·Beta Program - Terms of Use

·Updated on August 18, 2023

·PLEASE READ THESE BETA PROGRAM TERMS OF USE (THIS "AGREEMENT") CAREFULLY. THIS AGREEMENT IS BETWEEN YOU AND ZOOM COMMUNICATIONS, INC., AND ITS AFFILIATES ("ZOOM") AND GOVERNS YOUR PARTICIPATION IN THE BETA PROGRAM ("BETA PROGRAM") AND YOUR ACCESS TO, EVALUATION, AND USE OF THE BETA PRODUCTS AND SERVICES MADE AVAILABLE TO YOU BY ZOOM AS PART OF THE BETA PROGRAM. BY ACCEPTING THESE TERMS AND CONDITIONS OR ACCESSING OR USING ANY BETA PRODUCTS OR SERVICES, YOU AGREE TO PARTICIPATE IN THE BETA PROGRAM AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS AGREEMENT.

·YOU MAY ENTER INTO THIS AGREEMENT ON BEHALF OF YOURSELF OR ON BEHALF OF A LEGAL ENTITY. IF YOU ENTER INTO THIS AGREEMENT ON BEHALF OF A LEGAL ENTITY, YOU REPRESENT THAT YOU ARE A DULY AUTHORIZED REPRESENTATIVE WITH THE AUTHORITY TO BIND THAT LEGAL ENTITY TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. ALL REFERENCES TO "YOU" AND "YOUR" IN THIS AGREEMENT MEAN THE PERSON ACCEPTING THESE TERMS AS AN INDIVIDUAL OR THE LEGAL ENTITY FOR WHICH THE REPRESENTATIVE IS ACTING, AS THE CASE MAY BE.

·PLEASE BE ADVISED: THIS AGREEMENT INCLUDES AN EXCLUSION OF CERTAIN TYPES OF DAMAGES AND AN AGGREGATE LIMITATION ON LIABILITY THAT OPERATES AS A RELEASE AND WAIVER OF YOUR ABILITY TO RECOVER CERTAIN DAMAGES FROM ZOOM. THIS AGREEMENT ALSO INCLUDES A BINDING ARBITRATION CLAUSE AND CLASS ACTION WAIVER IN SECTION 18 (AGREEMENT TO ARBITRATE CLAIMS AND CLASS ACTION WAIVER) BELOW.

