·This FAQ answers questions we often get about our Terms of Service, our privacy statements, our documentation, our Acceptable Use Policy, and how they all work together. It does not replace any of those, nor is it legally binding on its own.

·NOTE: If you have questions or would like to suggest an update, check out our support page.

·Why is Fastly documentation mentioned in the Terms of Service?

·We believe in transparent communication. That's why we built out a public documentation portal that describes our products, how our services work, and our security and technology compliance programs. Fastly documentation is available to anyone (including all subscribers and prospective subscribers) at https://docs.fastly.com. We contractually stand behind all of our documentation. Anyone can sign up for a free account and confirm that what they see on https://docs.fastly.com matches our services.

·What if Fastly documentation changes over time?

·We work hard to improve and evolve our services, and we'll update the documentation as that happens and we post changes in our documentation to our changes blog. Anyone can subscribe to receive our changes blog via email or an RSS feed. We also maintain our significant changes blog, which highlights changes to our documentation that might reflect a reduction in features or functionality of our services, changes to our security program, or a significant increase in our subscribers' obligations. You can also subscribe to the significant changes blog by RSS or email.

·What are Fastly's support commitments and service level agreements?

·Our Support Description and SLA describes the hours of availability and response times for all our levels of customer support for our delivery products. The support offering a subscriber receives depends on the level of service a subscriber has purchased from us. The type of SLA a subscriber receives depends on the type of contract and level of support service the subscriber has purchased from us. Our Availability SLA describes our service level commitments for our network. Our Availability SLA also addresses how to work with our support team in the event of a planned (or unplanned) significant spike in usage. Product specific service and support SLAs are included in the product descriptions for Signal Sciences Next-Gen WAF and Signal Sciences Cloud WAF.

·Why does Fastly have a Privacy Policy and how does it affect my business?

·The Privacy Policy describes information we collect about visitors to our website and attendees to our corporate events, the information we collect from individuals who register for or authenticate to our edge cloud services, and individuals who submit an application for a career opportunity. It also summarizes our commitments to the EU-US Data Privacy Framework and the Swiss and United Kingdom extensions (together, the "Data Privacy Framework") as set forth by the US Department of Commerce. You can view our notice of Data Privacy Framework self-certification here.

·The Privacy Policy doesn't apply to how we process personal information submitted to us by our subscribers (or their internet clients) via our services - these commitments are covered by the privacy policies of our subscribers.

·What data does Fastly collect from Fastly services and how does Fastly use it?

·As you'll find with any internet company, when Fastly provides services to our subscribers, we receive some data about their websites and applications. We also learn a lot simply by having such a big presence on the internet. We collect data that is operationally necessary to deliver, maintain and improve our services. Details about how we retain and use data can be found in our Compliance documentation.

·Fastly's security services collect data insights from anomalous activity and suspicious behavior detected by the services. Fastly uses these data insights to further protect its customers and improve Fastly products. Fastly provides additional information about how these data insights are used in Threat Intelligence in the descriptions of Signal Sciences Next-Gen WAF and Signal Sciences Cloud WAF.

·Can I transfer personal data from the EU to the US using the Fastly services?

·Fastly services by default do not process personal data other than IP addresses to route requests and deliver content. Our service can be configured or used at the direction of the customer to process personal data. In addition, Fastly's data processing terms available here and incorporated by reference into the Fastly Terms of Service, include the European Commission's standard contractual clauses for the transfer of personal data to the U.S.

·The data processing terms cover use cases in which a data controller uses or configures the Fastly services to process personal data, to cache or transmit personal data, or to log personal information in your log files, including IP addresses. Like with all source code, service configurations and VCL are not appropriate places to store personal information.

·These data processing terms do not apply if you have reached separately agreed terms with Fastly. If you require a signed version of these terms, please contact support@fastly.com. Fastly considers any changes made to these data processing terms to be a significant update and will post a notice that these data processing terms have been updated on https://docs.fastly.com/changes.

·I think my business has some specific needs and requirements. What should I do?

·Reach out to your sales representative if you think you have needs or requirements that aren't addressed by our terms, data privacy, documentation, or this FAQ. Feel free to email sales@fastly.com to be connected with a sales team member for assistance.

·What does "Acceptable Use" mean?

·Fastly is an intermediary between our subscribers and their users. This means we have to put a few rules in place to ensure that we're not held accountable for illegal or harmful things that subscribers (or their users) do while using Fastly services. We expect subscribers and their end users to respect the law while using Fastly. You can find more information in our Acceptable Use Policy, which hosts DMCA information and process.

·Why do subscribers need to give us an Abuse Contact?

