·Last updated September 5, 2023

·Please note that this page is for informational purposes only and Datadog customers are responsible for making their own independent assessment of the information presented below. All of Datadog's obligations and liabilities to our customers are outlined in our agreements, and this page does not form part of, or modify, any agreement between Datadog and our customers. We may update or change this page from time to time. When we do so, we will update the "Current as of" date above.

• 1In July 2020, the Court of Justice of the European Union issued its long-awaited decision in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems ("Schrems II"), holding that (1) the EU-U.S. Privacy Shield program could no longer be used for data transfers to the United States, and (2) the transfer mechanisms identified in the GDPR-including the European Commission-issued Standard Contractual Clauses (SCCs)-could only be used where the laws and practices in the data importer's country do not impinge on the protections provided by the transfer mechanism. To address the concerns raised in the Schrems II decision, in October 2022, U.S. President Biden signed Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities, which requires certain changes to the way U.S. intelligence agencies collect data under its collection authorities. In furtherance of Executive Order (EO) 14086, the Department of Commerce created the EU-U.S. Data Privacy Framework (DPF)-a framework to allow for international data transfers to the U.S.-for which the European Commission adopted an adequacy decision on July 10, 2023. Datadog has certified to, and is an active member of, the DPF. That said, we continue to believe that being transparent about our data-transfer practices is important to our customers, so we will continue to maintain this Transfer Impact Assessment so that our customers are confident in their ability to use our Services no matter where they are located.

·Overview

• 2The most important terms you should know as you review this Assessment are the following:

·Definitions

• ·"Customer Data" means the data from our Customers' Environments that are submitted to the Services or that are otherwise uploaded to the Services.
• ·"Customer Personal Data" means Customer Data that consists of personal data (e.g., Logs events that include things like an individual's full name or an IP address).
• ·"Data Processing Addendum" and "DPA" mean the contract we sign with customers that governs how we process personal data; our current form DPA is here.
• ·"EEA" means the European Economic Area.
• ·"GDPR" means Europe's General Data Protection Regulation.
• ·"Personal data" means data related to an identified or identifiable natural person (e.g., a full name, an IP address, or a photograph of someone).
• ·"Services" means the hosted products we provide to our customers.
• ·"Standard Contractual Clauses" and "SCCs" mean the European Commission-approved contracts used to safeguard personal data when transferred out of the EEA.
• ·"Subprocessor" means a vendor that processes Customer Personal Data on Datadog's behalf.
• 3Datadog's Services include a number of SaaS-based products that can be used to collect, view, manage, and analyze a wide array of data relating to your computing infrastructure and software applications. These include, among other things, our Log Management product, which lets customers search, filter, and analyze their logs; and our Infrastructure Monitoring product, which gives customers visibility of the performance of their IT assets. Because we offer a number of distinct products within the Services and our customers use these products in unique ways, many different kinds of data may be sent to Datadog for processing. As a result, it's possible that you may configure and use our Services in a way that results in the collection of personal data, including personal data that is governed by data protection laws like the GDPR.

·Datadog's Services

·Transfers of Your Personal Data

• 4.1The GDPR prohibits the transfer of personal data outside of the EEA unless the transfer is made using an approved transfer mechanism: (1) the transfer is made to a country that the European Commission has determined provides an adequate level of data protection; (2) the transfer is subject to appropriate safeguards; or (3) the transfer is made in accordance with specific derogations. (While this Assessment focuses on the EU, the transfer frameworks in the UK and Switzerland are substantially the same.)

·Transfer Mechanisms Under the GDPR

• ·First, an organization may transfer personal data out of the EEA when the transfer is to a country that the European Commission has determined provides an adequate level of data protection. The European Commission maintains a list of the countries that have been deemed adequate, which as of July 2023, includes the U.S. (scoped to organizations that participate in the DPF).
• ·Second, an organization may transfer personal data out of the EEA when the transfer is subject to appropriate safeguards under Article 46 of the GDPR. There are a few specific mechanisms that provide appropriate safeguards, the most popular of which is the SCCs, a form contract signed by the data exporter and the data importer.
• ·Third, an organization may transfer personal data out of the EEA in specific (and limited) cases, including where the data subject (whose personal data will be transferred) has explicitly consented to the transfer. More information about these derogations is available in Article 49 of the GDPR. (After the UK withdrew from the European Union in 2020, it enacted its own version of the GDPR that essentially mirrors the relevant parts of the EU GDPR.)
• 4.2As noted in section 1 above, Datadog is certified to the EU-U.S. Data Privacy Framework (DPF). In addition to certification, and in order to safeguard the personal data transferred to us, we continue to incorporate a Data Processing Addendum (DPA) into our contracts with our customers that incorporates both (1) the European Commission-approved SCCs and (2) the UK-approved International data transfer addendum to the European Commission's standard contractual clauses for international data transfers.

