Serval Legal

This Data Processing Agreement, including its Annexes (“DPA” or “Addendum”), is entered into by and between Serval, Inc., a Delaware corporation (“Serval”), and Customer (as set forth in the applicable terms between Serval and Customer regarding use of the Service) (the “Agreement”).

“Customer” means a person or entity that accepts and agrees to the terms of this DPA as of the earlier date on which such person or entity either clicks a box indicating acceptance of this DPA or uses the Service.

Serval provides its proprietary enterprise service management software-as-a-service platform (the “Service”) to Customers. The provision of the Service involves the Processing of Personal Data subject to the Data Protection Laws, and the purpose of this DPA is to set forth the terms under which Serval Processes the Personal Data.

IF YOU DO NOT ACCEPT THIS DPA, YOU MAY NOT ACCESS OR USE THE SERVICE. THE SERVICE IS INTENDED FOR THE CUSTOMER AND ITS AUTHORIZED USERS ONLY AND IS NOT FOR USE BY CHILDREN UNDER 13 YEARS OF AGE. IF AN INDIVIDUAL IS ENTERING INTO THIS DPA ON BEHALF OF A LEGAL ENTITY, SUCH PERSON REPRESENTS AND WARRANTS THAT IT HAS THE LEGAL AUTHORITY TO BIND SUCH LEGAL ENTITY TO THIS DPA AND THIS DPA APPLIES TO SUCH ENTITY, WHICH IS DEEMED CUSTOMER.

Serval reserves the right to modify or update this DPA in its sole discretion. If Customer and Serval have executed a written data processing agreement governing the processing of personal data by means of the Service, then the terms of such signed data processing agreement between the parties will supersede this DPA.

This DPA is incorporated into and made part of the Agreement.

1. Subject Matter and Duration

1.1. Subject Matter. This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Personal Data in connection with Serval’s execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.

1.2. Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement or upon the date that the parties sign this Addendum if it is executed after the effective date of the Agreement. Serval will Process Personal Data until the relationship terminates as specified in the Agreement.

2. Definitions

For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.

2.1. “Controller” means the entity or Business which solely or jointly with other entities determines the purposes and means of the Processing of Personal Data and for the purposes of this Addendum means Customer.

2.2. “Data Breach” has the meaning given to it in the Data Protection Laws and for the purpose of this Addendum relates to the Personal Data Processed by Serval on behalf of Customer.

2.3. “Data Protection Laws” means the applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which the Personal Data are subject. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); any other applicable U.S. state data privacy or data protection law; the EU General Data Protection Regulation 2016/679 (“GDPR”) and its respective national implementing legislations; the Swiss Federal Act on Data Protection; the United Kingdom General Data Protection Regulation; and the United Kingdom Data Protection Act 2018 (in each case, as amended, adopted, or superseded from time to time), in each case solely to the extent applicable to Serval’s Processing of Personal Data.

2.4. “Data Subject” means the identified or identifiable person to whom the Personal Data relates, as defined in applicable Data Protection Laws.

2.5. “Standard Contractual Clauses” or “Clauses” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended, updated, or replaced from time to time.

2.6. “Personal Data” has the meaning given to it in the applicable Data Protection Laws and for the purpose of this Addendum relates to the personal data Processed by Serval on behalf of Customer.

2.7. “Process” or “Processing” has the meaning given to it in the Data Protection Laws and “process”, “processes” and “processed” will be construed accordingly.

2.8. “Processor” means the entity or Service Provider which Processes Personal Data on behalf of the Controller, as defined in applicable Data Protection Laws and for the purposes of this Addendum means Serval.

2.9. “Subprocessor(s)” means Serval’s authorized vendors and third-party service providers that Process Personal Data on behalf of Serval in connection with the provision of the Services.

3. Processing Terms for Personal Data

3.1. Documented Instructions. Serval shall Process Personal Data only on the documented instructions of Customer, including with respect to transfers of Personal Data to a third country, as set forth in the Agreement, this Addendum, any applicable Statement of Work, and any further documented instructions mutually agreed by the parties in writing. Serval will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that any instruction from Customer infringes applicable Data Protection Laws.

3.2. Confidentiality. Any person authorized to Process Personal Data must be subject to a duty of confidentiality, contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of confidentiality.

3.3. Personal Data Inquiries and Requests. Serval agrees to provide reasonable assistance and comply with reasonable instructions from Customer related to any requests from individuals exercising their rights in Personal Data granted to them under Data Protection Laws.

3.4. Data Protection Assessment, Data Protection Impact Assessment, and Prior Consultation. Where required by Data Protection Laws, Serval agrees to provide reasonable assistance and information to Customer where, in Customer’s judgement, the type of Processing performed by Serval requires a data protection assessment, data protection impact assessment, and/or prior consultation with the relevant data protection authorities. Customer shall reimburse Serval for non-negligible costs Serval incurs in performing its obligations under this Section beyond Serval’s standard support obligations.

3.5. Demonstrable Compliance. Serval agrees to provide information reasonably necessary to demonstrate compliance with this Addendum upon Customer’s reasonable request.