·In addition to being an intermediary between our subscribers and their end users, we often appear to be the provider for subscriber content. If someone has a complaint about content being delivered by or cached on our network, we want to enable the parties involved to resolve their issues as quickly as possible. The fastest way to do that is for Fastly to send a subscriber contact email to the person who alerted us to the potential violation of our Acceptable Use Policy.

·What are non-Fastly services and what am I giving Fastly permission to do?

·Non-Fastly services are services that our subscribers elect to use outside of Fastly. Examples include your origin, a DNS provider, a CMS like WordPress, or something similar. In many cases, Fastly is actually configured to work with these third-party services. The Non-Fastly Services provision gives us permission to work with these services, makes it clear that subscribers are directly responsible for their relationships with third-party service providers, and lets subscribers know that we are not responsible if something goes wrong with a service that Fastly does not provide.

·What are the typical lifecycles of Fastly Features and Services?

·Fastly typically uses three lifecycle categories for releases: beta, limited availability, and general availability. Our product lifecycle guide describes the support and long term availability for each of these categories in more detail. The Beta Services section of our Terms of Service also provides additional information.

·What does "feedback" mean?

·At Fastly, we take pride in our customer support and how effectively we are able to respond to subscriber requests. We also want to build an awesome edge cloud service that continues to evolve, and we are very open to suggestions for features and improvements. Our feedback provision ensures that if a subscriber gives us a suggestion about how to improve our service, we can integrate it efficiently.

·What happens if usage of our services by a subscriber or its users interferes with our services?

·Usage of our services that interferes with or disrupts the integrity and performance of our services violates our Acceptable Use Policy and may result in the suspension or termination of services to the applicable subscriber. To avoid adversely affecting other subscribers or the Fastly network, a subscriber must promptly respond to any communication from Fastly regarding its use of our services or its users' use of our services if that use interferes or disrupts our services.

·What are some examples of use of our services that may interfere with or disrupt the integrity and performance of our services?

·As described in our Service Availability SLA, utilization spikes in traffic may interfere with our services and adversely affect other subscribers. In addition, security vulnerability research testing or penetration testing by third parties or our subscribers that do not comply with our instructions may interfere with our services and as a result adversely affect our network or other subscribers. Fastly may take action against any unauthorized use of our services including suspension or termination of a subscriber's account.

·Which version of the Terms of Service, Acceptable Use Policy, and Privacy Policy apply to me?

·We most recently updated our Terms of Service on August 9, 2022. All previous versions of our Terms of Service are archived in our documentation archives site. Our current Data Processing Terms, which are incorporated into our Terms of Service, may be found here. The Terms of Service applicable to you are determined by the date you agreed to them, and stay in effect unless you agree to a new version, which means that updates to our Terms of Service don't affect you until you take significant action with your account. You will be asked to agree to our Terms of Service when you first create an account (usually a trial account). If after that, you switch to a paid month-to-month account, purchase a self-service product, or sign a service order with us, you will be asked to agree to the Terms of Service then in effect. If you are a trial subscriber prior to an update to the Terms of Service, you won't have to accept new terms of service until you convert to a paid account. Some subscribers have other arrangements with us, and updates to the Terms of Service on our website do not affect the terms of their arrangement with us.

·We believe in transparency and want to make sure you have the opportunity to see the changes we have made over time. In addition to historical versions of our Terms of Service, we make available all historical versions of the Acceptable Use Policy and the Privacy Policy. Updates to our Acceptable Use Policy are effective for everyone upon posting, but existing subscribers will have thirty days before they become effective for them. Updates to our Privacy Policy are effective thirty (30) days after being posted.

·What does Subscriber Data mean?

·As defined in our subscription documents, Subscriber Data is content transmitted or cached through our network, requests received by the network, and the configurations and credentials of our subscribers. Any content authorized or permitted by a subscriber to be transmitted or cached through our network is Subscriber Data of that subscriber.

·PLEASE READ THESE DATA PROCESSING TERMS (THESE "TERMS") CAREFULLY. THESE TERMS ARE A BINDING CONTRACT FOR PROCESSING OF PERSONAL DATA OF DATA SUBJECTS THROUGH THE USE OF FASTLY, INC. OR ITS AFFILIATES ("FASTLY") SERVICES.

