THEREFORE, in consideration of the foregoing recitals and the mutual terms and provisions herein, the parties hereby agree as follows:
Agreement
September 8, 2022
DPA-UK SCCs
exporter with regards to the processing and transfer of such personal data; and (b) to the extent Customer views itself to be a processor of personal data: (i) Relativity serves as the sub-processor and the data importer with regards to the processing and transfer of such personal data; and (ii) Customer serves as the processor and the data exporter with regards to the processing and transfer of such personal data. Relativity’s Privacy Policy governs Relativity’s obligations respecting personal data of which it is a controller.
6A. Swiss Annex. To the extent the FADP applies, the Swiss Annex, as set out in Addendum 5 (Swiss Annex) shall apply.
2
September 8, 2022
DPA-UK SCCs
3
September 8, 2022
DPA-UK SCCs
and/or export all Client Data from the Cloud Product in accordance with the terms in the Underlying Agreement.
IN WITNESS WHEREOF, the parties have caused this DPA to be executed by their respective duly authorised officers or representatives, as of the Effective Date.
RELATIVITY ODA LLC |
KLDISCOVERY ONTRACK, LLC |
Signature: /s/ Sailesh Munagala |
Signature: /s/ Andrew Southam |
Name: Sailesh Munagala |
Name: Andrew Southam |
Title: CFO |
Title: General Counsel |
Additional Customer details for purposes of the Addendums attached to this DPA:
Name: TBD
4
September 8, 2022
DPA-UK SCCs
Position: Data Protection Officer
Customer’s DPO or privacy contact
|
Email address: TBD@tbd.com |
Applicable competent supervisory authority for purposes of Clause 13 of the Transfer SCCs |
Republic of Ireland (where GDPR applies) and Switzerland (where the FADP applies) |
Applicable governing law for purposes of Clause 9 of the UK Transfer SCCs |
England and Wales |
5
September 8, 2022
DPA-UK SCCs
ADDENDUM 1: PROCESSING SCCS
Standard Contractual Clauses between Controllers and Processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council, pursuant to Commission Implementing Decision (EU) 2021/915 of 4 June 2021
SECTION I
Clause 1
Purpose and scope
Clause 2
Invariability of the Clauses
Clause 3
Interpretation
Addendum 1 – Processing SCCs – Page 6
September 8, 2022
DPA-UK SCCs
Clause 4
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 5 - Optional
Docking clause
SECTION II
OBLIGATIONS OF THE PARTIES
Clause 6
Description of processing(s)
The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.
Clause 7
Obligations of the Parties
7.1 Instructions
Addendum 1 – Processing SCCs – Page 7
September 8, 2022
DPA-UK SCCs
The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.
Processing by the processor shall only take place for the duration specified in Annex II.
If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.
of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby
Addendum 1 – Processing SCCs – Page 8
September 8, 2022
DPA-UK SCCs
giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.
7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.
Clause 8
Assistance to the controller
Addendum 1 – Processing SCCs – Page 9
September 8, 2022
DPA-UK SCCs
Clause 9
Notification of personal data breach
In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or under Articles 34 and 35 of Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.
In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
In the event of a personal data breach concerning data processed by the processor, the processor shall
Addendum 1 – Processing SCCs – Page 10
September 8, 2022
DPA-UK SCCs
notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.
SECTION III
FINAL PROVISIONS
Clause 10
Non-compliance with the Clauses and termination
Addendum 1 – Processing SCCs – Page 11
September 8, 2022
DPA-UK SCCs
ANNEX I TO ADDENDUM 1
List of parties
Controller (or Processor, as applicable)
Name: The legal entity identified as the Customer in the DPA to which this Addendum 1 is attached
Address: Customer’s legal notice address provided in Underlying Agreement
Contact details: Refer to signature block of the DPA to which this Addendum 1 is attached
Signature and accession date: Signatures are located in the DPA to which this Addendum 1 is attached, and date is the Effective Date of the DPA to which this Addendum 1 is attached
Processor (or Sub-Processor, as applicable) Name: Relativity ODA LLC
Address: 231 South LaSalle Street, 8th Floor, Chicago, IL 60604, United States
Contact details: Privacy Team, privacy.inquiries@relativity.com
Signature and accession date: Signatures are located in the DPA to which this Addendum 1 is attached, and date is the Effective Date of the DPA to which this Addendum 1 is attached
ANNEX II TO ADDENDUM 1
Description of the processing Categories of data subjects whose personal data is processed
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The extent of any personal data contained therein is determined by Customer and/or its end customers in their sole discretion. The categories of data subjects are not categorically specified due to the nature of the processing.