·Transfers to Datadog

• ·As a result, transfers of Customer Personal Data to Datadog are protected in multiple ways: under our certification to the DPF, through the obligations in the SCCs that we include in our DPA, and per the supplementary measures we have implemented to protect Customer Personal Data (outlined in section 5 below).
• 4.3To provide our best-in-class Services, including 24/7 technical support, we may disclose your Customer Personal Data to certain of our affiliates and trusted vendors (our Subprocessors). These onward transfers are only made in accordance with our agreements with you.

·Datadog's Onward Transfers

• ·Information about our Subprocessors is available on our Subprocessors List. There, we identify each of our Subprocessors along with the specific services that they provide to us and their locations. Before we engage a new Subprocessor, we subject it to rigorous review and onboarding processes to ensure that we can safely provide it with the Customer Personal Data we receive from our customers. This includes reviewing each vendor's security and privacy practices to ensure that they meet our strict requirements, as well as requiring them to sign a DPA with us that (1) provides protections for Customer Personal Data at least as protective as those in our DPA with you, and (2) includes GDPR-compliant transfer mechanisms for any onward transfers of Customer Personal Data. After we vet a new Subprocessor and feel confident that Customer Personal Data will be fully protected when shared with the Subprocessor, we send a notice to each of our customers who has subscribed to receive a notification so that it has an opportunity to review the new Subprocessor. You can subscribe to our notifications of new Subprocessors by completing the form on our Subprocessors List.
• 4.4The Schrems II court primarily focused on two U.S. legal frameworks related to the collection of personal data: Section 702 of the Foreign Intelligence Surveillance Act (FISA 702) and Executive Order (EO) 12333. Here, we briefly summarize those two frameworks and their impact on Datadog.

·Relevant U.S. Collection Authorities

• ·FISA 702 permits a specialized U.S. court to authorize the federal government to issue orders to U.S. companies to disclose data about specific non-U.S. persons reasonably believed to be outside the U.S. Under FISA 702, these orders may only be issued to "electronic communication service providers." We have analyzed the scope of FISA 702 and do not believe that we are subject to government orders for communications under the statute.
• ·EO 12333 outlines how U.S. intelligence agencies can collect the communications of non-U.S. persons reasonably believed to be outside of the U.S. Importantly, EO 12333 does not include any authorization to compel private companies to disclose personal data to the U.S. government. We do not believe that EO 12333 introduces a substantial risk to our customers with respect to the Services because (1) the kinds of data that our customers send to us through the Services would not constitute the types of communications that are relevant for the U.S. government during intelligence operations, and (2) we encrypt all Customer Personal Data in transit across public networks. As a result, we believe we are at little risk of having any Customer Personal Data in the clear intercepted under EO 12333 operations.
• 4.5In October 2022, the Biden administration issued Executive Order (EO) 14086 to address the concerns raised in Schrems II. EO 14086 outlines several changes to how the U.S. government can collect personal data under FISA 702 and EO 12333. In light of these changes, the U.S. Department of Commerce developed the EU-U.S. Data Privacy Framework (DPF) to facilitate international data transfers in compliance with EU law, which organizations can self-certify to.

·Executive Order 14086 and the EU-U.S. Data Privacy Framework

• ·Based on the changes identified in EU 14086, the European Commission adopted an adequacy decision for the DPF, concluding that "the United States ensures an adequate level of protection for personal data transferred under the EU-U.S. DPF from a controller or a processor in the Union to certified organisations in the United States." As a result, Datadog's customers benefit from these changes now that Datadog has certified to the DPF.
• 4.6Taken together, we believe that there is little risk that the U.S. government would collect the Customer Personal Data of our customers.

·Government Access Requests in General

• ·That said, if we ever were to receive any kind of request from a governmental body requesting the personal data you have submitted to our Services, to the extent permitted by applicable laws, we would (1) attempt to fight or quash the request by raising nonfrivolous objections; (2) provide you with reasonable notice of the request so that you have the opportunity to seek a protective order or other appropriate remedy; (3) attempt to redirect the governmental body to request the information from you directly; and (4) if ultimately required to disclose your personal data to the government, limit the disclosure to the minimum amount of data legally necessary to comply with the request.
• 5Even though we believe that the risk of the U.S. government collecting Customer Personal Data is low, we take the privacy and security of your personal data seriously. To ensure that we meet state of the art practices for privacy and security, we have implemented the following technical, contractual, and organizational measures to protect your personal data.