·IF YOU DO NOT AGREE TO BE BOUND BY ALL OF THE PROVISIONS OF THESE TERMS, AND YOU HAVE NOT SEPARATELY AGREED WITH FASTLY, INC. OR A RELEVANT FASTLY, INC. AFFILIATE ON TERMS REGARDING THE PROCESSING OF PERSONAL DATA OF DATA SUBJECTS, DO NOT ACCESS OR USE, AS APPLICABLE, FASTLY'S OR THE AFFILIATE'S SERVICES FOR THE PROCESSING OF PERSONAL DATA OF DATA SUBJECTS. IF YOU REQUIRE A SIGNED VERSION OF THESE TERMS PLEASE CONTACT SUPPORT@FASTLY.COM.

·BY ACCESSING OR USING FASTLY SERVICES YOU ARE ACCEPTING THESE TERMS (ON BEHALF OF YOURSELF OR THE ENTITY THAT YOU REPRESENT) AND YOU REPRESENT AND WARRANT THAT YOU HAVE THE RIGHT, AUTHORITY, AND CAPACITY TO ENTER INTO THESE TERMS (ON BEHALF OF YOURSELF OR THE ENTITY THAT YOU REPRESENT AND ITS AFFILIATES). T

·HESE TERMS WERE POSTED ON AUGUST 9, 2022. PRIOR VERSIONS OF THESE TERMS ARE AVAILABLE AT https://docs-archive.fastly.com/dataprocessing/.

·FASTLY DATA PROCESSING TERMS

11. Purpose. In consideration of the parties' mutual obligations to comply with applicable law in accordance with the Agreement, these Fastly Data Processing Terms (these "Terms") (including their appendices) apply to Fastly's Processing of Personal Data on Subscriber's behalf in accordance with Privacy and Data Protection Laws. Unless otherwise expressly agreed in writing between Subscriber and Fastly, this version of the Terms (1) is incorporated into and subject to the Agreement and each Service Order, (2) shall be effective and remain in force for the term of the Agreement and each Service Order, and (3) in the event of any conflict between the terms of the Agreement, a Service Order, and these Terms, the relevant provisions of these Terms shall take precedence. These Terms shall not apply to any Subscriber that does not access or use the Services for Processing of Personal Data subject to Privacy and Data Protection Laws.

22. Definitions. Capitalized terms not defined in these Terms shall have the meaning set forth in the Agreement.

2.12.1 "Agreement" means any master subscription agreement or master customer agreement, by which a member of the Fastly Group grants a limited subscription to use the Services to Subscriber or otherwise makes its services available, such as the Fastly Terms of Service (available at https://www.fastly.com/terms). In the event Subscriber has entered into an Agreement with more than one Fastly Group entity, the Agreement governing the Services Processing the applicable Personal Data shall control.

2.22.2 "CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.

2.32.3 "Data Controller" has the meaning given to "controller" or "data controller" in accordance with applicable Privacy and Data Protection Laws.

2.42.4 "Data Processor" has the meaning given to "processor" or "data processor" in accordance with applicable Privacy and Data Protection Laws.

2.52.5 "Data Subject" has the meaning given to "data subject" in accordance with applicable Privacy and Data Protection Laws.

2.62.6 "Documentation" means the online documentation available via http://docs.fastly.com, or when applicable, product specific documentation described in the Agreement with a Fastly Group affiliate.

2.72.7 "EU GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

2.82.8 "Fastly Group" means Fastly, Inc. and its affiliates engaged in the Processing of Personal Data.

2.92.9 "GDPR" means, as applicable, the EU GDPR and/or the UK GDPR.

2.102.10 "Personal Data" has the same meaning as personal data or information of or about a person, as defined in the applicable Privacy and Data Protection Laws, where such data is submitted to Fastly via the Services according to Subscriber's configuration of the Services.

2.112.11 "Privacy and Data Protection Laws" means any law or regulation applicable to the processing of personal data under the Agreement, including, for example, the GDPR and the CCPA.

2.122.12 "Processing" and "process" have the meaning given in accordance with applicable Privacy and Data Protection Laws.

2.132.13 "Service Order" means one or more online or written ordering documents which incorporate the Agreement or have otherwise been accepted by a member of the Fastly Group.

2.142.14 "Services" has the meaning of such defined term in the Agreement or other similar terms to describe the products and services provided by the Fastly Group.

2.152.15 "Standard Contractual Clauses" means, as applicable, the EEA Standard Contractual Clauses and/or the UK Standard Contractual Clauses as defined in Appendix 3.

2.162.16 "Subscriber" means the subscriber that has executed a Service Order for Services.

2.172.17 "Subscriber Data" has the meaning of such defined term in the Agreement or other similar term to describe the data submitted (or caused to be submitted) to the Fastly Group via the Services.

2.182.18 "Sub-processor" means any Data Processor engaged by Fastly or a member of the Fastly Group, including Fastly affiliates.