• 1Beta Offering Support The beta offering includes any hardware, software, product, service, feature, functionality, or other technology that is either integrated with another offering or provided on a stand-alone basis by Zoom and has been designated by Zoom as part of its Beta Program (each, a "Beta Offering"). Each Beta Offering may be more fully described in documentation provided to You by Zoom at the time You are given access to the Beta Offering. Zoom does not offer any service level agreement for a Beta Offering and Zoom is not obligated to provide any maintenance or technical support. Zoom reserves the right to modify, abandon, or impose any limitations on the use of any Beta Offering at any time, with or without notice, and without any obligation or liability.
• 2Eligibility; Participation Subject to Zoom's prior approval, You may participate in the Beta Program upon request or by Zoom's invitation. You must always meet the Zoom-determined eligibility criteria during the Term (as defined in Section 5 (Term and Termination of Agreement; Effect of Termination). Eligibility criteria includes, without limitation, that You are a customer in good standing with Zoom and have purchased any underlying Zoom services that are required to use the Beta Offering. If You cease to meet Zoom's eligibility criteria, then Zoom may immediately terminate Your participation in the Beta Program, Your access to any Beta Offering, or both. You shall provide any information required by Zoom and, if required, create an account to use the Beta Offering. You shall follow all instructions from Zoom in order to access, use, and create an account for the Beta Offering. You shall provide and maintain current, complete, and accurate information as requested by Zoom. You shall maintain the confidentiality and security of any password that is created or maintained as part of using a Beta Offering. You shall notify Zoom immediately of any unauthorized use of any password or account or of any suspected breach of the account's security.
• 3Right to Use; License Grant Zoom grants You a right to access and use, during the Term, each Beta Offering provided by Zoom to You. To the extent that access to or use of a Beta Offering requires or allows for You to download, use, or install software, Zoom grants You a nonexclusive, nontransferable, nonassignable, nonsublicensable, royalty-free license to the software for Your internal use solely to access and use the Beta Offering during the Term. You acknowledge that Your rights under this Section 3 (Right to Use; License Grant) are revocable in Zoom's sole discretion.
• 4Changes to Beta Offering; Suspension, Discontinuance, and Termination of Access and Use You acknowledge and agree that the form and nature of the Beta Offering, Beta Program, or both, may change from time to time without prior notice to You. Notwithstanding any provision set forth in this Agreement, Zoom may terminate, limit, disconnect, deny access to, discontinue, abandon, modify, or suspend Your or any of Your end users' use of a Beta Offering, participation in the Beta Program, or both, at any time, in Zoom's sole discretion, with or without notice and without any obligation or liability to You, Your end users, or any third party. You acknowledge that Your or Your end user's breach of Section 6 (Acceptable Use; Prohibited Uses), including a violation of Zoom's Acceptable Use Guidelines, may result in immediate suspension, disconnection, or termination of access to the Beta Offering.
• 5Term and Termination of Agreement; Effect of Termination The term ("Term") of this Agreement commences as of the date of You first access or use a Beta Offering and continues until terminated by a party as set forth below. Zoom may terminate this Agreement at any time, with or without cause, upon delivery of written notice to You. For the sake of clarity and not limitation, Zoom may terminate this Agreement with cause immediately in the event of a violation of Section 6 (Acceptable Use; Prohibited Uses) or any other material term of this Agreement by You or any of Your end users. You may terminate this Agreement at any time, with or without cause, by delivering at least thirty (30) days prior written notice to Zoom. Upon any termination of this Agreement, all rights granted herein to use and access the Beta Offerings terminate and You and Your end users shall immediately: (i) cease use of all Beta Offerings and (ii) return or destroy all of Zoom's Confidential Information (as defined in Section 9 (Confidential Information)) and, if requested in writing by Zoom, provide Zoom with written certification of the same.
• 6Acceptable Use; Prohibited Uses
• 6.1You agree that use of the Beta Offerings by You and Your end users is subject to Zoom's applicable guides, statements, notices, and policies located at zoom.us/legal including, without limitation, the Acceptable Use Guidelines, Privacy Statement, 911 U.S. Notice, 911 Canada Notice, EU Emergency Calling Notice, and Government Requests Guide, each of which may be updated or modified from time to time. You agree that You shall not, and shall not permit any of Your end users to: (i) make, use, or offer a Beta Offering for lease, rent, or sale, or reproduce, resell, distribute, lend, use on a timeshare or service bureau basis, or otherwise charge fees to other parties for use of the Beta Offering; (ii) modify, customize, disassemble, decompile, prepare derivative works of, create improvements, derive innovations from, reverse engineer, or attempt to gain access to any underlying technology of the Beta Offerings (e.g., any source code, process, data set or database, management tool, development tool, server or hosting site, etc.); (iii) knowingly or negligently use the Beta Offerings in a way that abuses, interferes with, or disrupts Zoom's networks; (iv) engage in activity that is illegal, fraudulent, false, or misleading; or (v) use the Beta Offerings in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law.
• 6.2You agree not to use the Beta Offerings for highly sensitive or confidential communications, unless Zoom (i) provides its express prior written agreement to the contrary or (ii) makes the Beta Offering directly available to You in a production environment for use with production data. Unless (i) or (ii) in the foregoing sentence applies, You shall not use any Beta Offerings for the receipt, use, maintenance, disclosure, storage, transmission, or processing of any regulated data, including, without limitation, electronic protected health information (as defined under the rules and regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996), personal data, personal information, personally identifiable information, financial data, education records, or similar sensitive information.
• 7As-Is; Disclaimer of Warranties ZOOM AND ITS LICENSORS EXPRESSLY DISCLAIM ANY AND ALL REPRESENTATIONS AND WARRANTIES, EITHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, WITH RESPECT TO ANY BETA OFFERING, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, OR THE CONTINUOUS, UNINTERRUPTED, ERROR-FREE, VIRUS-FREE, OR SECURE ACCESS TO OR OPERATION OF A BETA OFFERING. TO THE EXTENT ZOOM CANNOT DISCLAIM ANY SUCH WARRANTY AS A MATTER OF APPLICABLE LAW, THE SCOPE AND DURATION OF SUCH WARRANTY SHALL BE LIMITED TO THE FULLEST EXTENT PERMITTED BY LAW. YOU ACKNOWLEDGE THAT THE BETA OFFERING IS BEING PROVIDED AND MADE AVAILABLE ON AN "AS IS" OR "AS AVAILABLE" BASIS WITHOUT ANY WARRANTY OF ANY KIND. YOU AGREE THAT THE BETA OFFERING: (A) IS NOT COMPLETE IN DEVELOPMENT AND HAS NOT BEEN COMMERCIALLY RELEASED FOR SALE BY ZOOM; (B) MAY NOT BE FULLY FUNCTIONAL AND MAY CONTAIN BUGS, ERRORS, DESIGN FLAWS, OR OTHER PROBLEMS, INCLUDING PROBLEMS THAT MAY ADVERSELY IMPACT THE OPERATION OF YOUR INFRASTRUCTURE OR SERVICES PROVIDED BY ZOOM OR ANOTHER PARTY; (C) MAY NOT BE RELIABLE; (D) MAY NOT HAVE BEEN EVALUATED FOR REGULATORY COMPLIANCE AND MAY NOT MEET REQUIREMENTS FOR TRANSMITTING, STORING, CREATING, OR OTHERWISE PROCESSING ELECTRONIC PROTECTED HEALTH INFORMATION, PERSONALLY IDENTIFIABLE INFORMATION, PERSONAL INFORMATION, OR OTHER SENSITIVE OR CONFIDENTIAL INFORMATION; (E) WHEN USED, MAY RESULT IN UNEXPECTED RESULTS, LOSS OF CONTENT OR DATA, OR OTHER UNPREDICTABLE DAMAGE OR LOSS TO YOU. ZOOM EXPRESSLY DISCLAIMS ANY WARRANTY AS TO THE ACCURACY OR COMPLETENESS OF ANY INFORMATION, CONTENT, OR DATA ACCESSED OR USED IN CONNECTION WITH A BETA OFFERING.
• 8Compliance with Laws; Consents You are solely responsible for compliance with all laws that apply to Your participation in the Beta Program and the use, access, and receipt of a Beta Offering, including, but not limited to, laws requiring You to provide proper end user notifications and to obtain proper end user consents, which may be necessary to allow Zoom and third parties authorized by You or Zoom to access, process and use Content (as defined in Section 12 (Content)). You shall comply with all applicable local, state, national and foreign laws, rules, and regulations, including, but not limited to, all applicable import and export, anti-bribery, foreign corrupt practices, intellectual property, and privacy laws and regulations, in connection with Your performance of Your obligations under this Agreement, including access to and use of the Beta Offerings. You are solely responsible for Your end users' access to and use of the Beta Offerings in compliance with this Agreement and all applicable law.
• 9Confidential Information You and Zoom agree to keep confidential all non-public, proprietary, or confidential information that You and Zoom provide to each other in connection with the performance of this Agreement, the Beta Program, or any Beta Offering. You and Zoom further agree to disclose Confidential Information (as defined in this Section 9 (Confidential Information)) that You or Zoom receive under this Agreement only to those employees, advisors, and attorneys of Yours or Zoom's, as the case may be, who have a strict need to know the information being shared and who are bound by legal or contractual obligations to protect the confidentiality and security of the Confidential Information that are at least as restrictive as the obligations set forth in this Agreement. "Confidential Information" includes, without limitation, business information, development plans, product roadmap details, systems, strategic plans, source code, services, products, pricing, methods, processes, financial data, programs, trade secrets, know-how, and marketing plans in any form that are designated as "confidential" or a reasonable person knows or reasonably should understand to be confidential. Notwithstanding the restrictions in this Section 9 (Confidential Information), You and Zoom may each disclose Confidential Information received under this Agreement to the extent required by law, regulation, or court order, provided You or Zoom, as the case may be, first (i) notifies the other party, unless providing such notice is prohibited by the applicable legal authority, and (ii) cooperates with reasonable requests of the other party in order to seek a protective order or otherwise prevent or limit the disclosure of the information to third parties. You and Zoom shall keep all Confidential Information received under this Agreement in the strictest confidence until such time as, and only to the extent that, such information is (a) already rightfully known to You or Zoom at the time it is received, free from any obligation to keep such information confidential; (b) or becomes publicly known or available through no wrongful act of You or Zoom or any third party; (c) rightfully received from a third party without restriction and without breach of this Agreement; or (d) developed by You or Zoom without the use of any proprietary, non-public information received under this Agreement. You and Zoom shall each take reasonable steps to maintain the privacy and security of the Confidential Information that You and Zoom receive, using measures that are at least as protective as those taken to protect information of a similar sensitivity that belongs to You or Zoom, but in no event using less than a reasonable standard of care. In the event of any unauthorized use or disclosure of the other party's Confidential Information, You and Zoom agree to provide notice the affected party of such unauthorized use or disclosure and cooperate to regain control of, and to prevent further unauthorized use or disclosure of, the Confidential Information.
• 10Proprietary Rights You acknowledge and agree that Zoom owns all legal right, title, and interest in and to the Beta Program and each Beta Offering, Feedback, and any and all intellectual property (and other proprietary) rights therein or arising therefrom, including, but not limited to, any and all copyrights, patents, patent applications, trade secrets, trademarks, and other rights therein. To the extent You have the right to enforce or license any intellectual property (or other proprietary) rights needed for Zoom's exercise of the rights specified to it under this Agreement, You hereby grant to Zoom a perpetual, irrevocable, sublicensable, royalty-free, worldwide license under such rights to exercise (including to utilize the subject matter of) such Zoom rights. Except for the license and other rights expressly granted to You in this Agreement, You acknowledge that nothing contained in this Agreement shall be deemed to give You, directly or by implication, estoppel, or otherwise, any rights, forbearances, or waivers under any intellectual property (or other proprietary) rights of Zoom. Each Beta Offering is made available for purposes of evaluation and feedback in order to allow Zoom to create improvements for the benefit of You and others, but without any financial compensation or reimbursement of any kind from Zoom. You acknowledge the importance of communication with Zoom while participating in the Beta Program and agree to receive correspondence and updates from Zoom. You shall provide reasonable feedback and information, as requested. In the event You request to opt out from such communications, Your participation in the Beta Program, Your access to a Beta Offering, or both, may be canceled. During the Beta Program, You and Your end users will be asked to provide feedback and information regarding the use of the Beta Offering, and You acknowledge that Zoom owns, and shall retain ownership of, all right, title, and interest in any suggestions, ideas, know-how, concepts, enhancements, feedback, recommendations or other information provided by You or any other party relating to a Beta Offering or the Beta Program, including without limitation, new features or functionality relating thereto (collectively, "Feedback"). Zoom or its licensors own and shall retain all proprietary rights, including all copyright, patent, trade secret, trademark, trade name, and all other intellectual property rights in and to each Beta Offering and the Feedback. You hereby assign to Zoom all right, title, and interest in, and Zoom is free to use without any attribution or compensation to You, any Feedback relating to a Beta Offering or underlying technology of a Beta Offering. All Feedback is and will be treated as confidential until Zoom, in its sole discretion, chooses to make any specific Feedback non-confidential.
• 11Zoom Phone Services; Emergency Calling Services; Charges You are responsible for all fees and charges imposed by telephone carriers, wireless providers, and other voice, data transmission providers, or similar carriers or providers for voice and data transmission used to access and use a Beta Offering. If a Beta Offering involves the use of Zoom phone services, that Beta Offering may not be intended for, or provide emergency services connectivity for, some or all of the Beta Offering, and You agree to provide or continue emergency services access via another service and to inform end users in the Beta Program that emergency calling is not available through the Beta Offering and to use the alternative access method. To the fullest extent allowed by law, Zoom specifically disclaims any liability for emergency calling services applicable to a Beta Offering.
• 12Content You or Your end user may provide, upload, or originate data, content, or other materials in the use of a Beta Offering, which may be imported, accessed, used, stored, transmitted, reviewed, extracted, or processed by Zoom based on instructions from You or the nature of the Beta Offering (collectively, "Content"). Content also includes any resulting derivatives, analytics, outputs, visual text, displays, or data sets created by Zoom resulting from the data, content, or other materials or sources provided by You or Your end user. You consent to Zoom use of Content for the following reasons (the "Permitted Uses"): (i) consistent with this Agreement and as required to perform our obligations and provide the Beta Offering; (ii) in accordance with our Privacy Statement; (iii) as authorized or instructed by You; (iv) as required by Law; or (v) for legal, safety or security purposes, including enforcing our Acceptable Use Guidelines. You grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary for the Permitted Uses. You further agree that Zoom owns all rights, title, and interest in and to telemetry data, product usage data, diagnostic data, and similar data that Zoom collects or generates in connection with Your or Your End Users' use of the Beta Offering. Zoom may use consultants, contractors, service providers, subprocessors, and other Zoom-authorized third parties in connection with the delivery of the Beta Offering. You are responsible for any claims relating to any Content, including claims that Content violates the rights of another. Zoom reserves the right to remove from the Beta Offering or its systems any Content that creates a risk to Zoom, as determined by Zoom. You agree that Zoom has no responsibility or liability for the deletion or failure to store Content and other communications maintained or transmitted through use of a Beta Offering. You are solely responsible for securing and backing up Content. Wherever possible, You shall use "dummy data" in a nonproduction environment. You represent and warrant that, prior to making any Content available through Your use of a Beta Offering, You have obtained all necessary consents with respect to the Content for participation in the Beta Program and use of the Beta Offering, including, without limitation, for the sharing of such Content with Zoom, its employees, consultants, and its authorized third parties. You acknowledge that Zoom may provide a customizable sample notice for Your use in connection with a Beta Offering, but that You are ultimately responsible for assuring compliance with applicable privacy and data security requirements, including, without limitation, providing sufficient notice to meeting participants regarding the collection and use of Content by You, Zoom, and others as required by applicable law. Zoom may also access, use, preserve, or disclose account information and Content if legally required to do so or on a good faith belief that such access, use, preservation, or disclosure is reasonably necessary to comply with legal process or request; to enforce this Agreement; to detect or prevent fraud, security, or technical issues; or to protect the rights, property, or safety of Zoom, its end users, customers, or the public as permitted by law.
• 13General Availability; Future Roadmap Zoom may, in its sole discretion and at any time, choose to make a Beta Offering generally available to the public and remove the Beta Offering from the Beta Program. Prior to Zoom making a Beta Offering generally available, Zoom makes no representation that the Beta Offering will comply with any potentially applicable laws (including regulations) during the Beta Program. You acknowledge that (i) additional laws and regulations may apply to a Beta Offering upon general release, and (ii) You may be required to accept additional contract terms, pay for access to the generally available version of a Beta Offering to enable continued use, or both. You acknowledge that participation is voluntary and for the sole purpose of assisting and benefiting Zoom in the advancement of the Beta Program and Beta Offering. You acknowledge that (a) Zoom has not made any representations, promises, or guarantees that a Beta Offering will ever be announced or made generally available or otherwise available to anyone, and (b) Zoom has no express or implied obligation to You to announce or make a Beta Offering generally available or otherwise available. Any future plans or roadmap information provided during the Beta Program is intended solely to outline general product direction and should not be relied on in making a purchasing decision and does not represent a commitment or legal obligation to deliver any material, code, or functionality. Future plans or roadmap information is intended for informational purposes only and may not be incorporated into any contract. Any forward-looking indication of plans for products, including the development, release, and timing of any features or functionality, is preliminary and all future release dates are tentative and are subject to change without notice. You acknowledge that a Beta Offering or a Beta Program could be or include material nonpublic information, and therefore, You shall not offer to sell, sell, or otherwise enter into any transaction in connection with Zoom stock to the extent You are aware of or in the possession of any of Zoom's material nonpublic information.
• 14Indemnification You shall defend, indemnify, and hold harmless Zoom, its Affiliates, and their respective officers, directors, members, employees, consultants, agents, suppliers and representatives from any third-party allegations, suits, claims, or demands and associated liabilities, costs, damages, and expenses (including, but not limited to, attorneys' fees, expert fees, and court costs) (collectively, "Claims") arising from or related to Your or Your end users': (a) violation of this Agreement; (b) infringement or violation of the intellectual property rights of another; (c) violation of any law; or (d) act or omission resulting in personal injury or property damage.
• 15LIMITATION ON LIABILITY Please read this section carefully as it limits the liability of Zoom to You. IN NO EVENT WILL ZOOM OR ITS AFFILIATES BE LIABLE TO YOU OR ANY OTHER PARTY FOR DAMAGES OF ANY KIND ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER RESULTING FROM A TORT (INCLUDING NEGLIGENCE), BREACH OF CONTRACT, WARRANTY, OR OTHER FORM OF ACTION, AND INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, AND EVEN IF YOU HAVE ADVISED ZOOM OF THE POSSIBILITY OF SUCH DAMAGES. THE PARTIES AGREE THAT THE FOREGOING LIMITATION OF LIABILITY IS MATERIAL TO THIS AGREEMENT, AND THAT THESE LIMITATIONS APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY. BECAUSE SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.
• 16International Use; Export Controls; Sanctions You acknowledge that the Beta Offerings, or a portion thereof, are subject to the Export Administration Regulations, 15 C.F.R. Parts 730-774, of the United States and may be subject to other applicable country export control and trade sanctions laws ("Export Control and Sanctions Laws"). You shall not, and shall not permit any of Your end users of a Beta Offering, to access, use, export, re-export, divert, transfer, or disclose any part of a Beta Offering or any related technical information or materials, directly or indirectly, in violation of any applicable export control or trade sanctions law or regulation. You represent and warrant that: (i) You and Your end users (a) are not citizens of, or located within, a country or territory that is subject to U.S. trade sanctions or other significant trade restrictions (including without limitation Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk and Luhansk regions of Ukraine) and that You and Your end users will not access or use a Beta Offering, or export, re-export, divert, or transfer a Beta Offering, in or to such countries or territories; (b) are not persons, or owned 50% or more, individually or in the aggregate by persons, identified on the U.S. Department of the Treasury's Specially Designated Nationals and Blocked Persons List or Foreign Sanctions Evaders Lists; and (c) are not persons on the U.S. Department of Commerce's Denied Persons List, Entity List, or Unverified List, or U.S. Department of State proliferation-related lists; and (ii) You and Your end users located in China, Russia, or Venezuela are not Military end users and will not put Zoom's Beta Offerings to a Military end user, as defined in 15 C.F.R. 744.21. You are solely responsible for complying with the Export Control and Sanctions Laws and monitoring them for any modifications.
• 17Commercial Agreements; Data Processing Addendum; US Privacy Law Addendum
• 17.1The parties intend for this Agreement to be separate and distinct from a master subscription agreement, terms of service, and any other agreement for Zoom services (each, a "Commercial Agreement") that You may have with Zoom and this Agreement does not become part of, modify, supersede, or amend any Commercial Agreement between You and Zoom. You acknowledge that the terms and conditions of this Agreement govern and control Your use of and access to a Beta Offering and Your participation in the Beta Program and not any Commercial Agreement nor any beta terms that may be contained in a Commercial Agreement.
• 17.2If You are a business, enterprise, or education account owner and Your use of the Beta Offering requires Zoom to process personal data of Your end users under a data processing agreement or addendum ("DPA") in accordance with Section 6(b), then You acknowledge and agree that Zoom will process such personal data subject to Zoom's Global Data Processing Addendum (unless You and Zoom have previously entered into a DPA under a Commercial Agreement or otherwise, in which case Your previously entered into DPA will govern) and such DPA is hereby incorporated into and made a part of this Agreement solely for such purposes.
• 17.3If You (i) are a "business" and we process "personal information" (as those terms are defined by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020) on Your behalf, (ii) are a "controller" and Zoom processes "personal data" (as those terms are defined by other applicable US state data privacy laws) on Your behalf, or (iii) meet both criteria set out in (i) and (ii), then Zoom's US State Law Privacy Addendum is incorporated herein by reference and applies to Zoom's "processing" of Your "personal information" and "personal data" (as those terms are defined under the aforementioned laws).
• 18AGREEMENT TO ARBITRATE CLAIMS AND CLASS ACTION WAIVER You agree to resolve disputes with Zoom through binding arbitration before the American Arbitration Association ("AAA"). Arbitration means that an arbitrator, and not a judge or a jury, will decide the dispute. This Agreement also prevents You from bringing or participating in any kind of class, collective, or mass action, private attorney general action, or any other proceeding brought against Zoom by someone else.
• 18.1Covered Disputes You agree that any dispute or claim arising between You and Zoom concerning the Beta Program, the Beta Offering, including any related software, hardware, advertising or marketing communications related to the subject matter herein, will be resolved by binding arbitration, rather than in court.
• 18.2Exceptions to Arbitration This Agreement does not require arbitration of the following types of claims: (1) small claims court actions brought by either You or Zoom, if the requirements of the court are met and the claims are only on an individual basis; and (2) claims pertaining to domain names or intellectual property rights, including trademarks, trade dress, trade secrets, copyrights, and patents.
• 18.3Arbitration Procedure The AAA will conduct any arbitration under its Commercial Arbitration Rules unless You are an individual and use the Beta Offering for personal or household use, in which case AAA's Consumer Arbitration Rules will apply. Visit www.adr.org for more information. In the event of a conflict between any applicable AAA rules and the terms of this Agreement, the terms of this Agreement will govern to the extent necessary to resolve the conflict. If AAA is not available to arbitrate, the parties will select an alternative arbitral forum and, if they cannot agree, will ask the court to appoint an arbitrator pursuant to 9 U.S.C. § 5. Arbitration hearings will take place in one of the following locations: (i) where You reside or use the Beta Offering, (ii) in San Jose, California, or (iii) in another location that You and Zoom agree upon in writing. A single arbitrator will be appointed. The arbitrator may award damages, declaratory or injunctive relief, and costs (including reasonable attorneys' fees). Any arbitration award may be enforced (such as through a judgment) in any court with jurisdiction. Under AAA Rules, the arbitrator rules on his or her own jurisdiction, including the arbitrability of any claim; however, a court has exclusive authority to enforce the prohibition on arbitration on a class-wide basis or in a representative capacity.
• 18.4Arbitration Fees Your responsibility to pay any filing, administrative, and arbitrator fees will be solely as set forth in AAA's rules. If You have a gross monthly income of less than 300% of the federal poverty guidelines, You are entitled to a waiver of arbitration fees and costs. If You cannot afford to pay AAA's fees and AAA denies Your request for a waiver of fees, Zoom will pay them for You.
• 18.5Requirement to File Within One Year Notwithstanding any other statute of limitations, and exclusive of any claims or causes of action that are subject to Section 18(b) (Exceptions to Arbitration), any claim or cause of action under this Agreement must be filed within one (1) year after such claim or cause of action arose or else that claim or cause of action will be permanently barred.
• 18.6Severability of Class Action Waiver If the class action waiver is found to be illegal or unenforceable as to all or some parts of a dispute, then those parts will not be arbitrated but will be resolved in court, with the balance resolved through arbitration.
• 19Miscellaneous Terms
• 19.1Notice Zoom may give notice by (i) electronic mail to Your e-mail address on record in Your account information, (ii) written communication sent by letter delivered by a nationally recognized overnight delivery service, or (iii) first-class postage prepaid mail to Your address on record in Your account information. You may give notice to Zoom (such notice shall be deemed given when received by Zoom) by (x) letter delivered by a nationally recognized overnight delivery service or first-class postage prepaid mail to Zoom at 55 Almaden Blvd, San Jose, CA, 95113, Suite 600, USA, addressed to the attention of: Legal or (y) email to legal@zoom.us, addressed to the attention of: Legal.
• 19.2No Agency Relationship The parties do not intend for this Agreement to create an express or implicit agency relationship in accordance with federal or state common law of agency. Each party is intended to be an independent contractor and no agency relationship is created under this Agreement.
• 19.3No Third-Party Rights or Remedies This Agreement does not and is not intended to confer any enforceable rights or remedies upon any person other than Zoom and You.
• 19.4Assignment; Successors and Assigns You may not assign Your rights or transfer any of Your obligations under this Agreement without the express written consent of Zoom and such consent may be granted or withheld in Zoom's sole discretion. Zoom may assign its rights or transfer any or all of its obligations under this Agreement at any time, without prior notice to You. Any purported assignment or transfer in violation of this section is null and void. This Agreement is binding upon, and inures to the benefit of, the parties and their respective permitted successors and assigns.
• 19.5Changes to this Agreement; Additional Terms Zoom reserves the right to modify the terms and conditions of this Agreement from time to time, and Zoom will use commercially reasonable efforts to communicate any material change to You. Use of the Beta Offering may require acceptance of new, modified, or additional terms of use from time-to-time by and through You, Your administrator, or other account owner. By continuing to use the Beta Offering or participate in the Beta Program and not issuing a notice of termination of this Agreement, unless expressly prohibited by law, You agree that such actions will be deemed acceptance of, and Your agreement to be bound by, any such new, modified, or additional terms.
• 19.6Merger; Conflicts The parties intend for this Agreement to constitute the final agreement between the parties, and that it is the complete and exclusive expression of the parties' agreement on the matters contained herein. All prior or contemporaneous writings, negotiations, and discussions between the parties with respect to its subject matter are expressly merged and superseded by this Agreement. In entering into this Agreement, neither party has relied upon any statement, representation, warranty, or agreement of the other party except to the extent expressly contained in this Agreement. In the event of a conflict between any other agreement between the parties and this Agreement with respect to the subject matter of this Agreement, the terms of this Agreement will control. You acknowledge that no text or information set forth on any purchase order, preprinted form, or other document can add to or vary the terms and conditions of this Agreement.
• 19.7Severability If any provision of this Agreement is determined to be invalid, illegal, or unenforceable, the parties do not intend for this determination to affect or impair the validity, legality, and enforceability of the remaining provisions of this Agreement in any way.
• 19.8Survival All sections of this Agreement which, by their nature should survive termination will survive termination, including, without limitation, sections pertaining to confidential information, any payment obligations, warranty disclaimers, indemnification, arbitration, and the limitation on liability.
• 19.9Governing Law; Forum Selection The laws of the State of California, U.S.A., regardless of conflict of laws principles, govern all matters arising out of or relating to this Agreement, except that the Federal Arbitration Act governs provisions relating to arbitration. Except as otherwise provided in Section 18 (Agreement to Arbitrate Claims and Class Action Waiver), the parties consent to the exclusive jurisdiction and venue of the state courts located in and serving Santa Clara County, California and the federal courts in the Northern District of California. Notwithstanding the above, the parties agree that this paragraph does not preclude either party from initiating any legal, administrative, or regulatory proceedings (including nullity proceedings) before the Patent or Trademark Trial and Appeal Boards, the United States Patent and Trademark Office, the United States Copyright Office, any foreign patent, copyright, or trademark office, or any other such foreign or domestic administrative or regulatory body, regarding the validity or enforceability of any copyright, patent, trade secret, trademark or other intellectual property right assigned to either party to this Agreement.
• 19.10Ambiguity and Headings The parties intend that any ambiguity in this Agreement will be resolved and interpreted as closely as possible to meet the intent of the parties. The captions and headings appearing in this Agreement are for reference only and are not intended to be considered in construing this Agreement.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 1 of 30 This Data Processing Addendum, including its Exhibits (this "Addendum"), forms part of the Master Subscription Agreement, Terms of Service, Terms of Use, or any other agreement about the delivery of the contracted services between Zoom Communications, Inc.