·Supplementary Measures

• 5.1We have implemented the following technical measures to safeguard all personal data you transfer to us.

·Technical Measures

• ·Hosting locations. You can choose between multiple hosting locations for your Customer Personal Data, which today includes hosting locations in the U.S., the EU, and Japan. While your data may leave your hosting region in some cases (for example, if you open a support request and one of our support engineers needs to access your data to support you), we ensure that your data is never stored in a separate region.
• ·Encryption. All Customer Personal Data you send to us is encrypted in transit using Transport Layer Security (TLS) with HTTP Strict Transport Security (HSTS) by default, and can be configured by our customers to use TLS 1.2 where supported. Moreover, all Customer Personal Data is encrypted at rest with FIPS 140-2-compliant encryption standards, as well as FIPS 140-2-approved cryptographic devices for the generation, storage, and revocation of encryption keys.
• ·Data retention. We rely on the principle of storage minimization to ensure that your Customer Personal Data is not retained for longer than is necessary for your purposes. For more information on our default retention periods, please refer to our Data Collection, Resolution, and Retention page.
• 5.2We have implemented the following contractual measures to safeguard all Customer Personal Data you transfer to us.

·Contractual Measures

• ·DPAs. In addition to our certification to the DPF, we sign DPAs, which include the SCCs as a transfer mechanism, with every customer who needs one, and every Subprocessor to whom we may transfer your Customer Personal Data. Our DPAs with Subprocessors provide at least the same level of data protection as our DPA with you does, and they always include the SCCs as a transfer mechanism.
• 5.3We have implemented the following organizational measures to safeguard all Customer Personal Data transferred to us.

·Organizational Measures

• ·Subprocessor onboarding. Prior to onboarding a new Subprocessor, we conduct a comprehensive vendor assessment, which includes a review of the Subprocessor's security and privacy practices. Moreover, we require annual audit documentation from our Subprocessors to demonstrate compliance with the security terms of its data processing agreement.
• ·Government requests. As outlined above, we have not received any disclosure requests from the U.S. government, including requests for access under FISA 702, in connection with Customer Personal Data. Should we ever receive such a request, we will review the legality of government access requests and challenge such requests where they are unlawful.
• ·Incident response and business continuity planning. We have a robust vulnerability management program in place to stay ahead of security incidents. We use many tools and tactics to discover security vulnerabilities, including a private bug bounty program, infrastructure scans, internal security testing, and annual third-party pen tests. We also have a detailed incident response plan and dedicated incident response team that guides our investigation and mitigation of any identified or potential breach. Moreover, we have a thorough business continuity plan designed so that our teams work diligently to recover operations in a timely manner, if needed.
• ·Dedicated privacy team. We have a dedicated Legal Privacy team that specializes in privacy and data-protection issues. They stay up to date on all privacy regulations and requirements that apply to us, ensuring that your regulatory requirements with respect to Datadog are always met.
• ·Recurring audits. We conduct a series of annual audits, including ISO 27001 and SOC 2 Type 2 audits, to ensure compliance with our technical and organizational measures, and we make our relevant audit reports available to you.
• ·Confidentiality obligations. All of our employees are required to sign confidentiality agreements, where local law allows. In addition, all of our Subprocessors who handle Customer Personal Data are required to adhere to confidentiality terms.
• ·Access controls. We enforce strict access controls to ensure that the only people who have access to Customer Personal Data are those that absolutely need it to perform their job functions. To further ensure that this is the case, we log all access to Customer Data.
• ·Employee training. We provide privacy and security training to all of our employees when they join the company, and yearly thereafter. As a result, our employees are always kept up to date on security and privacy best practices.
• ·Privacy by design. To ensure that all of our Services are built with privacy in mind, we make sure that data protection reviews and considerations are explicitly included in the product design life cycle. This has led to the inclusion of a number of customer-facing privacy features in our products (including Logs, APM, and RUM), as well as a stronger, privacy-focused culture on our product and engineering teams.
• 6We know that the global privacy landscape is in constant flux, and that new risks are routinely uncovered. Accordingly, we do not view this as a static Assessment-instead, we are committed to continuously analyzing our policies and practices to ensure that we can process Customer Personal Data in a way that complies with all applicable privacy and data protection laws. We're always willing to work with you if you have specific concerns not covered in the Assessment above. You can reach out to Datadog's privacy team at privacy@datadoghq.com.

