·Print this page

·Customer and Partner Agreements An icon of a down chevron

·Privacy An icon of a down chevron

·Mobile Application Terms An icon of a down chevron Twilio Frontline End User App Terms Twilio Authy App Terms

·Supplier Agreements An icon of a down chevron Supplier Purchase Order Terms and Conditions Country-Specific Terms Supplier Data Protection Addendum Supplier Code of Conduct

·Intellectual Property An icon of a down chevron DMCA Policy Trademark

·Resources for Law Enforcement An icon of a down chevron Government Requests Transparency Report

·Civil Requests An icon of a down chevron Submit a request or subpoena

·Code of Conduct & Ethics Hotline An icon of a down chevron Twilio Code of Conduct Ethics and Whistleblower Hotline Discord Community Code of Conduct Twilio Discord FAQ

·Digital Promotions General Rules An icon of a down chevron Sweepstakes Rules

·Customer Research and User Experience An icon of a down chevron Acknowledgement and Waiver

·Contact Twilio Privacy

·Twilio Privacy Notice

·Last Updated: April 09, 2026 (View the prior version of our privacy notice here)

·Introduction & Scope

·Building the Future of Engagement. Twilio powers the world's most important communications by seamlessly unifying data and connectivity. We protect the personal data flowing through our platform by centering our privacy program on Binding Corporate Rules ("BCRs"). These BCRs serve as our global code of conduct, mandating how Twilio Inc. and its group companies ("Twilio", "we", or "our") process personal data wherever we operate.

·Trust Through Transparency. In a digital economy defined by speed and scale, transparency is essential to who we are and how we operate. It is the foundation of the trust we build with the millions of developers and organizations who rely on Twilio. To honor that trust, we explain our privacy practices in a clear, accessible, and easy-to-understand way, and let you know how to exercise your rights in relation to your data.

·Putting Privacy Into Practice. To provide our products and services (collectively, our "Services") and conduct our day-to-day business operations, we collect, store, use, and share personal data, which is any information that identifies you directly (such as your name) or indirectly (such as a phone number or device identifier).

·Depending on which Services are used, we process personal data for:

• ·Customers: Individuals or entities who contract with us to use our Services.
• ·End Users: Individuals who interact with our customers via our Services (e.g., receiving a text or authenticating an identity).
• ·Prospective Customers & Visitors: Individuals who visit our websites, attend our events, or engage with our sales teams.

·Our personal data responsibilities depend on how you use our Services or interact with us:

• ·Twilio As Data Controller: We determine the "how" and the "why" personal data is used in relation to our Services, accounts, websites, and operations. In these cases, we are directly responsible for protecting the data.
• ·Twilio As Data Processor: We process personal data as directed by our customers - whether through specific instructions, our Data Protection Addendum, or their chosen Service configurations. In these cases, we must use and protect personal data in line with those directions.

·This Privacy Notice ("Notice") applies when Twilio acts as a Data Controller.

·What This Notice Doesn't Cover

• ·Supplemental Notices: Specific Services or business operations may have additional privacy terms provided at the time of collection.
• ·Job Applicants: This Notice does not apply to candidates. Please see our Global Applicant Privacy Notice.

·What Personal Data We Process An icon of a plus symbol An icon of a minus symbol

·To deliver our Services, manage our business operations, drive research and development, secure our platform and networks, and prevent fraud, we process personal data from three sources: 1) data you share directly; 2) data we generate or collect automatically; and 3) data from third parties. The categories of personal data we have collected, processed and disclosed for our business purposes in the past 12 months will depend on the nature of your relationship with us or on the Services you or our customers use, and may include the following:

·Table 1: Data You Share Directly

·Table 2: Data We Generate or Collect Automatically

·Table 3: Data From Other Sources

·How and Why We Use Your Data An icon of a plus symbol An icon of a minus symbol

·The specific reasons we process personal data depend on your relationship with us. We only process the personal data necessary to fulfill the purposes listed below, and we do so in accordance with applicable data protection laws..

·In the past 12 months, we have processed personal data for the following business purposes:

·Table 4: Data Use Categories & Legal Basis for Processing

·How We Disclose Personal Data An icon of a plus symbol An icon of a minus symbol

·We only share your data when it is necessary to provide our Services, run our business, or comply with the law, and we do not sell your data to third parties. While we may share certain categories of personal data for these business purposes, no mobile information will be shared with or sold to any third parties for marketing or promotional purposes. Please note that if we share your personal data with a third-party acting on our behalf, Twilio remains liable under the DPF Principles (defined below) if that third-party processes your data in a way that violates those Principles, unless we prove we were not responsible for the violation. In the past 12 months, we may have shared personal data with the following categories of recipients:

·Table 5: Data Recipient Categories Data Recipient Categories

·Aggregated, Anonymized & De-Identified Data

·We may derive aggregated, anonymized, or de-identified data from your personal data. Because this data does not identify you, it is not considered personal data under the law. We may use this data for any purpose. We commit to never attempting to re-identify this information, and we will only share it with third parties who are legally or technically bound to keep it de-identified.

·U.S. Supplemental Disclosure

·If you are a US resident interested in what personal data we have disclosed lately for our business purposes, here's a list: Identifiers Commercial information Financial information

• ·Internet or other electronic activity information Geolocation information Professional or employment information

·By "our business purposes," we mean that we only disclose personal data as described in this section.

·International Transfers An icon of a plus symbol An icon of a minus symbol

·As a global platform, we move data across borders to ensure seamless connectivity, Service provision and business operations. While our primary processing facilities are in the U.S., we use regulator-approved frameworks to ensure personal data receives the same high level of protection everywhere it travels. Whether we are transferring data internally within the Twilio group or externally to trusted third parties, we rely on the following legal safeguards:

• ·Data Privacy Frameworks (or "DPF"): Twilio Inc. and our subsidiary Stytch Inc. comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Twilio Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Twilio Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. Twilio Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
• ·Binding Corporate Rules (or "BCRs"): EU-approved rules covering transfers to Twilio group companies globally.
• ·EU, UK Standard Contractual Clauses (or "SCCs"): Transfer mechanisms used for EU and UK transfers where the DPF or BCR's do not apply.
• ·Brazil Standard Contractual Clauses (or "Brazil SCCs"): Primary mechanism for transfers from Brazil.
• ·Global CBPR and PRP Systems (or "CBPR and PRP"): Twilio's privacy practices (as described in this Notice) comply with the Global Cross Border Privacy Rules and Privacy Recognition for Processors, frameworks for organisations to ensure the protection of data transferred among participating economies. More on these programs can be found here.

·For our customers, all international data transfers are governed by our Data Protection Addendum ("DPA"), which provides detailed information on our contractual safeguards.

·Data Security & Retention An icon of a plus symbol An icon of a minus symbol

·Twilio protects personal data through a risk-based security framework and data lifecycle management processes.

·Security Measures

·To protect against loss, unauthorized use, access, or disclosure, Twilio uses reasonable and appropriate security measures designed to protect personal data both online and offline.

• ·Risk-Based Protections: These measures vary based on the sensitivity of the personal data we collect, process, and store, as well as the current state of technology.
• ·Global Standards: All systems are governed by policies built on industry best practices, including ISO 27001 and NIST standards.

·More information about our security measures can be found in our Security Overview.

·Retention Policy

·We endeavor not to retain personal data in a form which permits identification of individuals for longer than is necessary for the purposes for which that data is processed. We retain personal data in accordance with Twilio's record retention policies and guidelines.

·Customer Account Data is stored as long as needed to provide Services and operate our business. Please note that requests to delete Customer Account Data are subject to the Limitations set forth in the Privacy Rights & Choices section of this Notice.