·("Zoom") and the Customer (the "Agreement") named in such Agreement or identified below to reflect the parties' agreement about the Processing of Customer Personal Data (as those terms are defined below).

·In the event of a conflict between the terms and conditions of this Addendum, the Agreement, an Order Form, or any other documentation, the terms and conditions of this Addendum govern and control with respect to the subject matter of Processing of Customer Personal Data. All capitalised terms not defined herein shall have the meaning set forth in the Agreement.

11. Definitions

1.11.1 "Affiliate" means, with respect to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party. For purposes of this Addendum, "control" means an economic or voting interest of at least fifty percent (50%) or, in the absence of such economic or voting interest, the power to direct or cause the direction of the management and set the policies of such an entity.

1.21.2 "Anonymised Data" means, having regard to the guidance published by the European Data Protection Board, Personal Data which does not relate to an identified or identifiable natural person or rendered anonymous in such a manner that the data subject is not or no longer identifiable.

1.31.3 "Applicable Data Protection Law" means any applicable legislative or regulatory regime enacted by a recognized government, or governmental or administrative entity with the purpose of protecting the privacy rights of natural persons or households consisting of natural persons, in particular the General Data Protection Regulation 2016/679 ("GDPR") and supplementing data protection law of the European Union Member States, the United Kingdom's Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK GDPR"), the Swiss Federal Data Protection Act ("Swiss DPA"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") S.C. 2000, ch. 5, and any provincial legislation deemed substantially similar to PIPEDA under the procedures set forth therein, the Brazilian Law No. 13,709/2018 - Brazilian General Data Protection Law ("LGPD"), the ePrivacy Directive 2002/58/EC (the "Directive"), together with any European Union Member national implementing the Directive.

1.41.4 "Authorized Subprocessor" means a subprocessor engaged by Zoom to Process Customer Personal Data on behalf of the Customer per the Customer's Instructions under the terms of the Agreement and this Addendum. Authorized Subprocessors may include Zoom Affiliates but shall exclude Zoom employees, contractors and consultants.

1.51.5 "Controller" means the entity that determines as a legal person alone or jointly with others the purposes and means of the Processing of Personal Data.

1.61.6 "Customer Personal Data" means Personal Data, including but not limited to:

·(a) Content Data: All text, sound, video, or image files that are part of an End User's profile and End User information exchanged between End Users (including guest users participating in Customer-hosted meetings and webinars) and with Zoom via the Services;

·(b) Account Data (name, screen name and email address);

·(c) Support Data (as defined in Annex I of the Standard Contractual Clauses);

·(d) Website access Data (including cookies); and

·(e) Diagnostic Data, including but not limited to: Data from applications (including browsers) installed on End User devices ("Telemetry Data"), Service generated server logs (for example meeting metadata and End User settings) and internal security logs that are generated by or provided to Zoom by, or on behalf of, Customer through use of the Services as further defined in in Annex I of the Standard Contractual Clauses).

1.71.7 "Data Subject" means the identified or identifiable person to whom Personal Data relates.

1.81.8 "Legitimate Business Purposes" means the exhaustive list of specific purposes for which Zoom is allowed to process some Personal Data as a Controller as specified in Section 2.4.

1.91.9 "Personal Data" means any information relating to a Data Subject; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes any special categories of Personal Data defined Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 2 of 30 in Art. 9 of the UK GDPR, data relating to criminal convictions and offences or related security measures defined in Art. 10 of the UK GDPR and national security numbers defined in Art. 87 of the GDPR and national supplementing law.

1.101.10 "Processor" means the entity that processes Personal Data on behalf of the Controller.

1.111.11 "Personal Data Breach" means a breach of security which results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Zoom or Zoom's Authorized Subprocessor.

1.121.12 "Process" or "Processing" means any operation or set of operations which is performed upon Personal Data or sets of Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. For the avoidance of doubt: This includes processing of Personal Data to disclose, aggregate, pseudonymise, de-identify or anonymize Personal Data, and to combine Personal Data with other Personal Data, or to derive any data or information from such Personal Data.

1.131.13 "Services" means the Zoom Services as set forth in the Agreement or associated Zoom order form.

1.141.14 "Specific US State Data Protection Law" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and any regulations promulgated thereunder ("CCPA"); the Colorado Privacy Act of 2021; the Virginia Consumer Data Protection Act of 2021; the Utah Consumer Privacy Act of 2022, as amended; and any other US state law that may be enacted that adheres to the same or substantially the same requirements of the aforementioned laws in this definition.

1.151.15 "Standard Contractual Clauses" means: (i) where the GDPR applies the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the "EU SCCs"); (ii) where the UK GDPR applies, the "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses" issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018 ("UK Addendum"); and (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or otherwise recognized by the Swiss Federal Data Protection and Information Commissioner ("FDPIC") (the "Swiss SCCs").

1.161.16 "Supervisory Authority" means an independent public authority responsible for monitoring the application of Applicable Data Protection Law, including the Processing of Personal Data covered by this Addendum.

22. Processing of Personal Data: Roles, Scope and Responsibility

2.12.1 The parties acknowledge and agree to the following: Customer is the Controller of Customer Personal Data. Zoom is the Processor of Customer Personal Data, except where Zoom or a Zoom Affiliate acts as a Controller processing Customer Personal Data in accordance with the exhaustive list of Legitimate Business Purposes in Section 2.4.

2.22.2 Only to the extent necessary and proportionate, Customer as Controller instructs Zoom to perform the following activities as Processor on behalf of Customer:

·(a) Provide and update the Services as configured, and used by Customer and its users, (for example, through Customer's use of Zoom settings or administrator controls) including to make ongoing product improvements and provide personalised experiences and recommendations;

·(b) Secure and real-time monitor the Services;

·(c) Resolve issues, bugs, and errors;

·(d) Provide Customer requested support, including applying knowledge gained from individual customer support requests to benefit all Zoom customers but only to the extent such knowledge is anonymized; and

·(e) Process Customer Personal Data as set out in the Agreement and Annex I to the Standard Contractual Clauses (subject matter, nature, purpose, and duration of Personal Data Processing in the controller to processor capacity and any other documented instruction provided by Customer and acknowledged by Zoom as constituting instructions for purposes of this Addendum.

·(collectively, the "Instructions").

2.32.3 Zoom shall immediately notify the Customer, if, in Zoom's opinion, an Instruction of the Customer infringes Applicable Data Protection Law and request that Customer withdraw, amend, or confirm the relevant Instruction. Pending the decision on the withdrawal, amendment, or confirmation of the relevant Instruction, Zoom shall be entitled to suspend the implementation of the relevant Instruction.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 3 of 30

2.42.4 Zoom may Process certain Customer Personal Data for its own Legitimate Business Purposes, as an independent Controller, solely when the Processing is strictly necessary and proportionate, and if the Processing is for one of the following exhaustive list of purposes:

·(a) Directly identifiable data (name, screen name, profile picture and email address and all Customer Personal Data directly connected to such directly identifiable data) may be Processed for:

·(i) billing, account, and Customer relationship management (marketing communications to procurement, sales, and other Customer personnel that requests such communication), and related Customer correspondence (mailings about for example necessary updates);

·(ii) complying with and resolving legal obligations, including responding to Data Subject Requests for Personal Data processed by Zoom as data Controller (for example website data), tax requirements, agreements and disputes;

·(iii) abuse detection, prevention, and protection (such as automatic scanning for matches with identifiers of known Child Sexual Abuse Material ("CSAM")), virus scanning and scanning to detect violations of terms of service (such as copyright infringement, SPAM, and actions not permitted under Zoom ́s Acceptable Use Guidelines;

·(b) Pseudonymized and/or aggregated data (Zoom will pseudonymise and/or aggregate as much as possible and pseudonymized and/or aggregated data will not be processed on a per-Customer level), for:

·(i) improving and optimizing the performance and core functionalities of accessibility, privacy, security, and the IT infrastructure efficiency of the Services, including zoom.us, explore.zoom.us, and support.zoom.us;

·(ii) internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy); and

·(iii) receiving and using Feedback for Zoom's overall service improvement.

·When acting as an independent Controller, Zoom will not process Customer Personal Data for any purposes other than the above list of Legitimate Business Purposes.

2.52.5 Zoom will not Process Customer Personal Data for third-party advertising, direct marketing, profiling, research or analytics purposes except where such processing is (i) necessary to comply with Customer's instructions as set out in Section 2.2 of this Addendum, or (ii) for the Legitimate Business Purposes described in Section 2.4 or (iii) part of Zoom's free Services, early access program, or beta program.

2.62.6 Zoom shall only process Customer Personal Data for the purposes specified in this Addendum; provided, however, Zoom may process Customer Personal Data for "further" or "compatible" purposes (within the meaning of Articles 5(l)(b) and 6(4) GDPR, where applicable), or seek consent from End Users for new types of data processing, where permitted by the Zoom account administrator and Applicable Data Protection Law.

2.72.7 With regard to content scanning for CSAM and reporting 'hits' to The National Center for Missing Exploited Children ("NCMEC"), Zoom will conduct human review of matched content before it is reported. Zoom may immediately suspend the account of the End User and if legally allowed to do so, notify the End User thereafter of the suspension and the option to appeal the suspension if applicable.