·Reevaluation

·Request a personalized demo with a Datadog engineer

·I'd like Datadog to share the latest news about Datadog services and related offerings with me by email or telephone. You may unsubscribe at any time by following the instructions in the communications received from Datadog. Start Your Free Datadog Trial Now Get Started with Datadog

·Last updated

·This Data Processing Addendum with its appendices (together, this "DPA") is incorporated into the Master Subscription Agreement (or other electronic or mutually executed written agreement) between Datadog and Customer that references it (the "Agreement"). This DPA is effective as of the effective date of the Agreement.

·Data Processing

• 1.1Scope. This DPA applies when Datadog Processes Customer Personal Data or Account Data in providing the Services under the Agreement to Customer.
• 1.2Roles of the Parties.
• ·(a) Customer Personal Data. The Parties agree that Datadog is a Processor with respect to its Processing of Customer Personal Data in providing the Services. Datadog will only Process Customer Personal Data in accordance with the Agreement, this DPA (including Appendix A), and the Orders (the "Documented Instructions"). Datadog will promptly inform Customer if it becomes aware that the Documented Instructions violate Data Protection Laws.
• ·(b) Account Data. The Parties agree that Customer and Datadog are independent Controllers of Account Data, and each Party (i) will comply with its obligations as a Controller, and (ii) agrees to provide reasonable assistance to the other Party when required by Data Protection Laws.
• 1.3Customer Obligations. Customer is responsible for ensuring that no special categories of Personal Data (under GDPR Article 9), Personal Data relating to criminal convictions and offenses (under GDPR Article 10), or similarly sensitive Personal Data (defined in Data Protection Laws) is submitted to Datadog for Processing.
• 1.4Compliance with Laws. Each Party will comply with all the Data Protection Laws applicable to its performance under this DPA.
• 2This DPA remains in effect until the later of (a) the expiration or termination of the Agreement, and (b) the return or deletion of Customer Personal Data in accordance with Section 6.

·Duration

• 3Datadog will implement and maintain the technical and organizational measures to protect Customer Personal Data and Account Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, as described in Appendix B (the "Technical and Organizational Measures"). Datadog will take appropriate steps to ensure compliance with the Technical and Organizational Measures by its employees, agents, contractors, and Subprocessors to the extent applicable to their scope of performance, including ensuring that all persons authorized to Process Customer Personal Data or Account Data have agreed to appropriate confidentiality obligations.

·Security and Confidentiality

·Subprocessors

• 4.1Subprocessor Authorization. Customer generally authorizes Datadog to engage Subprocessors in accordance with this Section 4 and approves Datadog's use of the Subprocessors listed in the Subprocessors List. Datadog will update the Subprocessors List at least 30 days before appointing a new Subprocessor and will provide Customer with a mechanism to receive notifications of updates to the Subprocessors List (a "Change Notice"), which today is available through the Subprocessors List.
• 4.2Objections to Subprocessors. Customer may object to the new Subprocessor on reasonable grounds related to the protection of Customer Personal Data by sending an email to privacy@datadoghq.com describing its legitimate, good-faith objection within 15 days of a Change Notice (an "Objection Notice"), in which case Datadog may satisfy the objection by (a) not using the Subprocessor to Process Customer Personal Data; (b) taking corrective steps requested by Customer in its Objection Notice; or (c) ceasing to provide the parts of the Services that involve the Subprocessor Processing Customer Personal Data, subject to a mutual agreement of the Parties to adjust the remuneration for the Services considering their reduced scope. If none of the options outlined above are reasonably available and Customer's objection has not been resolved to the Parties' mutual satisfaction within 15 days of Datadog's receipt of the Objection Notice, either Party may terminate the affected Order and Datadog will refund to Customer a pro rata share of any unused amounts prepaid by Customer under the applicable Order for the Services on the basis of the remaining portion of the current terms of the Order. If Customer does not provide a timely Objection Notice with respect to a new Subprocessor, Customer will be deemed to have authorized Datadog's use of the Subprocessor and to have waived its right to object.
• 4.3Subprocessor Requirements. Datadog will enter into a written agreement with each Subprocessor that contains data protection obligations equivalent to those in this DPA. Datadog will be liable for the actions and omissions of its Subprocessors undertaken in connection with Datadog's performance under this DPA to the same extent Datadog would be liable if performing the Services directly.
• 5If Datadog receives a Data Subject Request, Datadog will (a) advise the Data Subject to submit the request to Customer directly, and (b) promptly notify Customer of the request. Where required by Data Protection Laws, Datadog will, on Customer's request and taking into account the nature of Customer Personal Data Processed, provide reasonable assistance to Customer in fulfilling the Data Subject Request to the extent Customer is unable through its use of the Services to address a particular Data Subject Request on its own. To the extent permitted by Applicable Law, Customer will be responsible for any costs arising from Datadog's assistance.