·Managing Your Data

·We provide the tools you need to store, access, delete, and exercise control over your data. The specific choices available to you depend entirely on which Service you use and how you have configured it. The Twilio Docs repository is a centralized hub that includes product-specific instructions for managing your data, plus step-by-step guides on our retention and deletion practices.

·Privacy Rights & Choices An icon of a plus symbol An icon of a minus symbol

·Depending on the applicable data protection laws, you may have the following rights in relation to the personal data that we process as a data controller:

·Table 6: Privacy Rights & Choices Privacy Rights & Choices

·Additional Rights

·Depending on your jurisdiction, you may exercise specific controls over your data:

• ·Sensitive Data: Restrict the use of sensitive personal data to what is strictly necessary for Service delivery. Twilio currently limits processing to the specific purposes in this Notice or as permitted by law.
• ·EU Rights: If you believe data transfers from Europe to our U.S. headquarters or other non-US companies breach our BCRs, you may lodge a complaint with the transferring Twilio company or its local supervisory authority, or bring a court action against the company.
• ·U.S. CPNI: U.S. account holders can opt-out of the use of Customer Proprietary Network Information (e.g., call quantity, type, and destination) for marketing new services without affecting current services.
• ·Brazil: Brazilian data subjects may exercise Article 18 rights by contacting our Data Protection Officer at privacy@twilio.com.

·Security & Verification

·To protect your account, we must verify your identity before processing certain requests (e.g. deletion).

• ·Verification Process: We typically ask for proof of your recent interactions with us or login verification.
• ·Authorized Agents: If you use an authorized agent to make a request, we may require proof in the form of a power of attorney or written authority to act on your behalf.

·Limitations

·In certain cases, these rights may be limited or an exemption may be applicable, such as where Twilio can demonstrate that it has a legal requirement or legitimate interest to process your data. More information about these rights can be found in our Binding Corporate Rules Controller Policy Rule 10 and Appendix 3. We will not discriminate against you or change the price of our Services if you exercise your rights, but if you ask us to delete your data, it may affect your ability to use our Services.

·Important Note: If Twilio processes your data as a data processor on behalf of a customer, we will direct you to contact our customer to exercise your rights.

·Children's Privacy An icon of a plus symbol An icon of a minus symbol

·Our Services are not directed to or intended to be used by children (under the age of 13 in the U.S. and UK, or 16 in the EEA). If we discover that a child has created an account, we will deactivate it and delete the data as quickly as possible. If you believe we have inadvertently collected data from a child, please contact us at privacy@twilio.com with the subject line "Children".

·Cookies & Tracking Technologies An icon of a plus symbol An icon of a minus symbol

·We use cookies, pixels, web beacons, and similar tools to secure our website, analyze performance, and deliver relevant ads. These tools help us recognize your device to make your experience more secure, efficient and tailored to your interests. Under some U.S. state laws, this is considered "sharing" or "targeted advertising."

·Cookies

·Cookies are small files stored on your device that help us recognize you, making your experience more efficient and personalized. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period). Our cookies fall into three categories:

• ·Required: Essential for the website to function (e.g., secure log-in or remembering where you are at in the order process. You cannot opt-out of required cookies.
• ·Functional: Used to remember your choices (e.g, language or region) and analyze site usage to improve customer experience and site performance. You can opt-out of functional cookies, however some site features may not work properly.
• ·Advertising: Used to show you content and ads that are relevant to your interests. You can opt-out of advertising cookies at any time.

·Web Beacons (Pixels)

·Web beacons (or pixels) are 1x1 transparent images that can be embedded into our marketing emails and allow us to see if you opened an email or clicked a link, which helps us measure the effectiveness of our communications.

·Your Controls: How to Manage Tracking Technologies

·We provide multiple ways for you to manage tracking technologies:

• ·Twilio Cookie Preferences Tool: The easiest way to manage your settings is by clicking the "Cookie Preferences" icon located in the footer of any Twilio website. Any choices concerning cookies are browser and/or device specific. If you clear your cookies from your browser on any of your devices, your choices will need to be reset.
• ·Browser Settings: You can use your browser settings to opt out of Functional Cookies and Advertising Cookies. For more information on how to do that, click here. To manage privacy and storage settings for cookies, click here.
• ·Universal Opt-Outs: Global Privacy Control ("GPC") and Do Not Track ("DNT") are tools that you can use to inform websites of your privacy preferences in regard to ad trackers. To set up GPC, you can visit the Global Privacy Control page. To set DNT, you can visit the All About DNT page. Please note that this may impact the functionality of our websites or your account.
• ·Ad Industry Tools: To learn more about how to opt out of targeting and advertising cookies, you can visit Your Online Choices, the Network Advertising Initiative, and the Digital Advertising Alliance.

·Service Specific Privacy Notices An icon of a plus symbol An icon of a minus symbol

·If you utilize any of the following Services, we are required to provide additional details as to how we use the specified data categories and the purpose. Additional information regarding the products can be found at the links below or in the Twilio Docs. Authy

·The Authy service is our standalone two-factor authentication ("2FA") service for desktop and mobile. The Authy apps generate one time passwords and push notifications to provide an additional layer of security for your Authy-compatible accounts. Authy's 2FA can be used independently or with applications that integrate directly with Authy 2FA API.

·Due to the nature of the Authy service, Twilio collects the following additional personal data elements to our other Services:

• ·Identifiers To create an Authy account, we require a phone number. We send a verification code to that phone number to be sure that the person creating the Authy account has control over the device. This phone number serves as your "primary device and the unique identifier for your Authy account. We use that phone number to identify you, provide 2FA services, and maintain security and anti-fraud logs. We also collect your email address for identity verification and account recovery purposes.
• ·Device Information When you download and open the Authy desktop or mobile app, we automatically collect your device type and unique device identifier. This ensures we deliver the correct version of the app, as well as the appropriate technical support. We also use your device information to ensure proper delivery, maintenance, and security of the Authy app.
• ·Login History and Authy Account History When you use an Authy token to log into an account, whether generated within the app or sent to your phone, we collect information associated with that activity. This includes your IP address, the application you accessed, and the timestamp of the login. We also maintain a log of any changes made to the phone number or email address associated with your account. We collect this information to monitor for suspicious activity and to verify your identity if we suspect your account may be compromised.
• ·Geolocation information If you have location services enabled, we collect your location based on your IP address. We use this information for anti-fraud purposes, to detect suspicious activity, and as an additional data point to verify your identity in the event of a suspected account compromise.

·Frontline Services

·To use the Frontline services, you must log in to the Frontline app using a third party account through your Single Sign-On provider. Authentication is managed by that third party, and we only collect the information you expressly authorize when you link your account with the Frontline app. We only access the information you or our customers provide, and we use it solely for the purposes for which it was shared. Please see the Frontline App Terms for specific details about your relationship with us.

·SendGrid Services

·The SendGrid Services also collect additional data through web beacons placed in the body of emails delivered via our platform. This allows us to track email engagement, including whether a message was delivered, opened, or clicked, bounced, or marked as spam. You can learn more about our use of web beacons in the section titled "Cookies and Tracking Technologies" above.

·Conversational Intelligence

·Conversational Intelligence incorporates artificial intelligence and machine learning to transcribe and analyze voice calls into a structured format that allows our customers to drive their business processes. To translate voice calls into structured content, Twilio processes certain data, including personal data within voice calls, as an independent controller. This includes information provided to us by our customers through their use of the Conversational Intelligence Service.

·How to Contact Us

·If you have questions about this Notice or our privacy practices, please contact our Data Protection Officer ("DPO") using our Privacy Online Form.

·You can also write to us at our global headquarters:

·Worldwide Headquarters

·Twilio Inc. 101 Spear Street, 5th Floor San Francisco CA 94105

·EEA Headquarters Twilio Ireland Limited

·78 Sir John Rogerson's Quay, Dublin 2 D02 R296, Ireland

·Resolving Complaints

·We aim to resolve any questions or concerns in accordance with our Complaints Handling Procedure. If you have a question or wish to lodge a complaint (whether related to our privacy practices or otherwise), please contact the Twilio Privacy Team using our Privacy Online Form or by mail at the physical addresses referenced under "How to Contact Us."