2.192.19 "UK GDPR" means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018.

33. Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Subscriber is either a Data Controller or a Data Processor, and Fastly is a Data Processor.

44. Subscriber's Processing of Personal Data. Subscriber shall, in its use of the Services, only Process Personal Data or transfer such Personal Data to Fastly, in accordance with the requirements of Privacy and Data Protection Laws and the Documentation. In particular, Subscriber represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, there is a legal basis for the Processing by Fastly of Personal Data on behalf of Subscriber in accordance with these Terms and the Agreement (including any and all instructions issued by Subscriber from time to time in respect of such Processing) and it will honor the rights of Data Subjects pursuant to Privacy and Data Protection Laws. If Subscriber is a Data Processor, Subscriber represents and warrants that its instructions and actions with respect to the Personal Data, including appointing Fastly as a Processor, have been and are authorized by the relevant Data Controller.

55. Fastly's Processing of Personal Data. Fastly shall only Process Personal Data upon Subscriber's documented instructions and immediately notify Subscriber in writing if, in Fastly's reasonable opinion, their instructions infringe Privacy and Data Protection Laws; provided, Subscriber acknowledges that the Services will Process Personal Data on an automated basis in accordance with Subscriber's configurations, which Fastly does not monitor or control. Subscriber instructs Fastly to Process Personal Data for the following purposes: (i) Processing in accordance with the Agreement,applicable Service Orders, and Subscriber's use of the Services; (ii) Processing initiated by Subscriber through the Services' application programming interfaces (APIs) or user interfaces; (iii) Processing to comply with other reasonable documented instructions provided by Subscriber (e.g., via support tickets, email communications and chat platforms) where such instructions are consistent with the terms of the Agreement; and (iv) Processing otherwise required of Fastly by applicable laws. These Terms and the Agreement contain Subscriber's sole instructions to Fastly for the Processing of Personal Data, provided that the Subscriber may provide additional instructions during the term of the Agreement or applicable Service Order that are consistent with these Terms and the nature and lawful use of the Services. Appendix I, Part B to these Terms sets out the details of Fastly's Processing of Personal Data.

66. Transfers of Personal Data

6.16.1 Fastly's Global Network. Subscriber acknowledges that as part of performing its Services Fastly maintains a growing global network of computing facilities that will process Subscriber Data (including Personal Data) in accordance with Subscriber's configurations of the Services. Subscriber acknowledges that its Subscriber Data may automatically transit across national borders in response to Subscriber's clients' requests and Subscriber's configurations of the Services in accordance with the Documentation.

6.26.2 Consent to Transfer. Except as expressly set forth in the Agreement, Fastly may store and process Personal Data in the United States or any other country in which Fastly or any of its Sub-processors maintains facilities, subject to this Section 6.

6.36.3 Cross-Border Personal Data Transfer Mechanism. Where Processing of Personal Data by Fastly requires an onward transfer mechanism to lawfully transfer Personal Data from a jurisdiction (including those identified in Appendix 3), then the terms and conditions of Appendix 3 (Cross Border Transfer Mechanism) shall apply.

77. Correction, Amendment and Deletion of Personal Data. To the extent Subscriber, in its use of the Services, does not have the ability to correct, amend or delete Personal Data as required by Privacy and Data Protection Laws, Fastly shall comply with any commercially reasonable request by Subscriber to facilitate such actions to the extent Fastly is legally permitted to do so and has reasonable access to the Personal Data. Subscriber acknowledges that Fastly cannot correct, amend, or permanently delete cached copies of Personal Data hosted or stored on equipment controlled by Subscriber; and the storage and deletion of Subscriber Data processed by the Services occur automatically in accordance with the Documentation.

88. Third Party Requests. Fastly shall, to the extent legally permitted, promptly notify Subscriber if it receives a request, complaint, inquiry or other correspondence from a data subject, regulatory authority, or other third party in connection with Fastly's processing of Personal Data. Unless required by law, Fastly shall not respond to any such third party request without Subscriber's prior written consent except to confirm that the third party request relates to Subscriber and to provide the third party with Subscriber's contact information to allow them to contact Subscriber directly. Taking into account the nature of the Processing and to the extent Subscriber does not have access to the relevant information through its use of the Services, Fastly shall, at Subscriber's cost, provide Subscriber with such assistance as may be reasonably necessary and technically possible in the circumstances, to assist Subscriber in fulfilling its obligations with respect to third party requests.

99. Fastly Personnel

9.19.1 Confidentiality. Fastly shall ensure that its personnel (including personnel of the Fastly Group) engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed confidentiality agreements.