Categories of personal data processed
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The content of Client Data and the extent of any personal data contained therein is determined by Customer and/or its end customers in their sole discretion. The categories of personal data are not categorically specified due to the nature of the processing.
Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Client Data may include sensitive data, as determined by Customer and/or its end customers in their sole discretion. Relativity assumes all Client Data is sensitive data and complies with the obligations in this DPA and in the data security terms incorporated into the Underlying Agreement in connection with the processing of all Client Data.
Nature of the processing
Relativity processes personal data in connection with providing services related to the Cloud Product, including data hosting and technical support.
Addendum 1 – Processing SCCs – Page 12
September 8, 2022
DPA-UK SCCs
Purpose(s) for which the personal data is processed on behalf of the controller
To provide access to and use of the Cloud Product in connection with Customer’s and/or its end customers’ legal and compliance matters.
Duration of the processing
The subscription term set forth in the Underlying Agreement.
For processing by (sub-) processors, also specify subject matter, nature and duration of the processing
As of the Effective Date of this DPA, processing by sub-processors is limited to the provision of infrastructure to host the Cloud Product and technical support related thereto. The duration of the processing is the subscription term set forth in the Underlying Agreement.
ANNEX III TO ADDENDUM 1
Technical and organisational measures including technical and organisational measures to ensure the security of the data
Description of the technical and organisational security measures implemented by the processor(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, as well as the risks for the rights and freedoms of natural persons.
Relativity has implemented technical and organisational security measures to ensure an appropriate level of security, as detailed in the data security terms incorporated into the Underlying Agreement.
Addendum 1 – Processing SCCs – Page 13
September 8, 2022
DPA-UK SCCs
ADDENDUM 2: CONTROLLER-TO-PROCESSOR TRANSFER SCCS
Standard Contractual Clauses for the Transfer of Personal Data to Third Countries under Regulation (EU) 2016/679 of the European Parliament and of the Council, pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021
SECTION I
Clause 1
Purpose and scope
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
Clause 2
Effect and invariability of the Clauses
1 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.
Addendum 2 – Controller to Processor Transfer SCCs – Page 14
September 8, 2022
DPA-UK SCCs
Clause 3
Third-party beneficiaries
Clause 4
Interpretation
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
Addendum 2 – Controller to Processor Transfer SCCs – Page 15
September 8, 2022
DPA-UK SCCs
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done
Addendum 2 – Controller to Processor Transfer SCCs – Page 16
September 8, 2022
DPA-UK SCCs
so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses.
In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
Addendum 2 – Controller to Processor Transfer SCCs – Page 17
September 8, 2022
DPA-UK SCCs
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European
Union (2) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
Clause 9
Use of sub-processors
Addendum 2 – Controller to Processor Transfer SCCs – Page 18
September 8, 2022
DPA-UK SCCs
2 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. (3) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
Clause 10
Data subject rights
Clause 11
Redress
Addendum 2 – Controller to Processor Transfer SCCs – Page 19
September 8, 2022
DPA-UK SCCs
3 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
Clause 12
Liability
Clause 13
Supervision
Addendum 2 – Controller to Processor Transfer SCCs – Page 20
September 8, 2022
DPA-UK SCCs
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
Addendum 2 – Controller to Processor Transfer SCCs – Page 21
September 8, 2022
DPA-UK SCCs
4 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
Clause 15
Obligations of the data importer in case of access by public authorities
Addendum 2 – Controller to Processor Transfer SCCs – Page 22
September 8, 2022
DPA-UK SCCs
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
Addendum 2 – Controller to Processor Transfer SCCs – Page 23
September 8, 2022
DPA-UK SCCs
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Republic of Ireland.