·We encourage you to use these direct channels to ensure a prompt response, however, we will address complaints received through any other means. If we are unable to resolve your concern to your satisfaction, you may pursue further resolution through the following channels:

• ·Data Privacy Frameworks ("DPF"): For practices covered by our DPF certification, contact our U.S.-based third party dispute resolution provider JAMS, (free of charge) at https://www.jamsadr.com/DPF-Dispute-Resolution. Under certain circumstances, you may also invoke binding arbitration. For details, see Annex I of the EU-U.S. Data Privacy Framework Principles.
• ·Global CBPR and PRP Systems: For unresolved concerns related to our CBPR or PRP certifications, contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
• ·Data Protection Authorities: You may have the right to lodge a complaint with a local data protection authority or commence court proceedings under your local laws.
• ·EEA Residents: You have the right to lodge a complaint with the Data Protection Commissioner in Ireland, where our EEA headquarters are located.
• ·UK Residents: If you have a concern about our privacy practices, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). In accordance with the UK Data (Use and Access) Act, you are required to first submit your complaint directly to Twilio to allow us the opportunity to resolve the matter. We will acknowledge your complaint within 30 days and work to provide a substantive response without undue delay. If you remain unsatisfied after receiving our final response, you may then escalate your complaint to the ICO (www.ico.org.uk).

·If your complaint relates to a company using our Services (e.g., you want to stop receiving emails from a specific brand), please contact that company directly. As a data processor, we cannot resolve complaints about our customers' data practices.

·In addition to the above regulatory bodies, Twilio Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

·Changes to Our Privacy Notice

·We periodically review and update this Notice to make clarifications or to reflect legal, technical, or business changes. The latest version will always be posted at twilio.com/legal/privacy with the "Last Updated" date at the top. If we make significant changes that affect your rights, we will provide advance notice via the Twilio console or by email and obtain your consent where legally required.

·Print this page

·Customer and Partner Agreements An icon of a down chevron

·Privacy An icon of a down chevron

·Mobile Application Terms An icon of a down chevron Twilio Frontline End User App Terms Twilio Authy App Terms

·Supplier Agreements An icon of a down chevron Supplier Purchase Order Terms and Conditions Country-Specific Terms Supplier Data Protection Addendum Supplier Code of Conduct

·Intellectual Property An icon of a down chevron DMCA Policy Trademark

·Resources for Law Enforcement An icon of a down chevron Government Requests Transparency Report

·Civil Requests An icon of a down chevron Submit a request or subpoena

·Code of Conduct & Ethics Hotline An icon of a down chevron Twilio Code of Conduct Ethics and Whistleblower Hotline Discord Community Code of Conduct Twilio Discord FAQ

·Digital Promotions General Rules An icon of a down chevron Sweepstakes Rules

·Customer Research and User Experience An icon of a down chevron Acknowledgement and Waiver

·Twilio Data Protection Addendum

·Last Updated: April 9, 2026

·This Data Protection Addendum ("Addendum") forms part of the agreement(s) between Customer and Twilio covering Customer's use of the Services (as defined below) ("Agreement") and governs the use of Customer Data (as defined below), and the related processing of Customer Personal Data (as defined below), by Twilio.

11. Definitions

·"Affiliate" means any entity that directly or indirectly controls or is controlled by, or is under common control with, the party specified. For purposes of this definition, "control" means direct or indirect ownership of more than fifty percent (50%) of the voting interests of the subject entity.

·"Applicable Data Protection Law" means all laws and regulations applicable to Twilio's processing of personal data (as defined below) under the Agreement, including the following, without limitation, and as amended or replaced from time to time:

·(a) Australia: Australian Privacy Act 1988;

·(b) Brazil: Lei Geral de Proteção de Dados (General Personal Data Protection Act);

·(c) Canada: Federal Personal Information Protection and Electronic Documents Act;

·(d) European Economic Area: General Data Protection Regulation EU 2016/679 and the Privacy and Electronic Communications Directive 2002/EC/58;

·(e) Israel: Protection of Privacy Law;

·(f) Japan: Act on the Protection of Personal Information;

·(g) Mexico: Federal Law for the Protection of Personal Data Held by Private Parties and its Regulations;

·(h) Singapore: Personal Data Protection Act 2012;

·(i) Switzerland: Swiss Federal Act on Data Protection, as revised;

·(j) United Kingdom: UK General Data Protection Regulation, Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003; and

·(k) United States of America: All state laws relating to the protection and processing of personal data in effect in the United States of America, which may include, without limitation, 28 CFR Part 202 (Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons), the California Consumer Privacy Act, as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act.

·"controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data or as otherwise defined or interpreted under Applicable Data Protection Law.

·"Customer Account Data" means personal data that relates to Customer's relationship with Twilio, including (a) contact data of Customer (if a natural person), of individuals, or of individuals authorized by Customer to set up and access Customer's account; (b) data relating to billing management and purchase history; (c) personal data Twilio may need to administer Customer's account, provision the Services (as defined below), or verify the identity of End Users (as defined below) for security and verification purposes, such as information collected in connection with the fulfillment of Know-Your-Customer (KYC) requirements, as part of Twilio's obligation to retain Subscriber Records (as defined below), and other applicable statutory requirements as described in this Addendum.

·"Customer Content" means data, including personal data, (a) within any communications content exchanged as a result of using the Services, such as text message bodies, voice, sound, video media, images, email bodies, subject lines, and recipients and, where applicable, within any data (x) Customer submits to the Services from its designated software applications or other products and services or (y) generated for Customer's use as part of the Services and (b) stored on Customer's behalf, such as (i) communications content, transcripts, recordings, or communications logs, within the Services or (ii) marketing campaign data that Customer has uploaded to the Services.

·"Communications Usage Data" means data, including personal data, processed by Twilio to transmit, distribute, or exchange Customer Content through the public switched telephone network or other communications network, as well as to optimize and maintain Service performance, investigate and prevent system abuse, and identify the source of Service requests, including (a) electronic communications metadata such as traffic records and routing details used to identify the source and destination of a communications, such as sender/recipient information, and phone numbers communication logs, and other metadata regarding the type, date, time, duration and status of a communications (e.g., delivered, opened, or bounced) or (b) device data generated in the context of providing the Services or using Twilio's application programming interfaces, such as operating systems, browser details, IP addresses, identifiers, general location data, and activity logs.

·"Customer Data" means any data (a) provided by Customer or Customer's End Users to Twilio in connection with Customer's use of the Services or (b) generated for Customer's use as part of the Services.

·"Customer Personal Data" means personal data, including Sensitive Data, within Customer Data.

·"End User" means any user of the Services, including via any software application or other products and services provided by Customer and used in connection with Customer's use of the Services under the Agreement.

·"personal data" means any data or other information relating to an identified or identifiable natural person ("data subject") or as both terms are otherwise defined or interpreted under Applicable Data Protection Law. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

·"processor" means the entity which processes personal data on behalf of the controller or as otherwise defined or interpreted under Applicable Data Protection Law.

·"processing" (and "process") means any operation or set of operations performed on personal data, or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

·"Security Incident" means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, or as otherwise defined in Applicable Data Protection Law.

·"Sensitive Data" means an individual's (a) social security number, passport number, driver's license number, or similar identifier (or any portion thereof); (b) credit or debit card number (other than the truncated (i.e., last four digits) of a credit or debit card number), financial information, banking account numbers, or passwords; (c) employment, financial, genetic, biometric or health information; (d) racial, ethnic, political, or religious affiliation, trade union membership, or information about sexual life or sexual orientation; (e) account passwords, mother's maiden name, or date of birth; (f) criminal history; or (g) any other information or combinations of information that falls within the definition of "sensitive" or "special categories of data" under Applicable Data Protection Law.