9.29.2 Reliability. Fastly shall take commercially reasonable steps to ensure the reliability of any Fastly personnel engaged in the Processing of Personal Data.

9.39.3 Limitation of Access. Fastly shall limit its access to Personal Data to those personnel who require such access to perform the Agreement.

9.49.4 Data Protection Officer. Members of the Fastly Group have appointed a data protection officer to the extent this is required by Privacy and Data Protection Laws. The appointed person may be reached at gc@fastly.com. Fastly's language for official communications is English.

1010. Sub-Processors

10.110.1 Appointment of Sub-processors. In accordance with Article 28(2) of the GDPR, Subscriber acknowledges and agrees that (a) members of the Fastly Group may be retained as Sub-processors; and (b) members of the Fastly Group may engage third-party Sub-processors in connection with the provision of the Services, in which case, members of the Fastly Group (as the case may be) shall procure that the Fastly Group has entered into a written agreement with each Sub-processor containing data protection obligations in substantially similar terms to those in these Terms with respect to the protection of Personal Data to the extent applicable to the nature of the Services provided by such Sub-processor. Fastly will make available to Subscriber a current list of Sub-processors engaged in connection with the provision of the Services with the identities of those Sub-processors in the Documentation or by posting such list to a Fastly Group website at https://docs.fastly.com/products/sub-processors. Additions or changes to the list of Sub-processors will be provided to Subscribers according to the Documentation updates provision of the Agreement or the applicable Fastly Group website, but in no event less than thirty (30) days prior to the date on which those Sub-processors begin processing Personal Data.

10.210.2 Right to Object. In the event Subscriber objects to a new or replacement Sub-processor that Processes Personal Data, Subscriber may terminate the applicable Service Order(s) for those Services which cannot be provided by Fastly without the Processing of Personal Data by the objected-to new Sub-processor (including by changing Subscriber's configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or replacement Sub-processor without unreasonably burdening Subscriber or materially diminishing functionality) by providing written notice to Fastly within thirty (30) days of Fastly's notice or disclosure of such new Sub-processor(s). Subscriber shall receive a pro-rata refund of any unearned prepaid fees for the period following the effective date of termination in respect of such terminated Services.

10.310.3 Liability. Fastly shall be liable for the acts and omissions of its Sub-processors to the same extent Fastly would be liable if performing the services of each Sub-processor directly under the terms of these Terms, except as otherwise set forth in the Agreement.

1111. Security Controls for the Protection of Personal Data. Fastly shall maintain appropriate administrative, physical and technical safeguards for protection of the security and integrity of the Personal Data as set forth in the Documentation. Fastly regularly monitors compliance with these safeguards.

1212. Security Breach Management and Notification. Fastly shall notify Subscriber without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Fastly or its Sub-processors of which Fastly becomes aware ("Security Breach"), providing Subscriber with sufficient information (insofar as such information is within Fastly's possession) to allow Subscriber to meet its obligations to report or inform data subjects and/or regulatory authorities of the Security Breach under the GDPR, to the extent permitted by law. Fastly shall make commercially reasonable efforts to assist Subscriber in the investigation, mitigation and remediation of a Security Breach that is known to Fastly to the extent such Security Breach is caused by a violation of the requirements of these Terms by Fastly.

1313. Limitation of Liability. Nothing in these Terms is intended to prejudice or limit any of Fastly's right to limitations of liability afforded to data processors pursuant to Privacy and Data Protection Laws. Each party's liability arising out of or related to these Terms (whether in contract, tort or under any other theory of liability) is subject to the limitations of liability set forth in the Agreement; provided, in no event will such limitation apply to any data subject's rights under the Standard Contractual Clauses.

1414. Specific Provisions.

14.114.1 Data Protection Impact Assessment. Upon Subscriber's request and at Subscriber's cost, Fastly shall provide Subscriber with reasonable assistance needed to fulfill Subscriber's obligation under Privacy and Data Protection Laws to carry out a data protection impact assessment related to Processing of Personal Data by Fastly taking into account the nature of the Processing and to the extent Subscriber does not otherwise have access to the relevant information, and to the extent such information is available to Fastly.

14.214.2 Prior Consultation. Upon Subscriber's request and at Subscriber's cost, Fastly shall provide Subscriber with reasonable assistance with any prior consultations to any regulatory authority of Subscriber which are required under Privacy and Data Protection Laws such as Article 36 of the GDPR related to Processing of Personal Data by Fastly and taking into account the nature of the Processing and to the extent Subscriber does not otherwise have access to the relevant information and to the extent such information is available to Fastly.