Clause 18
Choice of forum and jurisdiction
ANNEX I TO ADDENDUM 2
Exporter:
Addendum 2 – Controller to Processor Transfer SCCs – Page 24
September 8, 2022
DPA-UK SCCs
Name: The legal entity identified as the Customer in the DPA to which this Addendum 2 is attached
Address: Customer’s legal notice address provided in Underlying Agreement
Contact details: Refer to signature block of the DPA to which this Addendum 2 is attached
Activities: Use of the Cloud Product in connection with Customer’s and/or its end customers’ legal and compliance matters.
Signature and date: Signatures are located in the DPA to which this Addendum 2 is attached, and date is the Effective Date of the DPA to which this Addendum 2 is attached
Role: Controller
Importer:
Name: Relativity ODA LLC
Address: 231 South LaSalle Street, 8th Floor, Chicago, IL 60604, United States
Contact details: Privacy Team, privacy.inquiries@relativity.com
Activities: The provision of services related to the Cloud Product, including data hosting and technical support
Signature and date: Signatures are located in the DPA to which this Addendum 2 is attached, and date is the Effective Date of the DPA to which this Addendum 2 is attached
Role: Processor
Categories of data subjects whose personal data is transferred
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The extent of any personal data contained therein is determined by Customer and/or its end customers in their sole discretion. The categories of data subjects are not categorically specified due to the nature of the processing.
Categories of personal data transferred
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The content of Client Data and the extent of any personal data contained therein is determined by Customer and/or its end customers in their sole discretion. The categories of personal data are not categorically specified due to the nature of the processing.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Client Data may include sensitive data, as determined by Customer and/or its end customers in their sole discretion. Relativity assumes all Client Data is sensitive data and complies with the obligations in this DPA and in the data security terms incorporated into the Underlying Agreement in connection with the processing of all Client Data.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Continuous basis when necessary for the provision of technical support.
Nature of the processing
Relativity processes personal data in connection with providing services related to the Cloud Product, including data hosting and technical support.
Addendum 2 – Controller to Processor Transfer SCCs – Page 25
September 8, 2022
DPA-UK SCCs
Purpose(s) of the data transfer and further processing
Relativity may transfer personal data in the form of remote access from another country for purposes of providing technical support services. In limited circumstances, Customer may choose, in its sole discretion, to provide Relativity with copies of Client Data for technical support purposes, and in such circumstances, personal data may be transferred to another country.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Personal data is not retained following remote access. In the limited circumstances that Customer chooses to provide Relativity with copies of Client Data for technical support purposes, such Client Data (and any personal data contained therein) will not be retained longer than is necessary to resolve the support issue.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As of the Effective Date of this DPA, transfers to sub-processors are limited to transfers in the form of remote access from another country for purposes of providing the infrastructure to host the Cloud Product and technical support related thereto. The duration of the processing is the subscription term set forth in the Underlying Agreement.
Refer to signature block of the DPA to which this Addendum 2 is attached.
ANNEX II TO ADDENDUM 2
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
Relativity has implemented technical and organisational security measures to ensure an appropriate level of security, as detailed in the data security terms incorporated into the Underlying Agreement.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
As of the Effective Date of this DPA, Relativity’s only sub-processor is Microsoft Corporation, as the provider of Microsoft Azure, the cloud infrastructure in which the Cloud Product is hosted. Details on Microsoft Azure’s security, privacy, and compliance standards may be found on the Microsoft Azure Trust Center homepage: https://azure.microsoft.com/en-us/support/trust-center/.
Addendum 2 – Controller to Processor Transfer SCCs – Page 26
ADDENDUM 3: PROCESSOR-TO-PROCESSOR TRANSFER SCCS
Standard Contractual Clauses for the Transfer of Personal Data to Third Countries under Regulation (EU) 2016/679 of the European Parliament and of the Council, pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021
SECTION I
Clause 1
Purpose and scope
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
Clause 2
Effect and invariability of the Clauses
5 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.