·"Service Abuse" means any abuse or misuse of the Services, including spam, fraud, illegal activities, or violations of Twilio's Acceptable Use Policy, the current version of which is available at https://www.twilio.com/legal/aup.

·"Services" means the products, services, and platforms provided by Twilio or its Affiliates, as applicable, including all updates, modifications, or improvements thereto, that Customer purchases pursuant to an order form or otherwise uses.

·"Subscriber Records" means Customer Account Data containing proof of identification and proof of physical address necessary for Twilio to provide Customer or Customer's End Users with phone numbers in certain countries.

·"sub-processor" means (a) Twilio and its Affiliates, where Twilio or its Affiliate is processing Customer Personal Data and Customer is a processor of such data or (b) any third-party processor engaged by Twilio to process Customer Personal Data as a sub-processor of Twilio in order to provide the Services to Customer. Telecommunications providers used by Twilio to provide the Services are not considered sub-processors.

·"Third-Party Request" means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.

·"Twilio Privacy Notice" means the privacy notice applicable to the Services, the current version of which is available at https://www.twilio.com/legal/privacy.

·Any capitalized term not defined in this Section 1 will have the meaning provided in this Addendum or the Agreement, as applicable. References in this Addendum to Sections or Schedules are to sections or schedules of this Addendum.

22. Role of Twilio and Customer in Relation to Customer Personal Data. Customer and Twilio acknowledge and agree that (a) Twilio is a processor or sub-processor (acting on behalf of Customer), except where Twilio processes Customer Personal Data as a controller as set forth in Section 3 (Processing of Customer Personal Data as a Controller) and (b) Customer may act as a controller or processor on behalf of its End Users of Customer Personal Data. Twilio's processing of Customer Personal Data as a processor or sub-processor is set forth in Section 4 (Processing of Customer Personal Data as a Processor).

33. Processing of Customer Personal Data as a Controller

3.13.1 Twilio as a Controller of Customer Personal Data. Customer and Twilio acknowledge and agree that Twilio acts as an independent controller of Customer Personal Data:

·(a) to the extent necessary for the legitimate business purposes described in Section 3.2 (Twilio as a Controller of Customer Account Data), Section 3.3 (Twilio as a Controller of Communications Usage Data), and Section 3.4 (Twilio as a Controller of Customer Content), provided that such processing is in accordance with the Agreement, the Twilio Privacy Notice, and applicable law or regulation, including Applicable Data Protection Law;

·(b) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the Twilio Privacy Notice; and

·(c) as otherwise authorized or requested by Customer, including as agreed in Service-specific terms or Customer's use and configuration of certain features of the Services.

·Customer and Twilio each have all rights and obligations with respect to Customer Personal Data as independent controllers of Customer Personal Data, not as joint controllers.

3.23.2 Twilio as a Controller of Customer Account Data. Customer and Twilio agree that Twilio is an independent controller of Customer Account Data which it processes:

·(a) to manage billing, Customer's account, and Twilio's relationship with Customer, including Know-Your-Customer (KYC) and identity verification required to access or use the Services;

·(b) to carry out Twilio's core business operations, such as accounting, auditing, and filing taxes;

·(c) to prevent, detect, or investigate security incidents and manage the security of Twilio's platform and services;

·(d) to prevent, detect, or investigate Service Abuse, through the development or improvement of Twilio's internal tools and related model training for such purposes, or to assist telecommunications providers, regulators, or law enforcement agencies with combating spam, fraud, or illegal activities;

·(e) for business analytics, internal reporting, financial reporting, forecasting capacity and revenue planning, and product strategy;

·(f) to develop and improve new products and services and improve the performance, functionality, safety, and security of the Services; and

·(g) to comply with Twilio's legal and regulatory obligations, including, without limitation, to maintain Subscriber Records.

3.33.3 Twilio as a Controller of Communications Usage Data. Customer and Twilio agree that Twilio is an independent controller of Communications Usage Data which it processes in order to:

·(a) carry out the necessary functions as an electronic communications service provider, such as (i) for Twilio's accounting, tax, billing, audit, and compliance purposes; (ii) to provide, optimize, and maintain the Services; and (iii) to prevent, detect, or investigate security incidents and manage the security of Twilio's platform and services;

·(b) prevent, detect, or investigate Service Abuse, including through the development or improvement of Twilio's internal tools and related model training for such purposes, or to assist telecommunications providers, regulators, or law enforcement agencies with combating spam, fraud, or illegal activities;

·(c) comply with Twilio's legal and regulatory obligations, including, without limitation, to maintain Subscriber Records, communications industry codes of conduct, and contractual commitments to telecommunications providers;

·(d) develop and improve new products and services and improve the performance, functionality, safety, and security of the Services; and

·(e) anonymize, de-identify, or aggregate Communications Usage Data such that it does not identify Customer, Customer's End Users, or any data subject.

3.43.4 Twilio as a Controller of Customer Content. Customer and Twilio acknowledge and agree that Twilio is an independent controller of Customer Content, which it processes to the extent necessary:

·(a) to prevent, detect, or investigate security incidents and manage the security of Twilio's platform and services;

·(b) to prevent, detect, or investigate Service Abuse, through the development or improvement of Twilio's internal tools and related model training for such purposes, or to assist telecommunications providers, regulators, or law enforcement agencies with combating spam, fraud, or illegal activities;

·(c) to comply with Twilio's legal and regulatory obligations, including, without limitation, to maintain Subscriber Records, communications industry codes of conduct, and contractual commitments to telecommunications providers;

·(d) to develop and improve new products and services and improve the performance, functionality, safety, and security of the Services;

·(e) for business analytics, internal reporting, financial reporting, forecasting capacity and revenue planning, and product strategy; and

·(f) as otherwise authorized or requested by Customer, including as agreed in Service-specific terms or Customer's use and configuration of certain features of the Services.

3.53.5 Data Minimization and Privacy Preservation Methods. Where reasonably necessary, Twilio will apply appropriate measures to minimize, anonymize, de-identify, pseudonymize, and/or aggregate Customer Personal Data used for the foregoing purposes in Sections 3.1 (Twilio as a Controller of Customer Personal Data) through 3.4 (Twilio as a Controller of Customer Content) such that it does not (a) identify Customer, Customer's End Users, or any data subject and (b) constitute personal data under Applicable Data Protection Law.

3.63.6 Anonymized, De-identified, and Aggregated Data. Customer Personal Data that is anonymized, de-identified, or aggregated by Twilio pursuant to Section 3.5 (Data Minimization and Privacy Preservation Methods) or the Agreement is not subject to this Addendum; provided, however, Twilio will not re-identify, or attempt to re-identify, Customer Personal Data.

44. Processing of Customer Personal Data as a Processor

4.14.1 Twilio as a Processor of Customer Personal Data. Customer and Twilio agree that Twilio will process Customer Personal Data as a processor or sub-processor, rather than as a controller, except as set forth in Section 3 (Processing of Customer Personal Data as a Controller). As a processor or sub-processor, Twilio will process Customer Personal Data in accordance with Customer's instructions as set forth in Section 4.2 (Customer Instructions), any terms that Customer has accepted for certain Services or through Customer's use and configuration of certain features within the Services.

4.24.2 Customer Instructions. Except as otherwise set forth in Section 3 (Processing of Customer Personal Data as a Controller), Customer appoints Twilio as a processor or sub-processor to process Customer Personal Data on behalf of, and in accordance with, Customer's instructions, as set forth in the Agreement, this Addendum (including Schedule 1 (Details of Processing)), and as otherwise necessary to provide the Services to Customer, which includes providing recommendations or demonstrations of other Twilio products, services, or features to Customer.