·Data Subject Requests

• 6Commencing 30 days after the effective date of termination of the Agreement, Datadog will initiate a process on Customer's written request that deletes Customer Personal Data retained in production within 90 days and in backups within 180 days. Any Customer Personal Data archived in backups will be isolated and protected from any further Processing, except as otherwise required by Applicable Laws. Notwithstanding the foregoing, to the extent Datadog is required by Applicable Laws to retain some or all Customer Personal Data, Datadog will not be obligated to delete the retained Customer Personal Data, and this DPA will continue to apply to the retained Customer Personal Data. Customer acknowledges that it is responsible for exporting any Customer Personal Data that Customer wants to retain prior to expiration of the referenced 30-day period pursuant to the Agreement.

·Data Deletion

·Personal Data Breaches

• 7.1Breach Notification. Datadog will notify Customer without undue delay after becoming aware of a Personal Data Breach. Datadog's notification to Customer will describe (a) the nature of the Personal Data Breach, including, if known, the categories and approximate number of Data Subjects and Personal Data records concerned; (b) the measures Datadog has taken, or plans to take, to respond to and mitigate the Personal Data Breach; (c) any measures Datadog recommends that Customer take to address the Personal Data Breach; and (d) information related to Datadog's point of contact with respect to the Personal Data Breach. If Datadog cannot provide all the information above in the initial notification, Datadog will provide the information to Customer as soon as it is available.
• 7.2Breach Response. Datadog will promptly take all actions relating to its Technical and Organizational Measures that it deems necessary and advisable to identify and remediate the cause of a Personal Data Breach.
• 7.3General. Datadog's notification of or response to a Personal Data Breach will not constitute an acknowledgment of fault or liability with respect to the Personal Data Breach. The obligations in this Section 7 do not apply to Personal Data Breaches that are caused by Customer, Authorized Users, or providers of Customer Components. Except as may otherwise be required by Applicable Law (including any mandated deadlines under Data Protection Laws), if Customer decides to notify a Supervisory Authority, Data Subjects, or the public of a Personal Data Breach, Customer will make reasonable efforts to provide Datadog with advance copies of the notice(s) and allow Datadog an opportunity to provide any clarifications or corrections to them.

·Audits

• 8.1Datadog's Audit Reports. On Customer's request, and subject to the confidentiality provisions of the Agreement, Datadog will make available to Customer copies of, or extracts from, Datadog's audit reports related to the security of the Services, including, for example, its ISO 27001 certification, SOC 2 Type 2 report, and Consensus Assessments Initiative Questionnaire (CAIQ).
• 8.2Customer's Audit Rights. Customer may request (directly or through a third-party auditor subject to written confidentiality obligations) an audit of Datadog to verify Datadog's compliance with the terms of this DPA if such an audit is required by Data Protection Laws and Datadog's compliance cannot be demonstrated by means that are less burdensome on Datadog (including under Section 8.1). Any audit under this section must meet the following requirements: (a) Customer must provide Datadog at least 30 days' prior written notice of a proposed audit unless otherwise required by a competent supervisory authority or Data Protection Laws; (b) Customer may not perform more than one audit in any 12-month period, except where required by a competent supervisory authority; (c) Customer and Datadog must mutually agree on the time, scope, and duration of the audit in advance; (d) Customer must reimburse Datadog for its time expended in connection with an audit at Datadog's reasonable professional service rates, which will be made available to Customer on request; (e) Customer must ensure that its representatives performing an audit protect the confidentiality of all information obtained through the audit in accordance with the Agreement, execute an enhanced mutually agreeable nondisclosure agreement if requested by Datadog, and abide by Datadog's security policies while on Datadog's premises; and (f) Customer must promptly disclose to Datadog any written audit report created, and any findings of noncompliance discovered, as a result of the audit.
• 9Taking into account the nature of the Processing and the information available to Datadog, Datadog will, when required by Data Protection Laws, assist Customer with its obligations related to data protection impact assessments (where related to the Services, and only to the extent that Customer does not otherwise have access to the relevant information) and prior consultation with supervisory authorities, including by providing the information outlined in Section 8.1 above.

