Data Processing Addendum

Data Exporter

The Data Exporter is the entity identified as “Customer” in this DPA, a customer of the Data Importer’s services.

Data Importer

The Data Importer is Dataweavers, a provider of experience management software, and its Affiliates.

Data Subjects

The Data Exporter’s employees, end users and customers.

Dataweavers Standard

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of responsibility
• IT related data: computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

• Identifying information during a website visit: such as full name, email addresses, physical addresses, and phone numbers.
• Website activities: including session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other calculated metrics.

Sitecore EXM
(if applicable)

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of responsibility
• IT related data: License ID

Sitecore Managed Cloud
(if applicable)

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of responsibility
• IT related data: computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

• Identifying information during a website visit: such as full name, email addresses, physical addresses, and phone numbers.
• Website activities: including session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other calculated metrics.

Sitecore Content Hub
(if applicable)

• Contact details: email address used to set up accounts and send notifications.
• Username: Used to authenticate account and provide
• access to Services.
• Profile information: This may include avatars, geographic location and any other information that end users choose to share.
• IT related data: computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

• Identifying information during a website visit: such as full name, email addresses, physical addresses, and phone numbers.
• Website activities: including session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other metrics (such as content volume).

Sitecore AI
(if applicable)

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of
• responsibility
• IT related data: computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

 End users and customers are those who are website visitors’ using the Data Importer’s platform, as configured by the Data Exporter.

This includes the following examples:

• Website activities: including session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other calculated metrics.

Sitecore Personalise (Boxever)

Employees:

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of responsibility
• IT related data: computer ID, user ID and password,
  domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

End Users:

End users and customers are those who are website visitors’ whose data may be input to Dataweavers’ platform, as configured by the Data Customer.

This includes the following examples:

• Website activities: including ID session data, session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other calculated metrics.
• Order Information: Information relating to any orders purchased by End Users.

Sitecore OrderCloud

• Contact details: address, telephone number (fixed and mobile), email address used to set up accounts.
• Employment details: job title, geographic location, area of responsibility
• IT related data: computer ID, user ID and password, domain name, IP address, log files, software and hardware inventory, software usage pattern tracking information (i.e., cookies and information recorded for operation and training purposes).

End Users:

End users and customers are those who are website visitors’ whose data may be input to Dataweavers’ platform, as configured by the Data Customer.

This includes the following examples:

• Website activities: including ID session data, session duration, referring website, source IP address, source geographical data, user agent, pages viewed, events triggered, and other calculated metrics.
• Order Information: Information relating to any orders purchased by End Users.

Special Categories of Data (if appropriate)

Dataweavers does not intentionally collect or process any special categories of data in the provision of its products and/or services. However, special categories of data may from time to time be inadvertently Processed where the Data Exporter or its end users choose to include this type of data in its configuration of Dataweavers’ products and services.

As such, the Data Exporter is solely responsible for ensuring the legality of any special categories or data it or its end users choose to process using Dataweavers’ products and/or services.

Processing Operations

The personal data transferred will be subject to the following basic Processing activities

The purpose of the data Processing under this DPA is the provision of the Services to the Customer and the performance of Dataweavers’ obligations under the Agreement, for the duration of the Agreement, and this DPA (or as otherwise agreed by the Parties).

The processing operations performed on the personal data will depend on the scope of the Services purchased and the data exporter’s configuration of data importer’s product

offerings. Such processing operations shall be as necessary for Data Importer to provide the Services and may include collection, storage, disclosure, transmission, archiving and/or destruction.