Addendum 3 – Processor to Processor Transfer SCCs – Page 27
September 8, 2022
DPA-UK SCCs
Clause 3
Third-party beneficiaries
Clause 4
Interpretation
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
Addendum 3 – Processor to Processor Transfer SCCs – Page 28
September 8, 2022
DPA-UK SCCs
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall
6 See Article 28(4) of Regulation (EU) 2016/679 and, where the controller is an EU institution or body, Article 29(4) of Regulation (EU) 2018/1725.
Addendum 3 – Processor to Processor Transfer SCCs – Page 29
September 8, 2022
DPA-UK SCCs
provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
Addendum 3 – Processor to Processor Transfer SCCs – Page 30
September 8, 2022
DPA-UK SCCs
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (7) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
Addendum 3 – Processor to Processor Transfer SCCs – Page 31
September 8, 2022
DPA-UK SCCs
7 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purposes of these Clauses.
controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
Clause 9
Use of sub-processors
Clause 10
Data subject rights
Addendum 3 – Processor to Processor Transfer SCCs – Page 32
September 8, 2022
DPA-UK SCCs
8 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
Clause 11
Redress
Clause 12
Liability
Addendum 3 – Processor to Processor Transfer SCCs – Page 33
September 8, 2022
DPA-UK SCCs
and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
Clause 13
Supervision
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Addendum 3 – Processor to Processor Transfer SCCs – Page 34
September 8, 2022
DPA-UK SCCs
Local laws and practices affecting compliance with the Clauses
exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
Clause 15
Addendum 3 – Processor to Processor Transfer SCCs – Page 35
September 8, 2022
DPA-UK SCCs
Obligations of the data importer in case of access by public authorities
9 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
The data exporter shall forward the notification to the controller.
Addendum 3 – Processor to Processor Transfer SCCs – Page 36
September 8, 2022
DPA-UK SCCs
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
In these cases, it shall inform the competent supervisory authority and the controller of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
Addendum 3 – Processor to Processor Transfer SCCs – Page 37
September 8, 2022
DPA-UK SCCs
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Republic of Ireland.
Clause 18
Choice of forum and jurisdiction
ANNEX I TO ADDENDUM 3
Exporter:
Name: The legal entity identified as the Customer in the DPA to which this Addendum 3 is attached
Address: Customer’s legal notice address provided in Underlying Agreement
Contact details: Refer to signature block of the DPA to which this Addendum 3 is attached
Activities: Use of the Cloud Product in connection with Customer’s and/or its end customers’ legal and compliance matters.
Signature and date: Signatures are located in the DPA to which this Addendum 3 is attached, and date is the Effective Date of the DPA to which this Addendum 3 is attached
Role: Processor
Importer:
Name: Relativity ODA LLC
Address: 231 South LaSalle Street, 8th Floor, Chicago, IL 60604, United States
Contact details: Privacy Team, privacy.inquiries@relativity.com
Activities: The provision of services related to the Cloud Product, including data hosting and technical support
Signature and date: Signatures are located in the DPA to which this Addendum 3 is attached, and date is the Effective Date of the DPA to which this Addendum 3 is attached
Role: Sub-Processor
Categories of data subjects whose personal data is transferred
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The extent of any personal data contained therein is determined by Customer and/or its end
Addendum 3 – Processor to Processor Transfer SCCs – Page 38
September 8, 2022
DPA-UK SCCs
customers in their sole discretion. The categories of data subjects are not categorically specified due to the nature of the processing.
Categories of personal data transferred
The content of Client Data generally relates to Customer’s and/or its end customers’ legal and compliance matters. The content of Client Data and the extent of any personal data contained therein is determined by Customer and/or its end customers in their sole discretion. The categories of personal data are not categorically specified due to the nature of the processing.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Client Data may include sensitive data, as determined by Customer and/or its end customers in their sole discretion. Relativity assumes all Client Data is sensitive data and complies with the obligations in this DPA and in the data security terms incorporated into the Underlying Agreement in connection with the processing of all Client Data.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Continuous basis when necessary for the provision of technical support.