·Impact Assessments and Prior Consultation

• 10To protect transfers of Personal Data out of the EEA, Switzerland, and the UK, the Parties agree to enter into the SCCs and the UK Transfer Addendum as described below.

·Data Transfers

• 10.1Transfers from the EEA. Where a Restricted Transfer is made from the EEA, the SCCs are incorporated into this DPA and apply to the transfer as follows:
• ·(a) with respect to Restricted Transfers from Customer to Datadog, Module One applies where both Customer and Datadog are Controllers, Module Two applies where Customer is a Controller and Datadog is a Processor, and Module Three applies where both Customer and Datadog are Processors;
• ·(b) in Clause 7, the optional docking clause does not apply;
• ·(c) in Clause 9(a) of Modules Two and Three, Option 2 applies, and the period for prior notice of subprocessor changes is set forth in Section 4 of this DPA;
• ·(d) in Clause 11(a), the optional language does not apply;
• ·(e) in Clause 17, Option 1 applies with the governing law being that of Ireland;
• ·(f) in Clause 18(b), disputes will be resolved before the courts in Dublin, Ireland;
• ·(g) Annex I of the SCCs is completed with the information in Appendix A to this DPA;
• ·(h) Annex II of the SCCs is completed with the information in Appendix B to this DPA; and
• ·(i) Annex III of the SCCs is completed with the information in the Subprocessors List.
• 10.2Transfers from Switzerland. Where a Restricted Transfer is made from Switzerland, the SCCs are incorporated into this DPA and apply to the transfer as modified in Section 10.1, except that:
• ·(a) in Clause 13, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner if the Restricted Transfer is governed by the Swiss Federal Act on Data Protection;
• ·(b) references to "Member State" in the SCCs refer to Switzerland, and data subjects located in Switzerland may exercise and enforce their rights under the SCCs in Switzerland; and
• ·(c) references to the "General Data Protection Regulation," "Regulation 2016/679," and "GDPR" in the SCCs refer to the Swiss Federal Act on Data Protection (as amended or replaced).
• 10.3Transfers from the UK. Where a Restricted Transfer is made from the UK, the UK Transfer Addendum is incorporated into this DPA and applies to the transfer. The UK Transfer Addendum is completed with the information in Section 10.1, the Subprocessors List, and Appendices A and B to this DPA; and both "Importer" and "Exporter" are selected in Table 4.
• 10.4Specific application of the SCCs. The following terms apply to the SCCs:
• ·(a) Customer may exercise its audit rights under the SCCs as set out in Section 8 above.
• ·(b) Datadog may appoint Subprocessors under the SCCs as set out in Section 4 above.
• ·(c) With respect to Restricted Transfers made to Datadog, Datadog may neither participate in, nor permit any Subprocessor to participate in, any further Restricted Transfer unless the further Restricted Transfer is made in full compliance with Data Protection Laws and in accordance with applicable SCCs or an alternative legally compliant transfer mechanism .
• ·(d) If any provision of this Section 10 is inconsistent with any terms in the SCCs, the SCCs will prevail.
• 11Each Party's liability taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability provisions of the Agreement.

·Limitation of Liability

• 12In the event of a conflict or inconsistency between the Agreement, this DPA, and the SCCs, the terms of the following documents will prevail (in order of precedence): the SCCs; then this DPA; and then the Agreement.

·Conflict

• 13Datadog may make changes to this DPA where (a) the change is required to comply with an Applicable Law; or (b) the change is commercially reasonable, does not materially reduce the security of the Services, does not change the scope of Datadog's processing of Customer Personal Data, and does not have a material adverse impact on Customer's rights under this DPA.

·Modifications

• 14Capitalized terms not otherwise defined in this DPA or the Agreement have the meanings assigned to them below.