2.82.8 Regardless of its role as Processor or Controller, Zoom shall process all Customer Personal Data in compliance with Applicable Data Protection Laws, the "Security Measures" referenced in Section 6 of this Addendum and Annex I to the Standard Contractual Clauses.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 4 of 30

2.92.9 Customer shall ensure that its Instructions to Zoom comply with all laws, rules, and regulations applicable to Customer Personal Data, and that the Processing of Customer Personal Data per Customer's Instructions will not cause Zoom to be in breach of Applicable Data Protection Law. Customer is solely responsible for the accuracy, quality, and legality of (i) the Customer Personal Data provided to Zoom by or on behalf of Customer; (ii) how Customer acquired any such Customer Personal Data; and (iii) the Instructions Customer provides to Zoom regarding the Processing of such Customer Personal Data. Customer shall not provide or make available to Zoom any Customer Personal Data in violation of the Agreement, this Addendum, or otherwise in violation of Zoom's Acceptable Use Guidelines (currently published at https://explore.zoom.us/en/community-standards/ as updated from time to time) and shall indemnify Zoom from all claims and losses in connection therewith.

2.102.10 Following the completion of the Services, at Customer's choice, to the extent that Zoom is a Processor, Zoom shall either enable Customer to delete some of Customer's Personal Data (for example an End User's Personal Data) or all of Customer's Personal Data, shall return to Customer the specified Customer Personal Data, or shall delete the specified Customer Personal Data, and delete any existing copies in compliance with its data retention and deletion policy. If return or destruction is impracticable or incidentally prohibited by a valid legal order law, Zoom shall take measures to inform the Customer and block such Customer Personal Data from any further Processing (except to the extent necessary for its continued hosting or Processing required by applicable law) and shall continue to appropriately protect the Customer Personal Data remaining in its possession, custody, or control and, where any Authorized Subprocessor continues to possess Customer Personal Data, require the Authorized Subprocessor to take the same measures that would be required of Zoom.

33. Privacy by design and by default

3.13.1 Zoom agrees to minimize Processing to the extent necessary to provide the Services and for the purposes permitted in this Addendum, the Agreement, or as otherwise agreed upon by Customer and Zoom. This includes minimization of Telemetry Data, Support Data, and feedback functionality; minimization of data retention periods; collection of pseudonymised identifiers when necessary, but immediate effective (irreversible) anonymization when the Service can be performed without Personal Data; and the implementation and control of strict access controls to the Customer Personal Data.

3.23.2 Zoom shall maintain a process whereby when Zoom collects new types of Diagnostic Data, such new collection shall be supervised by a privacy officer. Zoom will perform regular checks on the contents of collected Telemetry Data to verify that neither directly identifying data are collected nor Customer Content Data.

3.33.3 Regarding Zoom's use of cookies or similar tracking technology, Zoom shall ensure that only those cookies which are strictly necessary shall be set by default for European Enterprise and Education Customers on zoom.us, support.zoom.us, and explore.zoom.us, including visits to these pages when the End User or system administrator has signed into the Zoom account.

3.43.4 When Zoom plans to introduce new features, or related software and services ("New Service"), which will result in new types of Processing (i.e., new Personal Data and/or new purposes), Zoom will:

·(a) perform a data protection impact assessment;

·(b) determine if the new types of Processing following a New Service are allowed within the scope of this Addendum; and

·(c) ensure that the new Processing occurs with the necessary Customer notice or consents.

44. Authorized Persons

·Zoom shall ensure that all persons authorized to Process Customer Personal Data and Customer Content are made aware of the confidential nature of Customer Personal Data and Customer Content and have committed themselves to confidentiality (e.g., by confidentiality agreements) or are under an appropriate legal obligation of confidentiality.

55. Authorized Subprocessors

·To the extent that Zoom is a Processor:

5.15.1 Customer hereby generally authorizes Zoom to engage subprocessors in accordance with this Section 5.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 5 of 30

5.25.2 Customer approves the Authorized Subprocessors listed at https://explore.zoom.us/docs/en- us/subprocessors.html:

5.35.3 Zoom may remove, replace, or appoint suitable and reliable further subprocessors in accordance with this Section 5.3:

·(a) Zoom shall at least thirty (30) business days before the new subprocessor starts processing any Customer Personal Data notify Customer of the intended engagement (including the name and location of the relevant subprocessor, and the activities it will perform and a description of the Personal Data it will process). To enable such notifications, Customer shall visit https://explore.zoom.us/docs/en- us/subprocessors.html and enter its desired and valid email address into the submission field at the bottom of the webpage, and Zoom shall send such notifications to the email address entered into the submission field.

·(b) In an emergency concerning Service availability or security, Zoom is not required to provide prior notification to Customer but shall provide notification within seven (7) business days following the change in subprocessor.

·In either case, Customer may object to such an engagement in writing within fifteen (15) business days of receipt of the aforementioned notice by Zoom.

5.45.4 If Customer objects to the engagement of a new subprocessor, Zoom shall have the right to cure the objection through one of the following options (to be selected at Zoom's sole discretion):

·(a) Zoom cancels its plans to use the subprocessor with regard to Customer Personal Data.

·(b) Zoom will take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the subprocessor with regard to Customer Personal Data.

·(c) Zoom may cease to provide, or Customer may agree not to use (temporarily or permanently), the particular aspect of the Service that would involve the use of such a subprocessor with regard to Customer Personal Data.

·(d) Zoom provides Customer with a written description of commercially reasonable alternative(s), if any, to such engagement, including without limitation modification to the Services. If Zoom, in its sole discretion, cannot provide any such alternative(s), or if Customer does not agree to any such alternative(s), if provided, Zoom and Customer, within thirty days (30) days of being provided an alternative, may terminate the affected portion(s) of the Agreement with prior written notice. Termination shall not relieve Customer of any fees or charges owed to Zoom for Services provided up to the effective date of the termination under the Agreement.

·If Customer does not object to a new subprocessor's engagement within fifteen (15) business days of notice issuance from Zoom, that new subprocessor shall be deemed accepted.

5.55.5 Zoom shall ensure that Authorized Subprocessors have executed confidentiality agreements that prevent them from unauthorized Processing of Customer Personal Data and Customer Content both during and after their engagement by Zoom.

5.65.6 Zoom shall, by way of contract or other legal act, impose on the Authorized Subprocessor data protection obligations consistent with the obligations set out in this Addendum and in accordance with GDPR requirements. The parties acknowledge and agree that notice periods shall be deemed equivalent regardless of disparate notification periods. If Personal Data are transferred to an Authorized Subprocessor in a third country that does not ensure an adequate level of protection according to the European Commission, the FDIPC, or UK Information Commissioner's Office, Zoom will ensure the transferred data are processed with the same GDPR transfer guarantees as agreed with Customer (such as Standard Contractual Clauses and BCRs). Zoom will also perform a case-by-case assessment if supplementary measures are required in cases of onward transfers to third countries to bring the level of protection of the transferred data up to the EU standard of essential equivalence.

5.75.7 Zoom shall be fully liable to Customer where that Authorized Subprocessor fails to fulfil its data protection obligations for the performance of that Authorized Subprocessor's obligations to the same extent that Zoom would itself be liable under this Addendum had it conducted such acts or omissions.

66. Security of Personal Data

6.16.1 Zoom may not update the Services in a way that would remove Customer's choice to apply end to end encryption to Meetings, introduce any functionality that would purposefully allow anyone not authorized by Customer to gain access to Customer encryption keys or Customer content, or remove the ability to store recordings locally.

6.26.2 Zoom certifies that it has not purposefully created any "back doors" or similar programming in the Services that could be used by third parties to access the system and/or Personal Data. Zoom has not purposefully created or changed its Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 6 of 30 business processes in a manner that facilitates such third-party access to Personal Data or systems. Zoom certifies there is no applicable law or government policy that requires Zoom as importer to create or maintain back doors or to facilitate access to Personal Data or systems or for the importer to be in possession of or to hand over the encryption key.

6.36.3 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Zoom shall maintain appropriate technical and organizational measures with regard to Customer Personal Data and to ensure a level of security appropriate to the risk, including, but not limited to, the "Security Measures" set out in Annex II to the Standard Contractual Clauses (attached here as EXHIBIT B). Customer acknowledges that the Security Measures are subject to technical progress and development and that Zoom may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade or diminish the overall security of the Services.

77. International Transfers of Personal Data

7.17.1 Zoom may not update the Services in a way that would remove Customer's ability to choose to store certain Personal Data at rest within the European Economic Area ("EEA").

7.27.2 Customer acknowledges and agrees that Zoom may transfer and process Customer Personal Data to and in the United States. Zoom may transfer Customer Personal Data to third countries (including those outside the EEA without an adequacy statement from the European Commission) to Affiliates, its professional advisors, or its Authorized Subprocessors, including when a Zoom End User knowingly connects to data processing operations supporting the Services from such locations (for example, when the End user travels outside of the territory of the EU). Zoom shall ensure that such transfers are made in compliance with Applicable Data Protection Law and this Addendum.

7.37.3 Any transfer of Customer's Personal Data made subject to this Addendum from member states of the European Union, the EEA, Switzerland or the United Kingdom to any country that does not ensure an adequate level of protection according to the European Commission, the FDIPC, or UK Information Commissioner's Office (as applicable), shall be undertaken through the Standard Contractual Clauses, in connection with which the parties agree to the following:

·(a) EU SCCs (Controller to Controller Transfers). In relation to Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.4 of this Addendum, the EU SCCs shall apply, completed as follows:

·(i) Module One will apply;

·(ii) in Clause 7, the optional docking clause will apply;

·(iii) in Clause 11, the optional language will not apply;

·(iv) in Clause 17, Option 1 will apply, and the New EU SCCs will be governed by Irish law;

·(v) in Clause 18(b), disputes shall be resolved before the courts of Ireland;

·(vi) Annex I of the EU SCCs shall be deemed completed with the information set out in EXHIBIT A of this Addendum; and

·(vii) Subject to Section 6.3 of this Addendum, Annex II of the EU SCCs shall be deemed completed with the information set out in EXHIBIT B to this Addendum.

·(b) EU SCCs (Controller to Processor/Processor to Processor Transfers). In relation to Personal Data that is protected by the EU GDPR and processed in accordance with Sections 2.2 of this Addendum, the EU SCCs shall apply, completed as follows:

·(i) Module Two or Module Three will apply (as applicable);

·(ii) in Clause 7, the optional docking clause will apply;

·(iii) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes shall be as set out in Section 5.3 of this Addendum;

·(iv) in Clause 11, the optional language will not apply;

·(v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;

·(vi) in Clause 18(b), disputes shall be resolved before the courts of Ireland;

·(vii) Annex I of the EU SCCs shall be deemed completed with the information set out in EXHIBIT A to this Addendum; and Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 7 of 30

·(viii) Subject to Section 6.3 of this Addendum, Annex II of the EU SCCs shall be deemed completed with the information set out in EXHIBIT B to this Addendum.

·(c) Transfers from the UK. In relation to Personal Data that is protected by the UK GDPR, the UK Addendum will apply, completed as follows:

·(i) The EU SCCs shall also apply to transfers of such Personal Data, subject to sub-Section (ii) below;

·(ii) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out above in Section 7.3 (a)-(b) of this Addendum, and the option "neither party" shall be deemed checked in Table 4. The start date of the UK Addendum (as set out in Table 1) shall be the date of this Addendum.

·(d) Transfers from Switzerland. In relation to Personal Data that is protected by the Swiss DPA, the EU SCCs will apply in accordance with Sections 7.3 (a)-(b), with the following modifications:

·(i) any references in the EU SCCs to "Directive 95/46/EC" or "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA;

·(ii) references to "EU", "Union", "Member State" and "Member State law" shall be interpreted as references to Switzerland and Swiss law, as the case may be; and

·(iii) references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the FDIPC and competent courts in Switzerland, unless the EU SCCs as implemented above cannot be used to lawfully transfer such Personal Data in compliance with the Swiss DPA, in which event the Swiss SCCS shall instead be incorporated by reference and form an integral part of this Addendum and shall apply to such transfers. Where this is the case, the relevant Annexes of the Swiss SCCs shall be populated using the information contained in EXHIBIT A and EXHIBIT B to this Addendum.

7.47.4 It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this Addendum) the Standard Contractual Clauses shall prevail to the extent of such conflict.

7.57.5 Zoom may adopt a replacement data export mechanism (including any new version of or successor to the Standard Contractual Clauses or alternative mechanisms adopted pursuant to Applicable Data Protection Law) ("Alternative Transfer Mechanism"). So long as the Alternative Transfer Mechanism complies with Applicable Data Protection Law and extends to the territories to which Customer Personal Data is transferred on behalf of the Customer, Customer agrees to execute documents and take other reasonably necessary actions to give legal effect to such Alternative Transfer Mechanism.

7.67.6 Zoom will follow European Data Protection Board requirements and Applicable Data Protection Law requirements concerning the completion of a data transfer impact assessment ("DTIA").

88. Rights of Data Subjects

·To the extent that Zoom is a Processor:

8.18.1 Zoom shall promptly notify Customer upon receipt of a request by a Data Subject to exercise Data Subject rights under Applicable Data Protection Law. Zoom will advise the Data Subject to submit his or her request to Customer, and Customer will be responsible for responding to such request.

8.28.2 Zoom shall, taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to requests for exercising the Data Subject's rights (regarding information, access, rectification and erasure, restriction of Processing, notification, data portability, objection and automated decision-making) under Applicable Data Protection Law.

99. Disclosure of Personal Data

9.19.1 Zoom will not disclose or provide access to any Customer Personal Data except:

·(a) as Customer directs;

·(b) as described in this Addendum; or Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 8 of 30

·(c) as required by law.