14.314.3 Audits. The parties agree that the audits described in the Standard Contractual Clauses and Privacy and Data Protection Laws shall be carried out in accordance with the following specifications:

14.3.114.3.1 Upon Subscriber's request, and subject to the confidentiality obligations set forth in the Agreement, Fastly shall make available to Subscriber third-party certifications and audit reports regarding the Fastly Group's compliance with the obligations set forth in these Terms and Subscriber shall use such information solely for the purposes of complying with its obligations under Privacy and Data Protection Laws.

14.3.214.3.2 If the information made available pursuant to Section 14.3.1 is insufficient, in Subscriber's reasonable judgment, to confirm Fastly's compliance with its obligations under these Terms, then Subscriber may request an on-site audit of the procedures relevant to the protection of Personal Data under these Terms. All such audits will be performed at Subscriber's expense. Subscriber shall give Fastly reasonable notice of any on-site audit to be conducted under this Section 14.3(which shall in no event be less than thirty (30) days' notice unless required by a regulatory authority).

14.3.314.3.3 Subscriber shall reimburse Fastly for any time expended for any such on-site audit at the Fastly Group's then-current professional services rate, which shall be made available to Subscriber upon request. Before the commencement of any such on-site audit, Subscriber and Fastly shall mutually agree upon the scope, timing and duration of the audit in addition to the reimbursement rate for which Subscriber shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Fastly. Subscriber shall promptly notify Fastly with information regarding any non-compliance discovered during the course of an audit.

14.414.4 Deletion of Personal Data. Fastly shall delete Personal Data upon the termination or expiration of all Service Orders providing for the Processing of Personal Data and upon the request of Subscriber to the extent permitted by applicable law. Subscriber acknowledges that, except to the extent described in the Documentation, the Services do not export Subscriber Data and, therefore, Fastly will not return any Personal Data.

14.514.5 Certification of Deletion. The parties agree that the certification of deletion of Personal Data that is described in Clause 8.5 of the Standard Contractual Clauses shall be provided by Fastly to Subscriber only upon Subscriber's request.

1515. CCPA Compliance. As a service provider to Subscriber under the Agreement, Fastly will comply with the CCPA's restrictions and prohibitions on service providers selling Personal Data and retaining, using, or disclosing Personal Data outside of the parties' direct business relationship. Fastly shall not collect, use, retain, or disclose Personal Data except as permitted in the Agreement and under the CCPA. Fastly shall not sell Personal Data.

1616. Enforcement. If any provision of these Terms is held by a court of competent jurisdiction to be contrary to law, the provision will be deemed null and void, and the remaining provisions of these Terms will remain in effect

1717. Order of Precedence. In the event of any conflict or inconsistency among the following, the provisions of the following agreements, in order of precedence, shall prevail: (i) the Standard Contractual Clauses (when applicable), (ii) these Terms, (iii) the Service Order(s) and (iv) the Agreement.

1818. Changes to these Data Processing Terms. In consideration of Fastly's ongoing obligations to comply with applicable law in the performance of the Services, Fastly may update these Terms. Fastly will provide no less than thirty (30) days' prior notice of any change to these Terms (formatting and other immaterial changes excepted), unless prior notice is not practicable due to a conflict in applicable law or regulation or other changes outside of Fastly's reasonable control. This notice of an update to these Terms will be posted on https://docs.fastly.com/changes/. Subscriber may subscribe to receive email and RSS updates to http://docs.fastly.com/changes.

Appendix 1Appendix 1 - Details of the Parties and Processing

AA. List of Parties

·Data exporter(s): Name: Subscriber and any Affiliates identified by Subscriber in the Agreement

·Address: Address of Subscriber described in the Agreement or as Subscriber has otherwise informed Fastly

·Contact person's name, position, and contact details: As stated in the Agreement or as Subscriber has otherwise informed Fastly

·Activities relevant to the data transferred under the SCCs and these Terms: use of the Services in accordance with the Agreement

·Signature and Date: This Appendix 1 shall be deemed executed upon execution of these Terms.

·Role: Data exporter's role is set forth in Section 3 of these Terms.

·Data importer(s):

·Name: Fastly, Inc.

·Address: PO Box 78266, San Francisco, California, 94107, United States of America

·Contact person's name, position, and contact details: Tara Seracka, Data Protection Officer, gc@fastly.com

·Activities relevant to the data transferred under the SCCs and these Terms: Processing necessary to provide the Services

·Signature and Date: This Appendix 1 shall be deemed executed upon execution of these Terms. Role: Processor

BB. Description of Processing and Transfer

·The categories of Data Subject to whom the Personal Data relates

·Data Subjects include the identified or identifiable persons contained in content or requests, including internet protocol (IP) addresses, caused to be submitted to Fastly via the Services according to, by or at the direction of Subscriber's configuration of the Services.