·Definitions

• ·"Account Data" means information about Customer that Customer provides to Datadog in connection with the creation or administration of its Datadog accounts, such as first and last name, username, and email address of an Authorized User or Customer's billing contact.
• ·"Controller" means the entity that determines the purposes and means of Processing Personal Data.
• ·"Customer Data" means data from Customer's Environment that are submitted for Processing by the Services. Through Customer's configuration and use of the Services, Customer has control over the types and amounts of Customer Data.
• ·"Customer Personal Data" means Customer Data comprising Personal Data.
• ·"Data Protection Laws" means data protection or privacy laws and regulations directly applicable to a Party's Processing of Personal Data under the Agreement, including European Data Protection Laws.
• ·"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• ·"Data Subject Request" means a request from a Data Subject exercising his or her rights under Data Protection Laws that relates to Customer Personal Data and identifies Customer.
• ·"EEA" means the European Economic Area.
• ·"European Data Protection Laws" means the GDPR; the UK GDPR; and any national data protection laws, implementing regulations, or binding decisions made under the GDPR or the UK GDPR.
• ·"GDPR" means the General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing of Directive 95/46/EC.
• ·"Personal Data" means any information relating to an identified or identifiable natural person.
• ·"Personal Data Breach" means a breach of Datadog's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• ·"Process" and "Processing" mean any operation or set of operations which is performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• ·"Processor" means the entity that Processes Personal Data on behalf of a Controller.
• ·"Restricted Transfer" means (i) where the GDPR applies, a transfer of Customer Personal Data or Account Data from the EEA to a country outside of the EEA that is not subject to an adequacy determination by the European Commission; (ii) where the Swiss Federal Act on Data Protection applies, a transfer of Customer Personal Data or Account Data from Switzerland to a country that is not subject to an adequacy determination by the Swiss Federal Data Protection and Information Commissioner; and (iii) where the UK GDPR applies, a transfer of Customer Personal Data or Account Data from the UK to a country that is not the subject of adequacy regulations under section 17A of the United Kingdom Data Protection Act of 2018.
• ·"SCCs" means the standard contractual clauses for international transfers annexed to the European Commission's commission implementing decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, published on June 4, 2021, including as incorporated into the UK Transfer Addendum, if applicable.
• ·"Subprocessor" means any Processor engaged by Datadog or a Datadog Affiliate to Process Customer Personal Data on Datadog's or its Affiliate's behalf while providing the Services.
• ·"Subprocessors List" means the list of Subprocessors available at https://www.datadoghq.com/legal/subprocessors/.
• ·"UK" means the United Kingdom.
• ·"UK GDPR" means the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018.
• ·"UK Transfer Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, published by the UK Information Commissioner's Office on March 21, 2022.

Appendix AAppendix A - Details of Data Transfers

AA. LIST OF PARTIES

·Data Exporter(s):

·Name: Customer.

·Address: The address for Customer associated with its Datadog account or as otherwise stated in the Agreement.

·Contact person's name, position, and contact details: The contact details for Customer associated with its Datadog account or as otherwise stated in the Agreement.

·Activities relevant to the data transferred under these Clauses: Processing Customer Personal Data and Account Data for the purpose of providing, supporting, and improving the Services.

·Signature and date: The parties agree that execution of the Agreement constitutes execution of this Appendix A by both parties.

·Role (controller/processor): Processor or Controller with respect to Customer Personal Data; Controller with respect to Account Data.

·Data importer(s):

·Name: Datadog, Inc.

·Address: 620 8th Ave., 45th Fl., New York, NY 10018 USA

·Contact person's name, position, and contact details: The contact details for Datadog as stated in the Agreement. Datadog's privacy team can be contacted at privacy@datadoghq.com.

·Activities relevant to the data transferred under these Clauses: Processing Customer Personal Data and Account Data for the purpose of providing, supporting, and improving the Services.

·Signature and date: The parties agree that execution of the Agreement constitutes execution of this Appendix A by both parties.

·Role (controller/processor): Processor with respect to Customer Personal Data; Controller with respect to Account Data.

BB. DESCRIPTION OF TRANSFER

·Categories of data subjects whose personal data is transferred

·With respect to Account Data: the data subjects may include Customer's employees. With respect to Customer Personal Data, the data subjects may include Customer's employees, customers, vendors, and end-users. Categories of personal data transferred

·With respect to Account Data: the Personal Data that is sent to Datadog by Customer for the purpose of using the Services. With respect to Customer Personal Data: the Personal Data that is sent to Datadog by Customer for the purpose of using the Services.

·Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

·No sensitive data is transferred.

·The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

·The Personal Data is transferred on a continuous basis. Nature of the processing

·With respect to Account Data: general account management and other activities as outlined in Datadog's public Privacy Policy, available at https://www.datadoghq.com/legal/privacy/. With respect to Customer Personal Data: analysis, storage, and other Services as described in the Agreement, Order(s), DPA, and Documentation.