9.29.2 If a court, law enforcement authority or intelligence agency contacts Zoom with a demand for Customer Personal Data, Zoom will first assess if it is a legitimate order consistent with Zoom's Government Requests Guide. If so, Zoom will attempt to redirect this third party to request those data directly from Customer. If compelled to disclose or provide access to any Customer Personal Data to law enforcement, Zoom will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so, for example, through a so-called gagging order. If Zoom is prohibited by law from fulfilling its obligations under this Section 9.2, Zoom shall represent the reasonable interests of Customer. This is in all cases understood to mean:

·(a) Zoom shall document a legal assessment of the extent to which: (i) Zoom is legally obliged to comply with the request or order; and (ii) Zoom is effectively prohibited from complying with its obligations in respect of Customer under this Addendum.

·(b) Zoom shall only cooperate with the US issued request or order if legally obliged to do so and, where possible, Zoom shall judicially object to the request or order or the prohibition to inform Customer about this or to follow the instructions of Customer.

·(c) Zoom shall not provide more Customer Personal Data than is strictly necessary for complying with the request or order.

·(d) If Zoom becomes aware of a situation where it has reason to believe that the laws and practices in the third country of destination applicable to the processing of the Personal Data by Zoom, its Affiliates and Authorized Subprocessors, including any requirements to disclose Personal Data or measures authorizing access by public authorities, will prevent Zoom from fulfilling its obligations under this Addendum, Zoom will inform Customer without undue delay after Zoom becomes aware of such a situation.

·(e) Zoom will publish a transparency report twice a year.

1010. Compliance Auditing

10.110.1 Zoom will conduct third-party audits to attest to the ISO 27001 and SOC 2 Type II frameworks as follows:

·(a) Zoom will conduct at least one audit annually. Starting in 2022, Zoom will audit the Security, Availability and Privacy Criteria in the SOC-2 audit.

·(b) Audits will be performed according to the standards and rules of the regulatory or accreditation body for the applicable control standard or framework.

·(c) Audits will be performed by qualified, independent, third-party security auditors at Zoom's selection and expense.

10.210.2 Each audit will result in the generation of an audit report ("Zoom Audit Report"), which Zoom will make available to Customer upon request. The Zoom Audit Report will be Zoom's Confidential Information. Zoom will promptly remediate issues raised in any Zoom Audit Report to the satisfaction of the auditor.

10.310.3 At its request and cost, Customer is entitled to have an audit carried out by a mutually agreed upon auditor to demonstrate that Zoom complies with the provisions of this Addendum and Clause 8.9 "Documentation and compliance" (EU SCCs) for the processing of Personal Data. Customer may exercise the right no more than once a year, except in respect of an additional audit following (i) a Zoom data breach or (ii) if specifically ordered by Customer's national Supervisory Authority.

10.410.4 Following receipt by Zoom of a request for an audit under this Section 10.4, Zoom and Customer will discuss and agree in advance on

·(a) the identity of an independent and suitably qualified third-party auditor to conduct the audit;

·(b) the reasonable start date and duration (not to exceed two weeks in respect of any on premise audits) of any such audit;

·(c) the scope, process and normative framework of the audit, including: (i) the data processing outcomes, information, and control requirements to be in scope of the audit evidence requirements; and (ii) the nature and process for satisfactory audit evidence; and

·(d) the security and confidentiality controls applicable to any such audit. All audits must be conducted in accordance with recognized international auditing standards.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 9 of 30

10.510.5 Nothing in this Addendum will require Zoom to provide Personal Data of other Zoom customers or access to any Zoom systems or facilities that are not involved in the provision of the contracted Services.

1111. Cooperation

·Zoom shall provide Customer with all required assistance and cooperation in enforcing the obligations of the parties under Applicable Data Protection Law. To the extent that such assistance relates to the Processing of Customer Personal Data for the purpose of the performance of the Agreement, Zoom shall in any event provide Customer with such assistance relating to:

·(a) The security of Customer Personal Data;

·(b) Performing checks and audits;

·(c) Performing Data Protection Impact Assessments ("DPIA");

·(d) Prior consultation with the Supervisory Authority;

·(e) Responding to requests from the Supervisory Authority or another government body;

·(f) Responding to requests from Data Subjects;

·(g) Reporting Customer Personal Data Breaches.

1212. Security incidents and data breaches

12.112.1 In the event of a confirmed Personal Data Breach (at Zoom or at a subprocessor of Zoom), Zoom shall, without undue delay, inform Customer of the Personal Data Breach and take such steps as Zoom in its sole discretion deems necessary and reasonable to remediate such violation. In the event of such a Personal Data Breach, Zoom shall, taking into account the nature of the Processing and the information available to Zoom, provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its obligations under Applicable Data Protection Law with respect to notifying (I) the relevant Supervisory Authority and/or (ii) Data Subjects affected by such Personal Data Breach without undue delay.

12.212.2 In the event of a large scale, as determined by Zoom, confirmed Personal Data Breach (with Zoom or an Authorized Subprocessor of Zoom), Customer allows Zoom to independently alert and consult the relevant Supervisory Authorities in order to better inform Customer what steps the Supervisory Authorities expect.

12.312.3 The obligations described in Sections 12.1 and 12.2 shall not apply if a Personal Data Breach results from the actions or omissions of Customer, except where required by Applicable Data Protection Law. Zoom's obligation to report or respond to a Personal Data Breach under Sections 12.1 and 12.2 will not be construed as an acknowledgement by Zoom of any fault or liability with respect to the Personal Data Breach.

1313. US State Law Privacy Exhibit

13.113.1 To the extent that Customer (i) is a "business" and Zoom processes "personal information" (as those terms are defined by the CCPA) on Customer's behalf, or (ii) is a "controller" and Zoom processes "personal data" (as each of those terms are defined by the applicable Specific US State Data Protection Laws) on Customer's behalf, or (iii) meets both criteria set out in (i) and (ii), then the Zoom US State Law Privacy Exhibit, attached hereto as EXHIBIT C to this Addendum, shall apply to Zoom's "processing" of Customer's "personal information" and "personal data" (as each of those terms are defined under the applicable Specific US State Data Protection Laws).

13.213.2 In the event of a conflict between EXHIBIT C and any other parts of this Addendum with respect to Zoom's "processing" of "personal information" and "personal data" (as each of those terms are defined under the Specific US State Data Protection Laws), the terms of EXHIBIT C control and govern over other parts of this Addendum with respect to the parties' obligations under the applicable Specific US State Data Protection Laws.

1414. General

14.114.1 This Addendum may be executed in counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 10 of 30

14.214.2 Customer and Zoom acknowledge that the other party may disclose the Standard Contractual Clauses, this Addendum, and any privacy-related provisions in the Agreement to any Supervisory Authority upon request.

14.314.3 Except for the changes made by this Addendum, the Agreement remains unchanged and in full force and effect. If there is any conflict between this Addendum and the Agreement, an Order Form, or any other documentation, with regard to the subject matter of this Addendum, this Addendum shall prevail to the extent of that conflict.

14.414.4 If there is a change in (i) Specific US State Data Protection Law, (ii) Applicable Data Protection Law, or (iii) a determination, decision, or order by a Supervisory Authority or competent court affecting this Addendum or the lawfulness of any Processing activities under this Addendum, then Zoom may propose supplements and modifications to this Addendum. If the Customer objects to the supplement or modification, then Customer must object to the supplement or modification within thirty (30) days or the right to object is waived. If Customer timely objects to the appropriateness of the supplement or modification, then the parties will work to resolve their differences, and if resolution cannot occur within thirty (30) days of Customer's notice of objection, then either party may terminate this Addendum and any affected portion(s) of the Agreement. All supplements and modifications will be in writing and signed by the parties, unless the terms of the Agreement provide otherwise.

14.514.5 The provisions of this Addendum are severable. If any phrase, clause or provision or Exhibit (including the Standard Contractual Clauses) is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of this Addendum or the remainder of the Exhibit, shall remain in full force and effect.

14.614.6 This Addendum shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Law.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 11 of 30 [counterpartyName_S0daohE] "Customer" Signature: [counterpartySignerSignature_6OqpxaU] Zoom Communications, Inc.

·"Zoom" Signature:

·Print Name: [counterpartySignerName_qMLdNJ3] Print Name: Deborah Fay Title: [counterpartySignerTextField_AVVnayg||1] Title: Deputy General Counsel Date: [counterpartySignerDateField_Q4koP0x] Customer Address:

·[counterpartyAddress_70IyVTZ] Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 12 of 30

Exhibit AEXHIBIT A

Annex IAnnex I: Description of the Processing/Transfer Controller to Controller (A) List of Parties:

·Data Exporter Data Importer

·Name: [counterpartyName_Qinr0PQ] Name:

·Zoom Communications, Inc.

·Address: [counterpartyAddress_DDSVz9v] Address:

·55 Almaden Blvd. Suite 600, San Jose, CA 95113, USA Contact Person's Name, position and contact details:

·Name: [counterpartySignerTextField_vlzyH0b||5] Position: [counterpartySignerTextField_wMx5gRH||6] Email: [counterpartySignerTextField_wMx5gRH||7] Contact Person's Name, position and contact details:

·Name: Deborah Fay Position: Data Protection Officer Address: Address:

·55 Alma 55 Almaden Blvd. Suite 600, San Jose, CA 95113, USA With a copy to e-mail: privacy@zoom.us Activities relevant to the transfer:

·As described in Section (B) below Activities relevant to the transfer:

·As described in Section (B) below Role: Controller Role: Controller (B) Description of Transfer Categories Data Subjects The personal data transferred concern the following categories of data subjects:

·End Users

·Purposes of the transfer(s) The transfer is made for the following purposes: In accordance with Section 2.4 of this Addendum, Zoom may Process certain Customer Personal Data for its own Legitimate Business Purposes, as an independent Controller, solely when the Processing is strictly necessary and proportionate, and if the Processing is for one of the following exhaustive list of purposes:

·(a) Directly identifiable data (name, screen name, profile picture and email address and all Customer Personal Data directly connected to such directly identifiable data) may be Processed for:

·(i) billing, account, and Customer relationship management (marketing communications to procurement, sales, and other Customer personnel that requests such communication), and related Customer correspondence (mailings about for example necessary updates);

·(ii) complying with and resolving legal obligations, including responding to Data Subject Requests for Personal Data processed by Zoom as data Controller (for example website data), tax requirements, agreements and disputes;

·(iii) abuse detection, prevention, and protection (such as automatic scanning for matches with identifiers of known CSAM, virus scanning and Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 13 of 30 scanning to detect violations of terms of service (such as copyright infringement, SPAM, and actions not permitted under Zoom ́s Acceptable Use Guidelines;

·(b) Pseudonymized and/or aggregated data (Zoom will pseudonymise and/or aggregate as much as possible and pseudonymized and/or aggregated data will not be processed on a per-Customer level), for:

·(i) improving and optimizing the performance and core functionalities of accessibility, privacy, security, and the IT infrastructure efficiency of the Services, including zoom.us, explore.zoom.us, and support.zoom.us;

·(ii) internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy); and

·(iii) receiving and using Feedback for Zoom's overall service improvement.

·Categories of Personal Data

·The personal data transferred concern the following categories of data:

·Customer Content Data:

·Zoom Account Profile Info: Data associated with the End User account, profile picture, password, company name, and preferences. This includes: • Zoom unique user ID,

·• profile picture (optional) Diagnostic Data:

·Meeting metadata: Metrics about Service usage, including when and how meetings were conducted). This includes:

·• event logs (including action taken, event type and subtype, in-app event location, timestamp, client UUID, user ID, and meeting ID)

·• meeting session information, including frequency, average and actual duration, quantity, quality, network activity, and network connectivity • number of meetings

·• number of screen-sharing and non-screen-sharing sessions • number of participants • meeting host information • host name • meeting site URL • meeting start/end Time • join method

·• performance, troubleshooting and diagnostics information Telemetry data: Data collected from locally installed software (applications and browser information about the deployment of Zoom Services and related systems environment / technical information. This includes: • PC name • microphone • speaker

·• camera Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 14 of 30 • domain • hard disc ID • network type • operating system type and version • client version • MAC address

·• event logs (including action taken, event type and subtype, in-app event location, timestamp, client UUID, • user ID and meeting ID)

·• service logs (information on systems events and states) Other Service Generated Data: • spam identification • push notifications

·• Zoom persistent unique identifiers such as UUID or user ids that are combined with other data elements including: • IP address • Data center • PC name • Microphone • Speaker • Camera • Domain • Hard disc ID • Network type • Operating System Type and Version • Client Version

·• IP Addresses along the Network Path Support Data:

·• problem description, post-meeting feedback Frequency of the transfer Whether continuous or one-off. The transfer of account information is one off, otherwise continuous when using the Service.

·Special categories of personal data (if appropriate) The personal data transferred concern the following categories of sensitive data:

·Not applicable if end to end encryption is enabled, and if End Users do not upload profile pictures revealing special categories of data.

·Duration of processing: In accordance with the retention period detailed below.

·Nature and Subject Matter of the Processing: Zoom will process Customer Personal Data for its own exhaustive list of Legitimate Business Purposes when strictly necessary and proportionate, in accordance with this Addendum.

·Retention period (or, if not possible to determine, the criteria used to determine that period):

·Zoom retains Customer Personal Data for as long as required for its own exhaustive list of Legitimate Business Purposes, in accordance with this Addendum.

·The criteria used to determine Zoom's retention periods include the following:

·• The length of time of Zoom's relationship with Service users (for example, the duration of a Zoom account)

·• Whether account owners modify or their users delete information through their accounts Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 15 of 30

·• Whether Zoom has a legal obligation to keep the data (for example, certain laws require Zoom to keep records for a certain period of time)

·• Whether retention is required by Zoom's legal position (such as in regard to the enforcement of agreements, the resolution of disputes, and applicable statutes of limitations, litigation, or regulatory investigation).