·Categories of personal data processed and transferred

·Personal Data within network requests and/or Subscriber Data (as that term is defined in the Agreement).

·Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

·The Services do not require the Processing of sensitive data. Sensitive data will be processed only if data exporter instructs data importer to process sensitive data. The sensitive or special categories of data contained in content or requests (as determined and controlled by the data exporter) may include, Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and the processing of data concerning health or sex life. Any such special categories of data shall be protected by applying the Security Measures described in Appendix 2.

·The frequency of the processing and transfer (e.g. whether the data is transferred on a one-off or continuous basis).

·Processing and transfers shall occur on a continuous basis as instructed by data exporter.

·The nature and purpose of the Processing

·Fastly is (a) an Internet intermediary and provider of edge cloud services that processes network requests according to standard protocols; (b) a provider of edge computing; and, (c) directly and through members of the Fastly Group a provider of network security services. Fastly provides all of its services upon the instruction of the data exporter in accordance with the terms of (i) the Agreement and (ii) the Data Processing Terms (or Data Processing Agreement as applicable) with the data exporter.

·Fastly will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as further specified in the Documentation and in accordance with Subscriber's configurations of the Services.

·Purpose(s) of the data transfer and further processing

·The objective of processing of personal data by data importer is the performance of the Services pursuant to the Agreement with data exporter.

·The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period.

·Personal Data is retained consistent with data exporter's instructions and data importer's documentation. For data importer's content delivery and caching services, Personal Data is retained until the earlier of automated eviction from data importer's cache servers automatically or when exporter instructs importer to delete the data.

·For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

·Data may be transferred to sub-processors to process data, on data importer's behalf, consistent with data exporter's instructions to data importer and data importers published documentation.

·Data importer makes available to data exporter a current list of sub-processors engaged in connection with the Services with the identities of those sub-processors in its documentation (at docs.fastly.com). Notice of additions or changes to the list of sub-processors will be provided to data exporter according to the Documentation updates provision of the parties' Agreement or the applicable data importer website.

CC. Competent Supervisory Authority

·Identify the competent supervisory authority/ies in accordance with Clause 13

·For the EEA Standard Contractual Clauses, the competent supervisory authority is determined in accordance with Clause 13 of the EEA SCCs.

·For the UK Standard Contractual Clauses, the competent supervisory authority is the UK Information Commissioner's Office.

Appendix 2Appendix 2

·Technical and Organisational Measures Including Technical and Organisational Measures To Ensure The Security Of The Data

·Fastly will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data as described in the Security Measures applicable to the specific Services purchased by data exporter, as updated from time to time, and accessible via https://docs.fastly.com/guides/security-measures/ or otherwise made reasonably available by Fastly.

·Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

·Fastly's Security Measures are regularly tested and evaluated by third-party auditors, including as part of annual AICPA SOC 2 Type 2 and PCI DSS Level 1 audits. Fastly also conducts internal audits and risk assessments.

Appendix 3Appendix 3 - Cross Border Transfer Mechanism

11. Definitions. Capitalized terms not defined in this Appendix shall have the meaning set forth in the Terms.

1.11.1 "Standard Contractual Clauses" means, as applicable to a particular transfer, one of the following:

1.1.11.1.1 EEA SCCs

1.1.21.1.2 UK SCCs

1.1.31.1.3 UK IDTA

1.21.2 "EEA SCCs" or "EEA Standard Contractual Clauses" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.31.3 "UK SCCs" or "UK Standard Contractual Clauses" means the UK Addendum to the EEA SCCs adopted pursuant to or permitted under Article 46 of the UK GDPR.

1.41.4 "UK IDTA" means the UK International Data Transfer Agreement (IDTA) adopted pursuant to or permitted under Article 46 of the UK GDPR.

22. The Standard Contractual Clauses will apply to any Processing of Personal Data by Fastly where Personal Data is transferred from the European Economic Area ("EEA"), the United Kingdom and/or Switzerland to outside the EEA, the United Kingdom and/or Switzerland, either directly or via onward transfer, to any country or recipient: (a) not recognized by the European Commission, United Kingdom, or Switzerland (as applicable) as providing an adequate level of protection Personal Data (within the meaning of Privacy and Data Protection Laws); and (b) to the extent the transfer is not covered by an alternative mechanism of transfer (e.g., binding corporate rules) recognized by the relevant authorities or courts as providing an adequate level of protection for personal data.