4.34.3 Lawfulness of Instructions. Customer will ensure that its instructions to process Customer Personal Data comply with Applicable Data Protection Law. If Customer is a processor of Customer Personal Data, Customer will ensure that the appointment of Twilio as a sub-processor, and its instructions, have been authorized by the relevant controller. Customer acknowledges that Twilio is neither responsible for determining which laws or regulations are applicable to Customer's business nor whether Twilio's provision of the Services meets, or will meet, the requirements of such laws or regulations. Customer will ensure that Twilio's processing of Customer Personal Data, where done in accordance with Customer's instructions, will not cause Twilio to violate any applicable law or regulation, including Applicable Data Protection Law. Twilio will inform Customer if it becomes aware, or reasonably believes, that Customer's instructions violate any applicable law or regulation, including Applicable Data Protection Law.

4.44.4 Additional Instructions. Additional instructions for the processing of Customer Personal Data outside the scope of the Agreement and this Addendum will be agreed to in writing between Customer and Twilio, including any additional fees that may be payable by Customer to Twilio to carry out such additional instructions.

55. Confidentiality

5.15.1 Responding to Third-Party Requests. In the event any Third-Party Request is made directly to Twilio in connection with Twilio's processing of Customer Personal Data as a processor or sub-processor, Twilio will promptly inform Customer and provide details of such Third-Party Request, to the extent legally permitted. Twilio will not respond to any Third-Party Request without Customer's prior consent, unless Twilio is legally required to do so or to confirm that such Third-Party Request relates to Customer. Where applicable, Twilio will (a) comply with its law enforcement guidelines, the current version of which is available at https://www.twilio.com/legal/law-enforcement-guidelines, and (b) limit any Customer Personal Data provided as part of a Third-Party Request to the minimum extent necessary and strictly for the required purpose of such Third-Party Request.

5.25.2 Subscriber Records. Where required by applicable law or regulation, Subscriber Records are shared with local telecommunications providers, which provide local connectivity services, or local government authorities. Additional information about these regulatory requirements is available at https://www.twilio.com/guidelines/regulatory.

5.35.3 Confidentiality Obligations of Twilio Personnel. Twilio will ensure that any person it authorizes to process Customer Personal Data has agreed to protect Customer Personal Data in accordance with Twilio's confidentiality obligations in the Agreement.

66. Sub-Processors

6.16.1 Authorization for Sub-Processing. Customer hereby provides a general authorization for Twilio to engage third-party sub-processors for the onward processing of Customer Personal Data that Twilio processes as a processor or sub-processor, subject to the following requirements:

·(a) Twilio will restrict its sub-processors' access to, and processing of, Customer Personal Data only to what is strictly necessary to provide the Services;

·(b) Twilio agrees to impose contractual data protection obligations on its sub-processors, including appropriate technical and organizational measures, designed to protect Customer Personal Data in accordance with the standard required under Applicable Data Protection Law, including, without limitation, the requirements set forth in Schedule 4 (California Specific Terms); and

·(c) Twilio will remain liable for any breach of this Addendum that is caused by an act, error, or omission of its sub-processors.

6.26.2 Current Sub-Processors and Notification of Sub-Processor Changes. Twilio maintains an up-to-date list of its sub-processors available at https://www.twilio.com/legal/sub-processors, which contains a mechanism for Customer to subscribe to notifications of new sub-processors or replacement of existing sub-processors. If Customer subscribes to such notifications, Twilio will provide details of any change in its sub-processors as soon as reasonably practicable. With respect to any change in infrastructure providers of the Services, Twilio will provide written notice to Customer as soon as reasonably practicable but not less than thirty (30) days prior to such change. With respect to any change in Twilio's sub-processors that are not infrastructure providers of the Services, Twilio will provide written notice to Customer as soon as reasonably practicable, but not less than ten (10) days prior to such change.

6.36.3 Objection Right for Sub-Processors. Customer may object to Twilio's appointment of a new sub-processor or replacement of an existing sub-processor during the applicable notice period set forth in Section 6.2 (Current Sub-Processors and Notification of Sub-Processor Changes), provided such objection is in writing and based on reasonable grounds relating to data protection. In such an event, Customer and Twilio agree to discuss commercially reasonable alternative solutions in good faith. If Customer and Twilio cannot reach a resolution within the applicable notice period set forth in Section 6.2 (Current Sub-Processors and Notification of Sub-Processor Changes), Customer may discontinue the use of the affected Services by providing written notice to Twilio. Any discontinued use of the affected Services will be without prejudice to any fees incurred by Customer prior to the discontinued use. If no objection has been raised by Customer prior to the end of the applicable notice period set forth in Section 6.2 (Current Sub-Processors and Notification of Sub-Processor Changes), Twilio will deem Customer to have authorized the new sub-processor or updated sub-processor, as applicable.

77. Data Subject Rights. Twilio provides Customer with a number of self-service features via the Services to delete, obtain a copy of, or restrict use of Customer Personal Data for which Twilio is a processor or sub-processor. Customer may use these self-service features to assist in complying with its obligations under Applicable Data Protection Law with respect to responding to Third-Party Requests from data subjects via the Services at no additional cost. Upon Customer's written request, Twilio will provide reasonable additional and timely assistance to Customer in complying with Customer's data protection obligations with respect to data subject rights under Applicable Data Protection Law to the extent Customer does not have the ability to resolve a Third-Party Request from a data subject through self-service features made available via the Services.

88. Impact Assessments and Consultations. Where Twilio processes Customer Personal Data as a processor or sub-processor, Twilio will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer's expense only if such reasonable cooperation will require Twilio to assign significant resources to that effort) or consultation with any regulatory authority that may be required under Applicable Data Protection Law.

99. Return or Deletion of Customer Personal Data. Where Twilio processes Customer Personal Data as a processor or sub-processor, Twilio will, in accordance with Section 6 (Duration of the Processing) of Schedule 1 (Details of Processing), delete or return to Customer any Customer Personal Data stored within the Services.

9.19.1 Extension of Addendum. Upon termination of the Agreement, Twilio may continue to retain and store Customer Personal Data for the time periods set forth in Schedule 1 (Details of Processing), provided that Twilio ensures that Customer Personal Data is processed only as necessary for the purposes set forth in Schedule 1 (Details of Processing) and remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.

9.29.2 Retention Required by Law. Notwithstanding anything to the contrary in this Section 9, Twilio may retain Customer Personal Data, or any portion of it, if required by applicable law or regulation, including Applicable Data Protection Law, provided such Customer Personal Data remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.

1010. Security

10.110.1 Security Measures. Twilio has implemented, and will maintain, the technical and organizational security measures set forth in the Agreement designed to protect Customer Data, including Customer Personal Data. Additional information about Twilio's technical and organizational security measures is set forth in Schedule 2 (Technical and Organizational Security Measures).

10.210.2 Determination of Security Requirements. Customer acknowledges the Services include certain features and functionalities that Customer may elect to use which impact the security of Customer Data processed as result of Customer's use of the Services, including, without limitation, encryption of voice recordings, availability of multi-factor authentication on Customer's account, or optional Transport Layer Security (TLS) encryption. Customer is responsible for reviewing the information Twilio makes available regarding its data security, including its audit reports, and making an independent determination regarding whether the Services meet Customer's requirements and legal obligations, including its obligations under Applicable Data Protection Law. Customer is further responsible for properly configuring the Services and using features and functionalities made available by Twilio to maintain appropriate security in light of the nature of Customer Data processed as a result of Customer's use of the Services.