Nature of the processing
Relativity processes personal data in connection with providing services related to the Cloud Product, including data hosting and technical support.
Purpose(s) of the data transfer and further processing
Relativity may transfer personal data in the form of remote access from another country for purposes of providing technical support services. In limited circumstances, Customer may choose, in its sole discretion, to provide Relativity with copies of Client Data for technical support purposes, and in such circumstances, personal data may be transferred to another country.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Personal data is not retained following remote access. In the limited circumstances that Customer chooses to provide Relativity with copies of Client Data for technical support purposes, such Client Data (and any personal data contained therein) will not be retained longer than is necessary to resolve the support issue.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As of the Effective Date of this DPA, transfers to sub-processors are limited to transfers in the form of remote access from another country for purposes of providing the infrastructure to host the Cloud Product and technical support related thereto. The duration of the processing is the subscription term set forth in the Underlying Agreement.
Refer to signature block of the DPA to which this Addendum 3 is attached.
Addendum 3 – Processor to Processor Transfer SCCs – Page 39
September 8, 2022
DPA-UK SCCs
ANNEX II TO ADDENDUM 3
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
Relativity has implemented technical and organisational security measures to ensure an appropriate level of security, as detailed in the data security terms incorporated into the Underlying Agreement.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
As of the Effective Date of this DPA, Relativity’s only sub-processor is Microsoft Corporation, as the provider of Microsoft Azure, the cloud infrastructure in which the Cloud Product is hosted. Details on Microsoft Azure’s security, privacy, and compliance standards may be found on the Microsoft Azure Trust Center homepage: https://azure.microsoft.com/en-us/support/trust-center/.
Addendum 3 – Processor to Processor Transfer SCCs – Page 40
September 8, 2022
DPA-UK SCCs
ADDENDUM 4: UK TRANSFER SCCS
This International Data Transfer Addendum (this “Addendum”) supplements the DPA and incorporates and amends the Transfer SCCs.
PART 1:
Exporter:
Name: The legal entity identified as the Customer in the DPA to which this Addendum 4 is attached
Address: Customer’s legal notice address provided in Underlying Agreement
Contact details: Refer to signature block of the DPA to which this Addendum 4 is attached
Activities: Use of the Cloud Product in connection with Customer’s and/or its end customers’ legal and compliance matters.
Signature and date: Signatures are located in the DPA to which this Addendum 4 is attached, and date is the Effective Date of the DPA to which this Addendum 4 is attached
Role: Controller or Processor, as applicable
Importer:
Name: Relativity ODA LLC
Address: 231 South LaSalle Street, 8th Floor, Chicago, IL 60604, United States
Contact details: Privacy Team, privacy.inquiries@relativity.com
Activities: The provision of services related to the Cloud Product, including data hosting and technical support
Signature and date: Signatures are located in the DPA to which this Addendum 4 is attached, and date is the Effective Date of the DPA to which this Addendum 4 is attached
Role: Processor or Sub-Processor, as applicable
“Appendix Information” means the information set out in Annex I and Annex II to the Approved EU SCCs.
PART 2: MANDATORY CLAUSES
Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following
Addendum 4 – UK Transfer SCCs – Page 41
September 8, 2022
DPA-UK SCCs
meanings:
This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not
Addendum 4 – UK Transfer SCCs – Page 42
September 8, 2022
DPA-UK SCCs
be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
Addendum 4 – UK Transfer SCCs – Page 43
September 8, 2022
DPA-UK SCCs
“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex
I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
“These Clauses are governed by the laws of England and Wales.”;
“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
Addendum 4 – UK Transfer SCCs – Page 44
September 8, 2022
DPA-UK SCCs
The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
From time to time, the ICO may issue a revised Approved Addendum which:
The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.
Addendum 5 Swiss Annex
In order for the Transfer SCCs to comply with FADP:
Addendum 4 – UK Transfer SCCs – Page 45
September 8, 2022
DPA-UK SCCs
In the context of jurisdiction for claims arising out of this SCC, the term “Member State” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland).
Addendum 4 – UK Transfer SCCs – Page 46