33. Application of the EEA Standard Contractual Clauses. For data transfers from the EEA or Switzerland, then the EEA SCCs will apply as follows:

3.13.1 Module 2 (Controller to Processor) will apply where Subscriber is a Controller of Personal Data and Fastly is a Processor of Personal Data;

3.23.2 Module 3 (Processor to Processor) will apply where Subscriber is a Processor of Personal Data and Fastly is a Processor of Personal Data;

3.33.3 For each module, where applicable:

3.3.13.3.1 in Clause 7, the option docking clause will not apply.

3.3.23.3.2 in Clause 9, Option 2 will apply, and the time period for prior notice of a sub-processor will be as set forth in Section 10 of the Terms.

3.3.33.3.3 in Clause 11, the option will apply.

3.3.43.3.4 in Clause 17 (Governing Law) (Option 1), the law of the Netherlands will apply.

3.3.53.3.5 In Clause 18(b), disputes will be resolved before the courts of the Netherlands.

3.43.4 Annex I of the SCCs shall be deemed completed with the information in Appendix 1 of the Terms.

3.53.5 Annex II of the SCCs shall be deemed completed with the information in Appendix 2 of the Terms.

3.63.6 For transfers from Switzerland:

3.6.13.6.1 The supervisory authority with respect to such Personal Data is the Swiss Federal Data Protection and Information Commissioner.

3.6.23.6.2 References to a "Member State" shall be interpreted to refer to Switzerland.

3.6.33.6.3 Data subjects located in Switzerland shall be able to enforce their rights in Switzerland.

3.6.43.6.4 References to the EU GDPR shall be understood to refer to the Swiss Federal Act on Data Protection (as amended or replaced).

3.6.53.6.5 In Clause 17 (Governing Law)(Option 1), the law of Switzerland will apply.

3.6.63.6.6 In Clause 18(b), disputes will be resolved in the courts of Switzerland.

44. Application of the UK Standard Contractual Clauses. For Personal Data transfers from the EEA or Switzerland and the UK, the EEA SCCs will apply as noted in Section 3 above, and the UK Addendum to the EEA SCCs will apply to the Personal Data being transferred from the UK.

55. Application of the UK International Data Transfer Agreement. For Personal Data transfers from the UK that do not also involve Personal Data being transferred from the EEA or Switzerland ("Transferred Data"), then the UK IDTA will apply as follows:

5.15.1 Part one: Tables

5.1.15.1.1 Table 1: Parties and signature: This Table shall be deemed completed with the information in Appendix 1 of this DPA and the signatures to the Terms.

5.1.25.1.2 Table 2: Transfer Details

5.1.2.15.1.2.1 UK country's law that governs the IDTA: England and Wales

5.1.2.25.1.2.2 Place for legal claims to be made: England and Wales

5.1.2.35.1.2.3 The status of the importer: Importer is the Exporter's Processor or Sub-Processor

5.1.2.45.1.2.4 Whether the UK GDPR applies to the Importer: UK GDPR applies to the Importer's Processing of the Transferred Data

5.1.2.55.1.2.5 Linked Agreements: The Agreement, Service Orders, and the Terms as detailed in Exhibit A of these Terms.

5.1.2.65.1.2.6 Term: The Importer may Process the Transferred Data for the following time period: the period for which the Linked Agreement is in force.

5.1.2.75.1.2.7 Ending the ITDA before the end of the term: the Parties cannot end the IDTA before the end of the Term unless there is a breach of the IDTA.

5.1.2.85.1.2.8 Can the Importer make further transfers of the Transferred Data? The Importer MAY transfer on the Transferred Data to another organisation or person (who is a different legal entity) in accordance with IDTA Section 16.1 (Transferring on the Transferred Data).

5.1.2.95.1.2.9 Specific restrictions when the Importer may transfer on the Transferred Data: The Importer MAY ONLY forward the Transferred Data in accordance with IDTA Section 16.1 pursuant to the terms of Section 10 of the Terms.

5.1.2.105.1.2.10 Review Dates: The Parties must review this IDTA at least once each year.

5.1.35.1.3 Table 3: Transferred Data: This Table shall be deemed completed with the information in Appendix 1 of these Terms.

5.1.45.1.4 Table 4: Security Requirements: This Table shall be deemed completed with the information in Appendix 2 of these Terms.

5.25.2 Part two: Extra Protection Clauses: Intentionally omitted

5.35.3 Part three: Commercial Clauses: Intentionally omitted

5.45.4 Part four: Mandatory Clauses: no modifications