10.310.3 Security Incident Notification. Twilio will provide notification of a Security Incident in the following manner:

·(a) Twilio will notify Customer of any Security Incident involving Customer Personal Data that Twilio processes as a processor or sub-processor, without undue delay, after Twilio's discovery of such Security Incident;

·(b) Twilio will, to the extent permitted and required by applicable law or regulation, including Applicable Data Protection Law, notify Customer, without undue delay, of any Security Incident involving Customer Personal Data of which Twilio is a controller; and

·(c) Twilio will notify Customer of any Security Incident via email to the email address(es) designated by Customer in Customer's account.

·Twilio will provide reasonable assistance to Customer in the event that Customer is required under Applicable Data Protection Law to notify a regulatory authority or any data subjects impacted by a Security Incident.

1111. Audits. Customer will have the following audit rights where Twilio is acting as a processor or sub-processor of Customer Personal Data.

11.111.1 Twilio's Audit Program. Twilio uses external auditors to verify the adequacy of its technical and organizational security measures with respect to its processing of Customer Personal Data where Twilio is a processor or sub-processor. Any audits are performed at least once per calendar year at Twilio's expense by independent third-party security professionals selected by Twilio and result in the generation of a confidential audit report ("Audit Report"). Upon Customer's written request at reasonable intervals, and subject to reasonable confidentiality controls, Twilio will make available to Customer a summary copy of Twilio's most recent Audit Report. Additionally, no more than once per calendar year, Twilio will provide written responses, on a confidential basis, to Customer's reasonable request for information made in writing that is necessary to confirm Twilio's compliance with this Addendum related to Twilio's processing of Customer Personal Data as a processor or sub-processor.

11.211.2 Customer Audit. Customer agrees that only where any audit rights required under Applicable Data Protection Law cannot reasonably be satisfied through exercise of the rights set forth in Section 11.1 (Twilio's Audit Program), Customer, or its authorized representatives, may conduct an audit (each, a "Customer Audit"), during the term of the Agreement, to assess Twilio's compliance with the terms of this Addendum. To the extent Customer and Twilio determine that the exercise of the rights set forth in Section 11.1 (Twilio's Audit Program) does not satisfy the audit rights required under Applicable Data Protection Law, Customer will agree to a mutually agreed-upon audit plan with Twilio that includes the following:

·(a) requires the use of an independent third-party auditor;

·(b) requires Customer to provide reasonable prior written notice to Twilio regarding exercising its right under this Section 11.2 for a Customer Audit;

·(c) limits Customer's access to Twilio-managed facilities and Twilio personnel only during regular business hours;

·(d) requires Customer to pay Twilio's then-current rates to assist with a Customer Audit;

·(e) limits the occurrence of a Customer Audit to no more than once per calendar year;

·(f) restricts Customer Audit findings to only Customer Personal Data that is relevant to Customer, where Twilio is a processor or sub-processor; and

·(g) obligates Customer, to the extent permitted by law or regulation, to keep confidential any information gathered from a Customer Audit that, by its nature, should be confidential.

1212. International Provisions

12.112.1 California Specific Terms. To the extent Twilio processes personal information, as defined by the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et. seq., as amended by the California Privacy Rights Act and its implementing regulation (collectively, "CCPA"), the terms set forth in Schedule 4 (California Specific Terms) will apply.

12.212.2 Cross Border Data Transfer Mechanisms. To the extent Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction (e.g., the European Economic Area, the United Kingdom, Switzerland, Guernsey, and Jersey) to Twilio's operations located outside of that jurisdiction ("Transfer Mechanisms"), the terms set forth in Schedule 3 (Cross Border Data Transfer Mechanisms) will apply.

1313. Miscellaneous

13.113.1 Compliance. Customer is responsible for ensuring that (a) it has complied, and will continue to comply, with Applicable Data Protection Law in its use of the Services and its own processing of personal data, and (b) it has, and will continue to have, the right to transfer, or provide access to, personal data to Twilio for processing in accordance with the terms of the Agreement and this Addendum.

13.213.2 Conflict. In the event of any conflict or inconsistency among the following documents, the order of precedence will be as follows: (1) the Transfer Mechanisms; (2) the applicable terms set forth in Schedule 4 (California Specific Terms); (3) the terms of this Addendum outside of Schedule 4 (California Specific Terms); (4) the Agreement; and (5) the Twilio Privacy Notice. Any claims brought in connection with this Addendum will be subject to the terms, including, without limitation, the exclusions and limitations, set forth in the Agreement.

13.313.3 Entire Agreement. This Addendum supersedes data protection terms or terms relating to the processing of personal data previously agreed to between Customer and Twilio.

13.413.4 Updates. Twilio may update the terms of this Addendum from time to time upon at least thirty (30) days prior written notice to Customer. The then-current terms of this Addendum are available at https://www.twilio.com/legal/data-protection-addendum.

Schedule 1Schedule 1

·Details of Processing

·Where applicable, this Schedule 1 will serve as Annex 1 to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and the Brazil Standard Contractual Clauses (each of which is defined in Schedule 3 (Cross Border Data Transfer Mechanisms)).

11. Categories of Data Subjects. Customer's End Users and end-consumers of Customer.

22. Categories of Customer Personal Data. Customer Account Data, Communications Usage Data, and Customer Content.

33. Sensitive Data or Special Categories of Data. Customer Content may constitute Sensitive Data under Applicable Data Protection Law and, Customer Content may, from time to time, include Sensitive Data to be processed via the Services where Customer or Customer's End Users choose to include Sensitive Data within Customer Content. Customer is responsible for ensuring that suitable safeguards are in place prior to transmitting or processing, or prior to permitting Customer's End Users to transmit or process, any Sensitive Data via the Services.

44. The Frequency of the Transfer: Continuous

55. Nature and Purpose of the Processing. Customer Personal Data will be subject to the following basic processing activities:

·Twilio, as a processor or sub-processor, will process Customer Personal Data in accordance with Customer's instructions as set forth in Section 4.2 (Customer Instructions). As a controller, Twilio will process Customer Personal Data as necessary to carry out its legitimate business purposes set forth in Section 3 (Processing of Customer Personal Data as a Controller).

66. Duration of the Processing. The period for which personal data will be retained by Twilio and the criteria used to determine that period is as follows:

·Where Twilio is acting as a processor or sub-processor, Customer Personal Data will be retained as long as necessary to fulfill the purposes for which such personal data was collected and/or received by Twilio, as set forth in Section 6.1 and Section 6.2 of this Schedule 1, and as otherwise set forth in the data retention and deletion documentation for the Services available at at https://help.twilio.com/articles/4410585868443 and https://segment.com/docs/privacy/account-deletion.

6.16.1 Services. Prior to the termination of the Agreement, (a) Twilio will process stored Customer Content for the purposes set forth in Section 4.2 (Customer Instructions) until Customer elects to delete such Customer Content via the Services and (b) Customer agrees that it is solely responsible for deleting Customer Content via the Services. Except as set forth in Section 6.2 (SendGrid Services) of this Schedule 1, upon termination of the Agreement, Twilio will (i) provide Customer with thirty (30) days after the termination effective date to obtain a copy of any stored Customer Content via the Services; (ii) automatically delete any stored Customer Content thirty (30) days after the termination effective date; and (iii) automatically delete any stored Customer Content on Twilio's back-up systems sixty (60) days after the termination effective date. Any Customer Content archived on Twilio's back-up systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation, including Applicable Data Protection Law.

6.26.2 SendGrid Services. Upon termination of the Agreement, Twilio will (a) at Customer's election, delete or return to Customer any Customer Content (including copies) stored within any services and application programming interfaces branded as "SendGrid" or "Twilio SendGrid" (collectively, "SendGrid Services") and (b) automatically delete any stored Customer Content in the SendGrid Services on Twilio's back-up systems one (1) year after the termination effective date.

·Where Twilio is acting as a controller, Customer Personal Data will be retained for as long as necessary to fulfill the purposes for which such personal data was collected and/or received by Twilio and in accordance with Twilio's data retention policies.