·(C): Competent supervisory authority The competent supervisory authority, in accordance with Clause 13 of the EU SCCs, must be (i) the supervisory authority applicable to the data exporter in its EEA country of establishment or, (ii) where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or (iii) where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the data subjects relevant to the transfer are located. With respect to Personal Data to which the UK GDPR applies, the competent supervisory authority is the Information Commissioner's Office (the "ICO"). With respect to Personal Data to which the Swiss DPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

·Controller to Processor

·(A) List of Parties:

·Data Exporter Data Importer

·Name:

·[counterpartyName_gdiOjpp] Name:

·Zoom Communications, Inc.

·Address:

·[counterpartyAddress_Df6pHaV] Address:

·55 Almaden Blvd. Suite 600, San Jose, CA 95113, USA Contact Person's Name, position and contact details:

·Name: [counterpartySignerTextField_ZAKilWZ||4] Position: [counterpartySignerTextField_3kLcyVy||3] Email: [counterpartySignerTextField_3kLcyVy||8] Contact Person's Name, position and contact details:

·Name: Deborah Fay Position: Data Protection Officer Address: Address:

·55 Alma. 55 Almaden Blvd. Suite 600, San Jose, CA 95113, USA With a copy to e-mail: privacy@zoom.us Activities relevant to the transfer:

·As described in Section (B) below Activities relevant to the transfer:

·As described in Section (B) below Role: Controller Role: Processor (B) Description of Transfer Categories Data Subjects The personal data transferred concern the following categories of data subjects:

·Individuals about whom Personal Data is provided to Zoom via the Services by (or at the direction of) Customer or End Users, which may include without limitation Customer's or its Affiliates' employees, contractors, and End Users.

·Purposes of the transfer(s) The transfer is made for the following purposes: In accordance with Section 2.2 of the DPA, Zoom will only to the extent necessary and proportionate, Customer as Controller instructs Zoom to perform the following activities as Processor on behalf of Customer:

·• Provide and update the Services as configured, and used by Customer and its users, (for example, through Customer's use of Zoom settings or administrator controls) including to make ongoing product Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 16 of 30 improvements and provide personalised experiences and recommendations;

·• Secure and real-time monitor the Services;

·• Resolve issues, bugs, and errors;

·• Provide Customer requested support, including applying knowledge gained from individual customer support requests to benefit all Zoom customers but only to the extent such knowledge is anonymized; and

·• Process Customer Personal Data as set out in the Agreement and this Annex I to the Standard Contractual Clauses (subject matter, nature, purpose, and duration of Personal Data Processing in the controller to processor capacity and any other documented instruction provided by Customer and acknowledged by Zoom as constituting instructions for purposes of this Addendum.

·Categories of Personal Data

·The personal data transferred concern the following categories of data:

·Customer Content Data:

·Zoom Account Profile Info: Data associated with the End User's Zoom account, profile picture, password, company name, and Customer's preferences. This includes: • Zoom unique user ID, • social media login (optional), • profile picture (optional) and

·• display name.

·Customer authentication data: This includes username and password unless Single Sign On (SSO) is used.

·Meeting and webinar communication content. This includes:

·• video, audio, whiteboard, captions, and presentations

·• in-meeting Questions Answers, polls, and survey information

·• closed captioning (Live Transcription) Chat Messages. 1:1 in-meeting and group chat messages that are not transferred to a permanent chat channel.

·Customer Initiated cloud recordings. This includes the following recordings if such recording is permitted by the Customer administrator controls and selected by a meeting host or participant:

·• video recording of video, audio, whiteboard, captions, and presentations • audio recording

·• text file of all in meeting group chats • audio transcript text file

·• in-meeting Questions Answers, polls, and survey information

·• closed captioning transcripts Meeting and webinar participant information. This includes:

·• registered participant name and contact details; and any data requested by Customer to be provided in conjunction with registration, email addresses

·• status of participant (as host, as participants in a chat or as attendees) • room names (if used) • user categorizations

·• tracking fields such as department or group

·• scheduled time for a meeting Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 17 of 30

·• topic names Stored Chat Information. This is data at rest (in storage) and includes: • chat messages • files exchanged via chat • images exchanged via chat • videos exchanged via chat • chat channel title

·• whiteboard annotations Address book Information. This includes contact information made available through Customer controlled integrations (e.g. Outlook) Calendar Information. This includes meeting schedules made available through Customer controlled integrations (e.g. Outlook, Google Calendar) Diagnostic Data:

·Meeting metadata: Metrics about Service usage, including when and how meetings were conducted). This category includes:

·• event logs (including: action taken, event type and subtype, in-app event location, timestamp, client UUID, user ID, and meeting ID)

·• meeting session information, including frequency, average and actual duration, quantity, quality, network activity, and network connectivity • number of meetings

·• number of screen-sharing and non screen-sharing sessions • number of participants • meeting host information • host name • meeting site URL • meeting start/end Time

·• join method Telemetry data: Data collected from locally installed software (applications and browser information about the deployment of Zoom Services and related systems environment / technical information. This includes: • PC name • microphone • speaker • camera • domain • hard disc ID • network type • operating system type and version • client version • MAC address

·• event logs (including action taken, event type and subtype, in-app event location, timestamp, client UUID, user ID and meeting ID)

·• service logs (information on systems events and states) Other Service Generated Data:

·• spam identification Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 18 of 30 • push notifications

·• Zoom persistent unique identifiers such as UUID or user ids that are combined with other data elements including: • IP address • Data center • PC name • Microphone • Speaker • Camera • Domain • Hard disc ID • Network type • Operating System Type and Version • Client Version

·• IP Addresses along the Network Path Support Data:

·• Contact name of support requestor, time, subject, problem description, post-meeting feedback (thumbs- up/down)

·• User supplied attachments including recordings, transcripts or screenshots, post-meeting feedback (open text provided with thumbs down) Frequency of the transfer Whether continuous of one off. Continuous Special categories of personal data (if appropriate) The personal data transferred concern the following categories of sensitive data:

·Special categories of data are not required to use the service.

·The Customer / data exporter can prevent the processing of these data by using end to end encryption in the Meetings and preventing End Users from uploading profile information that contains such special categories of data. Such special categories of data include, but may not be limited to, Personal Data with information revealing racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, and the processing of data concerning an individual's health or sex life.

·Duration of processing: The term of the Agreement plus the period until Zoom deletes all Customer Personal Data processed on behalf of Customer in accordance with the Agreement.

·Nature and Subject Matter of the Processing: Zoom will process Customer Personal Data for the purposes of providing the Services to Customer in accordance with this Addendum.

·Retention period (or, if not possible to determine, the criteria used to determine that period):

·Zoom retains Customer Personal Data for as long as required for its own exhaustive list of Legitimate Business Purposes, in accordance with this Addendum. The criteria used to determine Zoom's retention periods include the following:

·• The length of time of Zoom's relationship with Service users (for example, the duration of a Zoom account)

·• Whether account owners modify or their users delete information through their accounts

·• Whether Zoom has a legal obligation to keep the data (for example, certain laws require Zoom to keep records for a certain period of time) Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 19 of 30

·• Whether retention is required by Zoom's legal position (such as in regard to the enforcement of agreements, the resolution of disputes, and applicable statutes of limitations, litigation, or regulatory investigation).

·(C) Competent supervisory authority The competent supervisory authority, in accordance with Clause 13 of the EU SCCs, must be (i) the supervisory authority applicable to the data exporter in its EEA country of establishment or, (ii) where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or (iii) where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the data subjects relevant to the transfer are located. With respect to Personal Data to which the UK GDPR applies, the competent supervisory authority is ICO. With respect to Personal Data to which the Swiss DPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 20 of 30

Exhibit BEXHIBIT B

·Technical and Organizational Security Measures

·Zoom's technical and organizational security measures for Processing Customer Personal Data will meet the Minimum-Security Control Requirements set out in this EXHIBIT B ("Security Measures"). Customer recognizes that there may be multiple acceptable approaches to accomplish a particular minimum control requirement. Zoom must document in reasonable detail how a particular control meets the stated minimum control requirement. Zoom may revise the Security Measures from time to time. The term "should" in these Security Measures means that Zoom will use commercially reasonable efforts to accomplish the stated minimum control requirement and will document those efforts in reasonable detail, including the rationale, if any, for deviation.

·As used in these Security Measures, (i) "including" and its derivatives mean "including but not limited to"; and (ii) any capitalized terms not defined in this EXHIBIT B shall have the same meaning as set forth in this Addendum.

11. Definitions

1.11.1 "Systems" means Zoom's production systems.

1.21.2 "Assets" means Zoom's production assets.

1.31.3 "Facilities" means Zoom's production facilities, whether owned or leased by Zoom (e.g., AWS, data centers).

22. Risk Management

2.12.1 Risk Assessment Program. The effectiveness of controls must be regularly validated through a documented risk assessment program and appropriately managed remediation efforts.

2.22.2 Risk Assessment. A risk assessment must be performed annually to verify the implementation of controls that protect business operations and Customer Content.

33. Security Policy

3.13.1 A documented set of rules and procedures must regulate the Processing of information and associated services.

3.23.2 Security Policies and Exception Process. Security policies must be documented, reviewed, and approved, with management oversight, on a periodic basis, following industry best practices.

3.33.3 A risk-based exception management process must be in place for prioritization, approval, and remediation or risk acceptance of controls that have not been adopted or implemented.

3.43.4 Awareness and Education Program. Security policies and responsibilities must be communicated and socialized within the organization to Zoom personnel. Zoom personnel must receive security awareness training on an annual basis.

44. Organizational Security

4.14.1 A personnel security policy must be in place to establish organizational requirements to ensure proper training, competent performance, and an appropriate and accountable security organization.

4.24.2 Organization. Current organizational charts representing key management responsibilities for services provided must be maintained.

4.34.3 Background Checks. Where legally permissible, background checks (including criminal) must be performed on applicable Zoom personnel.

4.44.4 Confidentiality Agreements. Zoom personnel must be subject to written non-disclosure or confidentiality obligations.

55. Technology Asset Management

5.15.1 Controls must be in place to protect Zoom production assets, including mechanisms to maintain an accurate inventory of assets and handling standards for introduction and transfer, removal and disposal of assets.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 21 of 30

5.25.2 Accountability. A process for maintaining an inventory of hardware and software assets and other information resources, such as databases and file structures, must be documented. Process for periodic asset inventory reviews must be documented. Identification of unauthorized or unsupported hardware/software must be performed.

5.35.3 Asset Disposal or Reuse. If applicable, Zoom will use industry standards to wipe or carry out physical destruction as the minimum standard for disposing of assets. Zoom must have documented procedures for disposal or reuse of assets.

5.45.4 Procedures must be in place to remove data from production systems in which Customer's Personal Data are stored, processed, or transmitted.

66. Physical and Environmental

6.16.1 Controls must be in place to protect systems against physical penetration by malicious or unauthorized people, damage from environmental contaminants and electronic penetration through active or passive electronic emissions.

6.26.2 Physical and Environmental Security Policy. Physical and environmental security plans must exist for facilities and scenarios involving access or storage of Customer's Personal Data. Additional physical and environmental controls must be required and enforced for applicable facilities, including servers and datacenter locations.

6.36.3 Physical Access. Physical access, to include visitor access to facilities, must be restricted and all access periodically reviewed.

6.46.4 Policies must be in place to ensure that information is accessed on a need-to-know basis.

6.56.5 Environmental Control. Facilities, including data and processing centers, must maintain appropriate environmental controls, including fire detection and suppression, climate control and monitoring, power and back-up power solutions, and water damage detection. Environmental control components must be monitored and periodically tested.

77. Communication and Connectivity

7.17.1 Zoom must implement controls over its communication network to safeguard data. Controls must include securing the production network and implementation of encryption, logging and monitoring, and disabling communications where no business need exists.

7.27.2 Network Identification. A production network diagram, to include production devices, must be kept current to facilitate analysis and incident response.

7.37.3 Data Flow Diagram. A current data flow diagram must depict data from origination to endpoint (including data which may be shared with subprocessors).

7.47.4 Data Storage. All of Customer's Personal Data, including Customer's Personal Data shared with subprocessors, must be stored and maintained in a manner that allows for its return or secure destruction upon request from Customer.

7.57.5 Firewalls. Firewalls must be used for the isolation of all environments, to include physical, virtual, network devices, production and non-production, and application/presentation layers. Firewall management must follow a process that includes restriction of administrative access, and that is documented, reviewed, and approved, with management oversight, on a periodic basis.

7.67.6 The production network must be either firewalled or physically isolated from the development and test environments.

·Multi-tier security architectures that segment application tiers (e.g., presentation layer, application and data) must be used.

7.77.7 Periodic network vulnerability scans must be performed, and any critical vulnerabilities identified must be remediated within a defined and reasonable timeframe.

7.87.8 Clock Synchronization. Production network devices must have internal clocks synchronized to reliable time sources.

7.97.9 Remote Access. The data flow in the remote connection must be encrypted and multi-factor authentication must be utilized during the login process.

7.107.10 Remote connection settings must limit the ability of remote users to access both initiating network and remote network simultaneously (i.e., no split tunneling).

7.117.11 Subprocessors' remote access, if any, must adhere to the same controls and must have a valid business justification.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 22 of 30

7.127.12 Wireless Access. Wireless access to the Zoom corporate network must be configured to require authentication and be encrypted.

88. Change Management

8.18.1 Changes to the production systems, production network, applications, data files structures, other system components, and physical/environmental changes must be monitored and controlled through a formal change control process. Changes must be reviewed, approved, and monitored during post implementation to ensure that expected changes and their desired result are accurate.