·Purpose(s) of the data transfer and further processing

·With respect to Account Data: for Datadog to (a) manage Customer's account, including to calculate Fees; (b) provide and improve the Services and Support, including to address Support Requests and troubleshoot other issues; and (c) provide Customer and Authorized Users with insights, service and feature announcements, and other reporting. With respect to Customer Personal Data: for Datadog to provide, support, and improve the Services.

·The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

·With respect to Account Data: Personal Data is retained to manage Customer's accounts in accordance with Datadog's Privacy Policy. With respect to Customer Personal Data: Personal Data is retained in accordance with either Customer's configuration of the Services or the retention schedules outlined in the Documentation.

·For transfers to (sub-) processors, also specify subject matter, nature, and duration of the processing

·With respect to Account Data: the subject matter of Personal Data transferred to Subprocessors is Account Data, which is transferred to Subprocessors to manage Customer's accounts with Datadog, in accordance with Datadog's Privacy Policy. With respect to Customer Personal Data: the subject matter of Personal Data transferred to Subprocessors is Customer Personal Data, which is transferred to Subprocessors to provide, support, and improve the Services, as outlined in the agreements between Customer and Datadog.

CC. COMPETENT SUPERVISORY AUTHORITY

·Identify the competent supervisory authority/ies in accordance with Clause 13

·The competent supervisory authority determined in accordance with Data Protection Laws.

Appendix BAppendix B - Technical and Organizational Measures

·As of the date of this DPA, Datadog's technical and organizational measures include the following.

11. Access Control

• ·Datadog restricts access to Customer Personal Data to employees with a defined need-to-know or a role requiring such access.
• ·Datadog maintains user access controls that address timely provisioning and de-provisioning of user accounts.

22. Audit

• ·Datadog will maintain SSAE 18 SOC 2 certification, or comparable certification, for the term of the Agreement. This certification will be renewed on an annual basis. Upon Customer's request, Datadog will provide a summary of its most recent SOC 2 report once every 12 months of the term of the Agreement.
• ·Datadog follows guidelines from ISO 27001, NIST and other industry-standard practices.

33. Business Continuity

• ·Datadog maintains business continuity, backup, and disaster recovery plans ("BC/DR Plans") in order to minimize the loss of service and comply with Applicable Laws.
• ·The BC/DR Plans address threats to the Services and any dependencies, and have an established procedure for resuming access to, and use of, the Services.
• ·The BC/DR Plans are tested at regular intervals.

44. Change Control

• ·Datadog maintains policies and procedures for applying changes to the Services, including underlying infrastructure and system components, to ensure quality standards are being met.
• ·Datadog undergoes a penetration test of its network and Services on an annual basis. Any vulnerabilities found during this testing will be remediated in accordance with Datadog's Vulnerability Management Policies and Procedures, and will be assessed on the basis of Datadog's Risk Management Framework.
• ·Datadog regularly performs vulnerability scans of its network and any vulnerabilities found will be addressed in accordance with Datadog's Vulnerability Management Policies and Procedures, and will be assessed on the basis of Datadog's Risk Management Framework.
• ·Security patches are applied in accordance with Datadog's patching schedule.
• ·Datadog maintains an environment for testing and development separate from the production environment.

55. Data Security

• ·Datadog maintains technical safeguards and other security measures to ensure the security and confidentiality of Customer Personal Data.
• ·Datadog logically segregates Customer Personal Data in the production environment.

66. Encryption and Key Management

• ·Datadog maintains policies and procedures for the management of encryption mechanisms and cryptographic keys in Datadog's cryptosystem.
• ·Datadog enlists encryption at rest and in transit between public networks, as applicable, according to industry-standard practice.

77. Governance and Risk Management

• ·Datadog maintains an information security program that is reviewed at least annually.
• ·Datadog maintains a risk management program, with risk assessments conducted at least annually.

88. Administrative Controls

• ·Datadog uses a third-party to conduct employee background verifications for all Datadog personnel with access to Customer Personal Data.
• ·Datadog employees are required to complete initial (at-hire) and annual security awareness training.

·Request a personalized demo with a Datadog engineer

·I'd like Datadog to share the latest news about Datadog services and related offerings with me by email or telephone. You may unsubscribe at any time by following the instructions in the communications received from Datadog. Start Your Free Datadog Trial Now Get Started with Datadog