Schedule 2Schedule 2

·Technical and Organizational Security Measures

·The full text of Twilio's technical and organizational security measures to protect Customer Data, including Customer Personal Data, is available at https://www.twilio.com/legal/security-overview ("Security Overview"). Twilio's Binding Corporate Rules Processor Policy is available at https://www.twilio.com/en-us/legal/bcr/processor.

·Where applicable, this Schedule 2 will serve as Annex II to the EU Standard Contractual Clauses, Table 3 of the UK International Data Transfer Agreement and the security measures required under the Brazilian Standard Contractual Clauses.

·In the event of a conflict or inconsistency between the Security Overview and any security-related terms set forth in the Agreement, the security-related terms set forth in the Agreement will prevail.

·The following table provides more information about Twilio's technical and organizational security measures.

Schedule 3Schedule 3

·Cross Border Data Transfer Mechanisms

11. Definitions

• ·"BCR Services" means all Services, except the SendGrid Services and Private Beta Offerings (as defined below).
• ·"Brazil Standard Contractual Clauses" means the Standard Contractual Clause contained in Annex II of Resolution CD/ANPD No. 19/2024, of August 23, 2024.
• ·"Data Privacy Framework" means the EU-US and/or Swiss-US Data Privacy Framework self-certification program operated by the U.S. Department of Commerce.
• ·"Data Privacy Principles" means the Data Privacy Framework principles (as supplemented by the Supplemental Principles).
• ·"EEA" means the European Economic Area.
• ·"EU Standard Contractual Clauses" mean the Standard Contractual Clauses approved by the European Commission in decision 2021/914.
• ·"Private Beta Offerings" means certain Services that are identified as alpha, beta, not generally available, limited release, developer preview, or any similar Services that are, in all the foregoing cases, only made available to a limited number of customers on an invitation basis in a non-public or private matter.
• ·"Twilio BCRs" means Twilio's Binding Corporate Rules as set forth at https://www.twilio.com/legal/binding-corporate-rules.
• ·"Twilio Global CBPR and Global PRP Certifications" means Twilio's certification under the Global Cross-Border Privacy Rules System ("Global CBPRs") and Global Privacy Recognition for Processors System ("Global PRPs"), as recorded in the directory available at https://www.globalcbpr.org.
• ·"UK International Data Transfer Agreement" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022.

22. Cross Border Data Transfer Mechanisms

2.12.1 Order of Precedence. In the event the Services are covered by more than one transfer mechanism, the transfer of personal data will be subject to a single transfer mechanism. These transfer mechanisms will apply in following order of precedence, as set forth in this Schedule 3: (a) the Data Privacy Framework (Section 2.2 ); (b) Twilio BCRs (Section 2.3 ); (c) the EU Standard Contractual Clauses (Section 2.4 ); (d) the UK International Data Transfer Agreement (Section 2.5); (e) the Brazil Standard Contractual Clauses (Section 2.7); (f) the Twilio Global CBPR or Global PRP Certifications (Section 2.8); or (g) if none of the foregoing apply, any other data transfer mechanism permitted under Applicable Data Protection Law.

2.22.2 Data Privacy Framework. To the extent Twilio Inc. processes any personal data via the Services originating from the EEA, Switzerland, or the United Kingdom, Twilio represents that Twilio Inc. is self-certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, and complies with the Data Privacy Principles where processing any such personal data. To the extent that Customer is (a) located in the United States of America and is self-certified under the Data Privacy Framework or (b) located in the EEA, Switzerland, and the United Kingdom, Twilio further agrees (i) to provide at least the same level of protection to any personal data as required by the Data Privacy Principles; (ii) to notify Customer in writing, without undue delay, if its self-certification to the Data Privacy Framework is withdrawn, terminated, revoked, or otherwise invalidated (in which case, an alternative Transfer Mechanism will apply in accordance with the order of precedence in Section 2.1 (Order of Precedence) of this Schedule 3); and (iii) upon written notice, to work with Customer to take reasonable and appropriate steps to stop and remediate any unauthorized processing of personal data.

2.32.3 Twilio BCRs. Twilio will process personal data within the BCR Services in accordance with the Twilio BCRs. Customer and Twilio agree that, with respect to the BCR Services, the Twilio BCRs will be the lawful transfer mechanism of Customer Personal Data from the EEA or Switzerland to (a) Twilio in the United States of America or (b) any other non-EEA Twilio entity. For avoidance of doubt, the Twilio BCRs do not serve as a transfer mechanism for the SendGrid Services or Private Beta Offerings.

2.42.4 EU Standard Contractual Clauses. The EU Standard Contractual Clauses will apply to personal data that is transferred via the Services from the EEA, Switzerland, Guernsey, or Jersey, either directly or via onward transfer, to any country or recipient outside the EEA, Switzerland, Guernsey, or Jersey that is not (a) recognized by the relevant competent authority as providing an adequate level of protection for personal data and (b) covered by the Twilio BCRs. For data transfers that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into, and incorporated into this Addendum by this reference, and completed as follows:

·(a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where (i) Twilio is processing Customer Account Data and Communications Usage Data and (ii) Customer is a controller of Customer Personal Data, and Twilio is processing Customer Personal Data pursuant to Section 3 (Processing of Customer Personal Data as a Controller);

·(b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a controller of Customer Personal Data, and Twilio is processing Customer Personal Data pursuant to Section 4 (Processing of Customer Personal Data as a Processor); and

·(c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a processor of Customer Personal Data, and Twilio is processing Customer Personal Data pursuant to Section 4 (Processing of Customer Personal Data as a Processor);

·(d) For each Module, where applicable:

·(i) in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply;

·(ii) in Clause 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of sub-processor changes will be as set forth in Section 6.2 (Current Sub-Processors and Notification of Sub-Processor Changes);

·(iii) in Clause 11 of the EU Standard Contractual Clauses, the optional language will not apply;

·(iv) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by Irish law;

·(v) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;

·(vi) in Annex I, Part A of the EU Standard Contractual Clauses: Data Exporter: Customer

·Contact details: The email address(es) designated by Customer in Customer's account via its notification preferences.

·Data Exporter Role: The Data Exporter's role is set forth in Section 3 (Processing of Customer Personal Data as a Controller) and Section 4 (Processing of Customer Personal Data as a Processor), as applicable.

·Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these EU Standard Contractual Clauses incorporated herein, including their Annexes, as of the effective date of the Agreement.

·Data Importer: Twilio Inc.

·Contact details: Twilio Privacy - privacy@twilio.com

·Data Importer Role: The Data Importer's role is set forth in Section 3 (Processing of Customer Personal Data as a Controller) and Section 4 (Processing of Customer Personal Data as a Processor), as applicable.

·Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these EU Standard Contractual Clauses, incorporated herein, including their Annexes, as of the effective date of the Agreement;

·(vii) in Annex I, Part B of the EU Standard Contractual Clauses:

·The categories of data subjects are set forth in Section 1 (Categories of Data Subjects) of Schedule 1 (Details of Processing).

·The Sensitive Data transferred is set forth in Section 3 (Sensitive Data or Special Categories of Data) of Schedule 1 (Details of Processing).

·The frequency of the transfer is a continuous basis for the duration of the Agreement.

·The nature and purpose of the processing is set forth in Section 5 (Nature and Purpose of the Processing) of Schedule 1 (Details of Processing).

·The period for which the personal data will be retained is set forth in Section 6 (Duration of the Processing) of Schedule 1 (Details of Processing).

·For transfers to sub-processors, the subject matter, nature, and duration of the processing is set forth at https://www.twilio.com/legal/sub-processors;

·(viii) in Annex I, Part C of the EU Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority; and

·(ix) Schedule 2 (Technical and Organizational Security Measures) serves as Annex II of the EU Standard Contractual Clauses.