8.28.2 Change Policy and Procedure. A change management policy, including application, operating system, network infrastructure, and firewall changes must be documented, reviewed, and approved, with management oversight, on a periodic basis.

8.38.3 The change management policy must include clearly identified roles and responsibilities so as to support separation of duties (e.g., request, approve, implement). The approval process must include pre- and post-evaluation of change. Zoom posts service status and scheduled maintenance at https://status.zoom.us.

99. Operations

9.19.1 Documented operational procedures must ensure the correct and secure operation of Zoom's assets. Operational procedures must be documented and include monitoring of capacity, performance, service level agreements and key performance indicators.

1010. Access Control

10.110.1 Authentication and authorization controls must be appropriately robust for the risk of the system, data, application, and platform; access rights must be granted based on the principle of least privilege and monitored to log access and security events, using tools that enable rapid analysis of user activities.

10.210.2 Logical Access Control Policy. Documented logical access policies and procedures must support role-based, "need-to- know" access (e.g., interdepartmental transfers, terminations) and ensure separation of duties during the approval and provisioning process. Each account provisioned must be uniquely identified. User access reviews must be conducted on a periodic basis.

10.310.3 Privileged Access. Management of privileged user accounts (e.g., those accounts that have the ability to override system controls), to include service accounts, must follow a documented process and be restricted. A periodic review and governance process must be maintained to ensure appropriate provisioning of privileged access.

10.410.4 Authentication and Authorization. A documented authentication and authorization policy must cover all applicable systems. That policy must include password provisioning requirements, password complexity requirements, password resets, thresholds for lockout attempts, thresholds for inactivity, and assurance that no shared accounts are utilized.

·Authentication credentials must be encrypted, including in transit to and from subprocessors' environments or when stored by subprocessors.

1111. Data Integrity

11.111.1 Controls must ensure that any data stored, received, controlled, or otherwise accessed is accurate and reliable. Procedures must be in place to validate data integrity.

11.211.2 Data Transmission Controls. Processes, procedures, and controls must be documented, reviewed, and approved, with management oversight, on a periodic basis, to ensure data integrity during transmission and to validate that the data transmitted is the same as data received.

11.311.3 Data Transaction Controls. Controls must be in place to protect the integrity of data transactions at rest and in transit.

11.411.4 Encryption. Data must be protected and should be encrypted, both in transit and at rest, including when shared with subprocessors.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 23 of 30

11.511.5 Data Policies. A policy must be in place to cover data classifications, encryption use, key and certificate lifecycle management, cryptographic algorithms and associated key lengths. This policy must be documented, reviewed, and approved with management oversight, on a periodic basis.

11.611.6 Encryption Uses. Customer Personal Data must be protected, and should be encrypted, while in transit and at rest.

·Customer Content must be protected, and should be encrypted when stored and while in transit over any network;

·authentication credentials must be encrypted at all times, in transit or in storage.

1212. Incident Response

12.112.1 A documented plan and associated procedures, to include the responsibilities of Zoom personnel and identification of parties to be notified in case of an information security incident, must be in place.

12.212.2 Incident Response Process. The information security incident management program must be documented, tested, updated as needed, reviewed, and approved, with management oversight, on a periodic basis. The incident management policy and procedures must include prioritization, roles and responsibilities, procedures for escalation (internal) and notification, tracking and reporting, containment and remediation, and preservation of data to maintain forensic integrity.

1313. Business Continuity and Disaster Recovery

13.113.1 Zoom must have formal documented recovery plans to identify the resources and specify actions required to help minimize losses in the event of a disruption to the business unit, support group unit, application, or infrastructure component. Plans assure timely and orderly recovery of business, support processes, operations, and technology components within an agreed upon time frame and include orderly restoration of business activities when the primary work environment is unavailable.

13.213.2 Business Recovery Plans. Comprehensive business resiliency plans addressing business interruptions of key resources supporting services, including those provided by subprocessors, must be documented, tested, reviewed, and approved, with management oversight, on a periodic basis. The business resiliency plan must have an acceptable alternative work location in place to ensure service level commitments are met.

13.313.3 Technology Recovery. Technology recovery plans to minimize service interruptions and ensure recovery of systems, infrastructure, databases, applications, etc. Must be documented, tested, reviewed, and approved with management oversight, on a periodic basis.

1414. Back-ups

14.114.1 Zoom must have policies and procedures for back-ups of Customer's Personal Data. Backups must be protected using industry best practices.

14.214.2 Back-up and Redundancy Processes. Processes enabling full restoration of production systems, applications, and data must be documented, reviewed, and approved, with management oversight, on a periodic basis.

1515. Third-Party Relationships

15.115.1 Subprocessors must be identified, assessed, managed, and monitored. Subprocessors that provide material services, or that support Zoom's provision of material services to Customers, must comply with control requirements no less stringent than those outlined in this document.

15.215.2 Selection and Oversight. Zoom must have a process to identify subprocessors providing services to Zoom; these subprocessors must be disclosed to Customer and approved to the extent required by this Agreement.

15.315.3 Lifecycle Management. Zoom must establish contracts with subprocessors providing material services; these contracts should incorporate security control requirements, including data protection controls and notification of security and privacy breaches must be included. Review processes must be in place to ensure subprocessors' fulfillment of contract terms and conditions.

1616. Standard Builds

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 24 of 30

16.116.1 Production systems must be deployed with appropriate security configurations and reviewed periodically for compliance with Zoom's security policies and standards.

16.216.2 Secure Configuration Availability. Standard security configurations must be established and security hardening demonstrated. Process documentation must be developed, maintained, and under revision control, with management oversight, on a periodic basis. Configurations must include security patches, vulnerability management, default passwords, registry settings, file directory rights and permissions.

16.316.3 System Patches. Security patch process and procedures, to include requirements for timely patch application, must be documented.

16.416.4 Operating System. Versions of operating systems in use must be supported and respective security baselines documented.

16.516.5 Desktop Controls. Systems must be configured to provide only essential capabilities. The ability to write to removable media must be limited to documented exceptions.

1717. Application Security

17.117.1 Zoom must have an established software development lifecycle for the purpose of defining, acquiring, developing, enhancing, modifying, testing, or implementing information systems. Zoom must ensure that web-based and mobile applications used to store, receive, send, control, or access Customer Personal Data are monitored, controlled, and protected.

17.217.2 Functional Requirements. Applications must implement controls that protect against known vulnerabilities and threats, including Open Web Application Security Project ("OWASP") Top 10 Risks and denial of service (DDOS) attacks.

17.317.3 Application layer controls must provide the ability to filter the source of malicious traffic.

17.417.4 Restrictions must also be placed on or in front of web server resources to limit denial of service (DoS) attacks.

17.517.5 Zoom must monitor uptime on a hosted web or mobile application.

17.617.6 Software Development Life Cycle. A Software Development Life Cycle (SDLC) methodology, including release management procedures, must be documented, reviewed, approved, and version-controlled, with management oversight, on a periodic basis. These must include activities that foster the development of secure software.

17.717.7 Testing and Remediation. Software executables related to client/server architecture that are involved in handling Customer Personal Data must undergo vulnerability assessments (both the client and server components) prior to release and on an on-going basis, either internally or using external experts, and any gaps identified must be remediated in a timely manner.

·(c) Testing must be based on, at a minimum, the OWASP Top 10 risks (or the OWASP Mobile Top 10 risks, where applicable), or comparable replacement.

·(d) Zoom must conduct penetration testing on an annual basis.

1818. Vulnerability Monitoring

18.118.1 Zoom must continuously gather information and analyse vulnerabilities in light of existing and emerging threats and actual attacks. Processes must include vulnerability scans, anti-malware, Intrusion Detection Systems ("IDS")/Intrusion Prevention Systems (IPS), logging and security information and event management analysis and correlation.

18.218.2 Vulnerability Scanning and Issue Resolution. Vulnerability scans (authenticated and unauthenticated) and penetration tests must be performed against internal and external networks and applications periodically and prior to system provisioning for production systems that process, store or transmit Customer Content.

18.318.3 Malware. In production, Zoom must employ tools to detect, log, and disposition malware.

18.418.4 Intrusion Detection/Advanced Threat Protection. Network and host-based intrusion detection/advanced threat protection must be deployed with events generated fed into centralized systems for analysis. These systems must accommodate routine updates and real-time alerting. IDS/advanced threat protection signatures must be kept up to date to respond to threats.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 25 of 30

18.518.5 Logging and Event Correlation. Monitoring and logging must support the centralization of security events for analysis and correlation. Organizational responsibility for responding to events must be defined. Retention schedule for various logs must be defined and followed.

18.618.6 Zoom publishes a vulnerability disclosure policy at https://explore.zoom.us/en/trust/vulnerability-disclosure/ .

1919. Cloud Technology

19.119.1 Adequate safeguards must ensure the confidentiality, integrity, and availability of Customer Personal Data stored, processed or transmitted using cloud technology (either as a cloud customer or cloud provider, to include subprocessors), using industry standards.

19.219.2 Audit Assurance and Compliance. The cloud environment in which data is stored, processed or transmitted must be compliant with relevant industry standards and regulatory restrictions.

19.319.3 Application and Interface Security. Threat modeling should be conducted throughout the software development lifecycle, including vulnerability assessments, including Static/Dynamic scanning and code review, to identify defects and complete remediations before hosting in cloud environments.

19.419.4 Business Continuity Management and Operational Resiliency. Business continuity plans to meet recovery time objectives (RTO) and recovery point objectives (RPO) must be in place.

19.519.5 Data Security and Information Lifecycle Management. Proper segmentation of data environments and segregation must be employed; segmentation/segregation must enable proper sanitization, per industry requirements.

19.619.6 Encryption and Key Management. All communications must be encrypted in-transit between environments.

19.719.7 Governance and Risk Management. Comprehensive risk assessment processes and centralized monitoring that enables incident response and forensic investigation must be used to ensure proper governance and oversight.

19.819.8 Identity and Access Management. Management of accounts, including accounts with privileged access, must prevent unauthorized access and mitigate the impacts thereof.

19.919.9 Infrastructure and Virtualization Security. Controls defending against cyberattacks, including the principle of least privilege, baseline management, intrusion detection, host/network-based firewalls, segmentation, isolation, perimeter security, access management, detailed data flow information, network, time, and a SIEM solution must be implemented.

19.1019.10 Supply Chain Management, Transparency and Accountability. Zoom must be accountable for the confidentiality, availability and integrity of production data, to include data processed in cloud environments by subprocessors.

19.1119.11 Threat and Vulnerability Management. Vulnerability scans (authenticated and unauthenticated) must be performed, both internally and externally, for production systems. Processes must be in place to ensure tracking and remediation.

2020. Audits

20.120.1 At least annually, Zoom will conduct an independent third-party review of its security policies, standards, operations, and procedures related to the Services provided to Customer. Such review will be conducted in accordance with the AICPA's Statements on Standards for Attestation Engagements (SSAE), and Zoom will be issued a SOC 2 Type II report. Upon Customer's request, Zoom will provide Customer with a copy of the SOC 2 Type II report within thirty (30) days. If applicable, Zoom will provide a bridge letter to cover time frames not covered by the SOC 2 Type II audit period scope within 30 days, upon request by Customer. If exceptions are noted in the SOC 2 Type II audit, Zoom will document a plan to promptly address such exceptions and shall implement corrective measures within a reasonable and specific period.

·Upon Customer's reasonable request, Zoom will keep Customer informed of progress and completion of corrective measures.

20.220.2 Customer shall rely on the third-party audit SOC 2 Type II report for validation of proper information security practices and shall not have the right to audit, unless such right is granted under applicable law, except in the case of a Security Breach resulting in a material business impact to Customer. If Customer exercises the right to audit as a result of a Security Breach, such audit shall be within the scope of the Services. Customer will provide Zoom a minimum of thirty (30) days of notice prior to the audit. Zoom shall have the right to approve any third-party Customer may choose to conduct or be involved in the audit.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 26 of 30

2121. Specific Measures

·Measure Description

·Measures of pseudonymisation and encryption of personal data Optional End-to-End Encryption for Meetings: Users may choose to enable end-to-end encryption for Zoom meetings. This provides a high level of security since no third party - including Zoom - has access to the meeting's private keys.

·Default Encryption: The connection between a given device and Zoom is encrypted by default, using a mixture of TES 1.2+ (Transport Layer Security), Advanced Encryption Standard (AES) 256-bit encryption, and SRTP (Secure Real-time Transport Protocol). The precise methods used depend on whether a user uses the Zoom client, a web browser, a third-party device or service, or the Zoom phone product. For further information, please see our Encryption Whitepaper Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services Zoom utilizes security measures to ensure the ongoing confidentiality, integrity, availability, and resilience of our processing systems and services.

·Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident Zoom takes measures to facilitate the restoration of availability and access to our processing systems and services promptly in the event of a physical or technical incident.

·Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing Zoom implements a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures to ensure the security of the data we process.

·Measures for user identification and authorisation Protections against unauthorised meeting participants: Zoom has implemented numerous safeguards and controls to prohibit unauthorized participants from joining meetings: • Eleven (11) digit unique meeting IDs • Complex passwords

·• Waiting rooms with the ability to automatically admit participants from your domain name or another selected domai

·• Meeting lock feature that can prevent anyone from joining the meeting • Ability to remove participants

·• Authentication profiles that only allow entry to registered users, or restrict to specific email domains Measures for the protection of data during transmission Optional End-to-End Encryption for Meetings: Users may choose to enable end-to-end encryption for Zoom meetings. This provides a high level of security since no third party - including Zoom - has access to the meeting's private keys Default Encryption: The connection between a given device and Zoom is encrypted by default, using a mixture of TLS 1.2+ (Transport Layer Security), Advanced Encryption Standard (AES) 256-bit encryption, and SRTP (Secure Real-time Transport Protocol). The precise methods used depend on whether a user uses the Zoom client, a web browser, a third- party device or service, or the Zoom phone product. For further information, please see our Encryption Whitepaper.

·Measures for the protection of data during storage Cloud Recording Storage: Cloud Recordings are processed and stored in Zoom's cloud after the meeting has ended; these recordings can be passcode-protected or available only to people in your organization. If a meeting host enables cloud recording and audio transcripts, both will Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 27 of 30 be stored encrypted.

·File transfer storage: If a meeting host enables file transfer through in- meeting chat, those shared files will be stored encrypted and will be deleted within 31 days of the meeting.

·Cloud recording access: Recording access for a meeting is limited to the meeting host and account admin. The meeting/webinar host authorizes others to access the recording with options to share publicly, internal- only, add registration to view, enable/disable ability to download, and an option to protect the recording Authentication: Zoom offers a range of authentication methods such as SAML, Google Sign-in and Facebook Login, and/or Password based which can be individually enabled/disabled for an account.

·2-Factor Authentication ("2FA"): Admins can enable 2FA for your users, requiring them to set up and use 2FA to access the Zoom web portal.

·Measures for ensuring physical security of locations at which personal data are processed Controls are in place to protect systems against physical penetration by malicious or unauthorized people, damage from environmental contaminants and electronic penetration through active or passive electronic emissions.

·Measures for ensuring events logging Zoom implements a standard requiring all systems to log relevant security access events.

·Measures for ensuring system configuration, including default configuration Zoom implements a standard specifying the minimum requirements for configuration management as it applies to Zoom's corporate and commercial environment.

·Measures for internal IT and IT security governance and management Zoom implements policies and standards governing internal IT and IT security governance and management.

·Measures for certification/assurance of processes and products Zoom implements a Security Audit and Accountability policy.

·Measures for ensuring data minimisation Zoom implements a privacy review in its software development lifecycle to align product development with the principle of data minimization.

·Measures for ensuring data quality Zoom implements a System and Information Integrity Policy.

·Measures for ensuring limited data retention We retain personal data for as long as required to engage in the uses described in our Privacy Statement, unless a longer retention period is required by applicable law.

·The criteria used to determine our retention periods include the following

·• The length of time we have an ongoing customer relationship;

·• Whether account owners modify or their users delete information through their accounts;

·• Whether we have a legal obligation to keep the data (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or

·• Whether retention is advisable in light of our legal position (such as in regard to the enforcement of our agreements, the resolution of disputes, and applicable statutes of limitations, litigation, or regulatory investigation).

·Measures for ensuring accountability Zoom implements a Security Audit and Accountability policy.

·Measures for allowing data portability and ensuring erasure Zoom's paying customers can access their account data through their dashboard.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 28 of 30

Exhibit CEXHIBIT C

·US State Law Privacy Exhibit

·This US State Law Privacy Exhibit ("State Law Exhibit") supplements the terms of this Addendum to which it is attached and sets forth certain data privacy rights and obligations in connection with Specific US State Data Protection Laws. Capitalized terms used in this EXHIBIT C but not otherwise defined herein have the meaning ascribed to them in this Addendum or the Agreement.

·Section A - General Provisions. This Section A of the State Law Exhibit applies to Zoom's provision of and Customer's use of the Services to the extent that Customer is a Business or a Controller and Zoom Processes or is Processing Customer's Personal Information or Personal Data pursuant to CCPA or other Specific US State Data Protection Laws.

11. Definitions. As used throughout this State Law Exhibit, "Customer" means a Business or Controller that subscribes to Zoom Services. Capitalized terms used in this Section A, but not otherwise defined, have the meaning ascribed to them in Sections B 1. and C 1. below.

22. Audits and Assessments. Zoom will conduct third-party audits and assessments in accordance with Section 10.1 and 10.2 of this Addendum.

33. Restrictions on Receipt of Information. Nothing under this State Law Exhibit shall require Zoom to disclose: (a) any data or information of any other customer of Zoom, or any third party; (b) any internal accounting or financial information; (c) any trade secret of Zoom; or (d) any information that, in Zoom's reasonable opinion could: (i) compromise the security of Zoom's networks, systems, or premises; (ii) cause Zoom to breach its security or privacy obligations to any third party; or

·(iii) any information sought for any reason other than the reasons outlined in this State Law Exhibit. Zoom may require Customer's agreement to reasonable Zoom (or its third-party auditor or assessor's) terms and conditions prior to providing the Zoom Audit Report to Customer.

44. Deletion of Data. Zoom will (a) as required by Specific US State Data Protection Laws applicable to Customer and at Customer's direction, delete or return all Personal Data to the Customer at the end of the provision of Services or (b) as required by the CCPA, not retain, use, or disclose Personal Information upon termination or expiration of the relationship between the Customer and Zoom. Nothing in this Section A 4. will require Zoom to (i) delete or return data that it must retain pursuant to applicable Laws or (ii) return instead of destroying Personal Data to the extent that return is not technically feasible, or return would impose substantial burdens, costs, or both upon Zoom.

·Section B - California. This Section B of the State Law Exhibit applies to Zoom's provision of and Customer's use of the Services to the extent that Customer is a Business and Zoom is Processing Personal Information on Customer's behalf pursuant to CCPA.

11. Definitions. As used in this Section B of the State Law Exhibit: (a) "Business", "Business Purpose", "Commercial Purpose", "Consumer", "Processing", "Sell", "Service Provider" and "Share" have the respective meanings given in the CCPA; and (b) "Personal Information" means "personal information" as defined in the CCPA, but only to the extent the personal information is collected, accessed, obtained, received, used, disclosed, or otherwise processed by Zoom as a result of Zoom's provision of Services to Customer in its capacity as a Business under the Agreement.

22. Acknowledgments and Obligations. Zoom (a) acknowledges that Personal Information is disclosed by Customer only for the limited and specified purposes of providing the Services described in an Order Form and for the purposes described in the Agreement; (b) shall comply with obligations applicable to Service Providers under the CCPA and shall provide the same level of privacy protection to Personal Information as is required by the CCPA, including the same privacy protection required to be provided by Businesses; (c) agrees that Customer may take reasonable and appropriate steps consistent with Section A 2. of this State Law Exhibit to help to ensure that Zoom's use of Personal Information is consistent with Customer's obligations under the CCPA; (d) shall notify Customer promptly of any determination made by Zoom that it can no longer meet its obligations under the CCPA; and (e) agrees that Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information, consistent with and in accordance with Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 29 of 30 applicable regulations, by requesting reasonable documentation from Zoom that verifies Zoom no longer retains or uses Personal Information that is subject to a valid deletion request.

33. Restrictions. Zoom shall not (a) Sell or Share Personal Information; (b) retain, use, or disclose any Personal Information for any purpose other than for the purpose(s) described in Section B 2. (a) of this State Law Exhibit, or as otherwise permitted by the CCPA, including retaining, using, or disclosing Personal Information for a Commercial Purpose other than such purpose(s) or the servicing of a different Business; (c) retain, use or disclose Personal Information outside of the direct business relationship between Zoom and Customer, except to the extent permitted by CCPA; or (d) combine the Personal Information received pursuant to the Agreement with Personal Information received from another party, or Zoom's own interactions with the Consumer to whom the Personal Information pertains, except to the extent a Service Provider is permitted to do so under the CCPA. Zoom hereby certifies that it understands its obligations under this State Law Exhibit and will comply with them.

44. Audits, Reviews, and Assessments. Customer, subject to reasonable requirements and written agreements as required by Zoom and consistent with the CCPA, and at Customer's sole cost and expense, may audit, review, or assess Zoom not more than once every twelve (12) months, in accordance with Section A 2. of this State Law Exhibit.

55. Consumer Requests. Customer will promptly notify Zoom and provide all necessary information to Zoom after receiving and verifying a Consumer request, and Zoom shall promptly take such actions and provide such information as Customer may reasonably request pertaining to a Consumer's Personal Information in order to help Customer fulfill requests of individuals to exercise their rights under the CCPA, including, without limitation, requests to access, correct, delete, opt out of the Sale or Sharing of, or receive information about Personal Information pertaining to them. If Zoom receives any request directly from Customer's Consumer(s), then Zoom may either (i) advise the Consumer to contact Customer directly with such request or (ii) contact Customer to respond directly to the Consumer.

100Section C - Virginia, Colorado, Utah Other States. This Section C of the State Law Exhibit applies to Zoom's provision of and Customer's use of the Services to the extent that Customer is a Controller of Personal Data and Zoom Processes Customer's Personal Data under Specific US State Data Protection Laws.

11. Definitions. As used in this Section C of the State Law Exhibit: (a) "Controller", "Personal Data", "Process" and "Processor" shall have the respective meanings given to them in the Specific US State Data Protection Laws; and (b) "Instructions" has the meaning given below.

22. Processing of Personal Data: Roles, Scope, and Responsibility.

·a. For the purposes of this State Law Exhibit, the parties acknowledge and agree to the following: (i) Customer is the Controller of Customer Personal Data and (ii) Zoom is the Processor of Customer Personal Data.

·b. Only to the extent necessary and proportionate, Customer as Controller instructs Zoom to perform the activities as Processor on behalf of Customer in accordance with the Instructions set forth in Section 2.2 of this Addendum.

·c. To the extent that Zoom acts as a Processor of Customer Personal Data, Zoom shall Process Customer Personal Data only in accordance with Customer's Instructions. Customer shall ensure that its Instructions to Zoom comply with all Laws, rules, and regulations applicable to the Customer Personal Data, and that the Processing of Customer Personal Data per Customer's Instructions will not cause Zoom to be in breach of Specific US State Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of (i) the Customer Personal Data provided to Zoom by or on behalf of Customer; (ii) how Customer acquired any such Customer Personal Data; and (iii) the Instructions it provides to Zoom regarding the Processing of such Customer Personal Data.

·Zoom Communications, Inc.

·Global Data Processing Addendum

·Zoom Global Data Processing Addendum (November 2024) Page 30 of 30 Customer shall not provide or make available to Zoom any Customer Personal Data in violation of the Agreement, this Addendum, or this State Law Exhibit.

·d. Customer authorizes Zoom to conduct scanning and reporting of Personal Data in limited circumstances (e.g., to detect and report Child Sexual Abuse Material; to comply with other applicable Laws; to ensure compliance with Zoom's Acceptable Use Guidelines).

·e. With regard to Personal Data, the "EXHIBIT A Controller to Processor" portion of this Addendum further describes the nature and purposes of the Processing, the types of Personal Data to be Processed, and the duration of the Processing.

33. Authorized Persons. Zoom shall ensure that all persons authorized to Process Customer Personal Data are made aware of the confidential nature of Customer Personal Data and are subject to a duty of confidentiality with respect to the data.

44. Subcontractors and Subprocessors. To the extent that Zoom is a Processor, Customer hereby generally authorizes Zoom to engage subcontractors and subprocessors in accordance with this Section C 4.

·a. Customer approves Zoom's use of the providers located at https://explore.zoom.us/en/subprocessors/ to Process Customer's Personal Data.

·b. Zoom may remove, replace or appoint additional providers. Provided Customer subscribes to updates at https://explore.zoom.us/en/subprocessors/, Zoom shall notify Customer of any changes to these provider engagements. Where required by Specific US State Data Protection Laws, Zoom shall also provide an opportunity for Customer to object to the engagement in accordance with Sections C 4. (d) and C 4. (e) herein.

·c. In an emergency concerning availability or security of the Services, Zoom is not required to provide prior notification to Customer of the removal, replacement, or appointment of subcontractors, but shall provide notification within seven (7) business days following the change in a subcontractor.

·d. In either case, the Customer may object to such an engagement of a subcontractor in writing within fifteen (15) business days of receipt of the aforementioned notice by Zoom.

·e. If the Customer objects to the engagement of a new subcontractor, Zoom shall have the right to cure the objection through one of the following options (to be selected at Zoom's sole discretion):

·i. Zoom may cancel its plans to use the subcontractor with regard to Customer Personal Data.

·ii. Zoom may take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the subcontractor with regard to Customer Personal Data.

·iii. Zoom may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve the use of such a subcontractor with regard to Customer Personal Data. Zoom shall provide Customer with a written description of commercially reasonable alternative(s), if any, to such engagement, including without limitation modification to the Services. If Zoom, in its sole discretion, cannot provide any such alternative(s), or if Customer does not agree to any such alternative(s), if provided, Zoom and Customer may terminate the affected portion(s) of the Agreement with thirty (30) days prior written notice. Termination shall not relieve Customer of any fees or charges owed to Zoom for Services provided up to the effective date of the termination under the Agreement.

·iv. If Customer does not object to a new subcontractor's engagement within fifteen (15) business days of notice issuance from Zoom, that new subcontractor shall be deemed accepted.

·f. Zoom shall engage any subcontractor that Processes Customer's Personal Data only pursuant to a written contract and require the subcontractor to meet any obligations of Zoom that are subcontracted with respect to such Personal Data. Zoom remains liable to Customer where that subcontractor fails to fulfill its data protection obligations for the performance of that subcontractor's obligations to the same extent that Zoom would itself be liable under this State Law Exhibit had it conducted such acts or omissions.

55. Information Security. Taking into account the context of Processing, Zoom shall maintain appropriate technical and organizational measures with regard to Customer Personal Data to ensure a level of security appropriate to the risk in accordance with this State Law Exhibit and as otherwise expressly stated in the Agreement.

66. Compliance Information. Upon the reasonable request of Customer, Zoom shall make available to Customer reasonable information, consistent with and in accordance with applicable Laws, in Zoom's possession necessary to demonstrate Zoom's compliance with Zoom's obligations in this State Law Exhibit.