2.52.5 UK International Data Transfer Agreement. Customer and Twilio agree that the UK International Data Transfer Agreement will apply to personal data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to any country or recipient outside of the United Kingdom that is not (a) recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal data and (b) covered by the Twilio BCRs. For data transfers from the United Kingdom that are subject to the UK International Data Transfer Agreement, the UK International Data Transfer Agreement will be deemed entered into, and incorporated into this Addendum by this reference, and completed as follows:

·(a) In Table 1 of the UK International Data Transfer Agreement, Customer's and Twilio's details and key contact information are set forth in Section 2.4(d)(vi) of this Schedule 3;

·(b) In Table 2 of the UK International Data Transfer Agreement, information about the version of the Approved EU SCCs, modules, and selected clauses, which the UK International Data Transfer Agreement is appended to, are set forth in Section 2.4 (EU Standard Contractual Clauses) of this Schedule 3;

·(c) In Table 3 of the UK International Data Transfer Agreement:

·(i) The list of Parties is set forth in Section 2.4(d)(vi) of this Schedule 3.

·(ii) The description of the transfer is set forth in Section 5 (Nature and Purpose of the Processing) of Schedule 1 (Details of the Processing).

·(iii) Annex II is located in Schedule 2 (Technical and Organizational Security Measures).

·(iv) The list of sub-processors is available at https://www.twilio.com/legal/sub-processors; and

·(d) In Table 4 of the UK International Data Transfer Agreement, both the Importer and the Exporter may end the UK International Data Transfer Agreement in accordance with the terms of the UK International Data Transfer Agreement.

2.62.6 Application of EU Standard Contractual Clauses. The EU Standard Contractual Clauses apply to all Customer Personal Data that is transferred from or accessed remotely from outside any country whose data protection laws or regulations require an adequacy means for the international transfer or access. The required adequacy means can be met by entering into the EU Standard Contractual Clauses, either directly or via onward transfer to any country or recipient, in each case, where such transfer or access would be prohibited under Applicable Data Protection Law in the absence of the EU Standard Contractual Clauses. The EU Standard Contractual Clauses must be slightly modified (e.g., in terms of terminology) to ensure that this entire Addendum applies to all parties, regardless of the location of the parties, whether within or outside the EEA, Switzerland, Guernsey, or Jersey. Such modifications, however, do not apply for data transfers governed by EEA, Switzerland, Guernsey, or Jersey data protection laws or regulations.

2.72.7 Application of Brazil Standard Contractual Clauses. The Brazil Standard Contractual Clauses will apply to personal data that is transferred via the Services from Brazil, either directly or via onward transfer, to any third country or territory, or any recipient located in a third country or territory, (a) subject to an adequacy determination by the Brazilian Data Protection Authority ("ANPD") or (b) as otherwise covered by a transfer mechanism recognized or approved by the ANPD as providing appropriate safeguards for personal data in accordance with Article 33 of the Lei Geral de Proteção de Dados (General Personal Data Protection Act). For data transfers that are subject to the Brazil Standard Contractual Clauses, the Brazil Standard Contractual Clauses will be deemed entered into, and incorporated into this Addendum by this reference, and completed as follows:

·(i) Clause 2 of the Brazil Standard Contractual Clauses is satisfied by the information set forth in Section 2.4(d)(vi) of this Schedule 3, which describes the data transfer;

·(ii) In Clause 3 of the Brazil Standard Contractual Clauses, OPTION B will apply, with onward transfers permitted in accordance with Section 6 (Sub-Processors) of this Addendum. The subject matter, nature, and duration of processing are set forth at https://www.twilio.com/legal/sub-processors;

·(iii) Clause 4 of the Brazil Standard Contractual Clauses is satisfied by the information set forth in Section 2.4(d)(vi) of this Schedule 3. Where Twilio is a controller, it will be the "Designated Party", as defined in the Brazil Standard Contractual Clauses, and for the purposes of Clause 14 (Transparency), Clause 15 (Data Subject Rights), and Clause 16 (Incident Reporting) of the Brazil Standard Contractual Clauses. Customer remains responsible for compliance with Clause 14 (Transparency), Clause 15 (Data Subject Rights), and Clause 16 Incident Reporting) of the Brazil Standard Contractual Clauses for any personal data of which it may otherwise be controller;

·(iv) In Clause 9 of the Brazil Standard Contractual Clauses, the optional docking clause will not apply; and

·(v) Section III (Security Measures) of the Brazil Standard Contractual Clauses will be deemed completed with the information set forth in Schedule 2 (Technical and Organizational Security Measures).

2.82.8 Application of Global Cross Border Privacy Rules. Twilio's privacy program has been certified under the Global CBPRs and Global PRPs, which are government-backed data privacy certifications that demonstrate compliance with internationally-recognized data privacy protections. Twilio will process personal data transferred from a participating Global CPBR economy to Twilio in accordance with the Twilio Global CBPR and Global PRP Certifications, to the extent applicable.

2.92.9 Conflict. In the event of any conflict or inconsistency among (a) the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the Brazil Standard Contractual Clauses, as applicable; (b) any other terms in this Addendum, including Schedule 4 (California Specific Terms); (c) the Agreement; or (d) the Twilio Privacy Notice, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, as applicable, will prevail.

Schedule 4Schedule 4

·California Specific Terms

11. Twilio is an independent "business" where processing Customer Personal Data subject to the CCPA as a controller pursuant to Section 3 (Processing of Customer Personal Data as a Controller).

22. The following terms apply where Twilio is processing Customer Personal Data subject to the CCPA as a processor pursuant to Section 4 (Processing of Customer Personal Data as a Processor) and acting as a "service provider":

·(a) The term "personal information", as used in this Schedule 4, will have the meaning provided in the CCPA;

·(b) Twilio will process any personal information within Customer Personal Data only for the business purposes set forth in the Agreement, including the purpose of processing and processing activities set forth in this Addendum ("Purpose"). Where acting as a service provider, Twilio will not sell or share personal information within Customer Personal Data or retain, use, or disclose such data (i) for any purpose other than the Purpose, including retaining, using, or disclosing the data for a commercial purpose other than the Purpose, or as otherwise permitted under the CCPA or (ii) outside of the direct business relationship between Customer and Twilio;

·(c) Twilio will (i) comply with obligations applicable to it where it acts as a service provider under the CCPA and (ii) provide personal information with the same level of privacy protection as is required under the CCPA. Customer is responsible for ensuring that it has complied, and will continue to comply, with the requirements of the CCPA in its use of the Services and its own processing of personal information;

·(d) Customer will have the right to take reasonable and appropriate steps to help ensure that Twilio uses personal information in a manner consistent with Customer's obligations under the CCPA;

·(e) Twilio will notify Customer if it makes a determination that it can no longer meet its obligations as a service provider under the CCPA;

·(f) Upon notice, Customer will have the right to take reasonable and appropriate steps in accordance with the Agreement to stop and remediate unauthorized use of personal information;

·(g) Twilio will provide reasonable additional and timely assistance to assist Customer in complying with its obligations with respect to consumer requests as set forth in the Agreement;

·(h) For any sub-processor used by Twilio to process personal information subject to the CCPA, Twilio will ensure that Twilio's agreement with such sub-processor complies with the CCPA, including, without limitation, the contractual requirements for service providers and contractors;

·(i) Twilio will not combine Customer Personal Data that it receives from, or on behalf of, Customer, with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, unless such combination is required to perform any business purpose as permitted under the CCPA, including any regulations thereto, or by regulations adopted by the California Privacy Protection Agency; and

·(j) Twilio certifies that it understands and will comply with its obligations under the CCPA.

33. Twilio acknowledges and confirms that it does not receive personal information within Customer Personal Data as consideration for any Services provided to Customer.