3.6. California Specific Terms. To the extent that Serval’s Processing of Personal Data is subject to the CCPA, this Section shall also apply. Customer discloses or otherwise makes available Personal Data to Serval for the limited and specific purpose of Serval providing the Services to Customer in accordance with the Agreement and this Addendum. Serval shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Personal Data; (v) not retain, use, or disclose Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Serval; and (vii) unless otherwise permitted by the CCPA, not combine Personal Data with Personal Data that Serval (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Customer may: (1) take reasonable and appropriate steps agreed upon by the parties to help ensure that Serval Processes Personal Data in a manner consistent with Customer’s CCPA obligations; and (2) upon notice, take reasonable and appropriate steps agreed upon by the parties to stop and remediate unauthorized Processing of Personal Data by Serval.

4. Technical and Organisational Measures

Serval shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Data from Data Breaches and Serval’s current security measures are described at trust.serval.com and include the controls validated by Serval’s SOC 2 report.

5. Data Breaches

5.1. Notice. Upon confirming a Data Breach has occurred, Serval shall provide written notice without undue delay and within seventy-two (72) hours to Customer’s Designated POC. To the extent then known, such notice will include: (i) the nature of the Data Breach, including the categories and approximate number of data subjects and records concerned; (ii) the measures taken or proposed to address the Data Breach; and (iii) a contact point from whom Customer may obtain further information. Where Serval cannot provide all information simultaneously, it shall provide information in phases without undue delay.

5.2. Investigation. Serval shall use commercially reasonable efforts to investigate the Data Breach and provide Customer with information concerning the scope, cause, impact of, and remediation measures referenced in Section 5.3 below taken with respect to such Data Breach upon the initial notification referenced in Section 5.1 above, or, if not available at such time, promptly thereafter upon Customer’s written request.

5.3. Remediation. Serval shall use commercially reasonable efforts to remediate the Data Breach as it relates to Serval’s impacted systems.

5.4. Exceptions. Serval will not have any obligations under Section(s) 5.2 – 5.3 if a Data Breach is attributable to Customer.

6. Cross-Border Transfers of Personal Data

6.1. Cross-Border Transfers of Personal Data. Customer authorizes Serval and its Subprocessors to transfer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.

6.2. EEA, Swiss, and UK Standard Contractual Clauses. If Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom is transferred by Customer to Serval in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by the Standard Contractual Clauses as supplemented by Exhibit A attached hereto, the terms of which are incorporated herein by reference. Where the Standard Contractual Clauses are applicable and Customer acts as a controller of Personal Data with Serval acting as a processor of Personal Data, each party shall comply with its obligations under Module Two of the Standard Contractual Clauses. Where the Standard Contractual Clauses are applicable and Customer acts as a processor of Personal Data with Serval acting as a (sub)processor of Personal Data, each party shall comply with its obligations under Module Three of the Standard Contractual Clauses. Each party’s execution of the Agreement or the Addendum (as applicable) shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.

7. Audits and Assessments

Where Data Protection Laws afford Customer an audit or assessment right, Customer (or its appointed representative) may carry out an audit or assessment of Serval’s policies, procedures, and records relevant to the Processing of Personal Data. Any audit or assessment must be: (i) conducted during Serval’s regular business hours; (ii) with reasonable advance notice to Serval; (iii) carried out in a manner that prevents unnecessary disruption to Serval’s operations; (iv) subject to reasonable confidentiality procedures; and (v) limited to once per twelve-month period, unless an audit or assessment is carried out at the direction of a government authority having proper jurisdiction. To satisfy its audit obligations under this Section, Serval shall make available to Customer, upon request, copies of relevant third-party audit reports or certifications (such as SOC 2 Type II reports), subject to reasonable confidentiality restrictions. Customer agrees that the provision of such reports shall satisfy Customer’s audit rights under this Section unless Customer can demonstrate, in writing, that the report does not adequately address Customer’s specific compliance concerns, in which case Customer may exercise its audit rights in the form of meetings with Serval’s information security experts upon a mutually agreeable date. Such interviews will be conducted with a minimum of disruption to Serval’s normal business operations and subject always to Serval’s agreement on scope and timings, at Customer’s sole cost and expense. Customer will be responsible for any actions taken by its authorized auditor. All information disclosed by Serval under this Section 7 will be deemed Serval Confidential Information, and Customer will not disclose any audit report to any third party except as obligated by law, court order or administrative order by a government agency.

8. Personal Data Retrieval and Deletion

Customer may retrieve Personal Data through the standard functionality of the Services during the term of the Agreement. At the expiry or termination of the Agreement, Serval will delete all Personal Data (excluding any back-up or archival copies which shall be deleted no later than ninety (90) days after expiry or termination), except where Serval is required to retain copies under applicable laws, in which case Serval will isolate and protect that Personal Data from any further Processing except to the extent required by applicable laws. Serval shall confirm deletion in writing upon Customer’s written request.

9. Sub-Processing

9.1. Authorization to Use Subprocessors. Customer authorizes Serval to engage Subprocessors to provide the Services. Serval will (i) impose data protection obligations on each Subprocessor that are no less protective than those in this Addendum, and (ii) remain responsible for its Subprocessors' performance of those obligations.

9.2. Right to Object to Subprocessors. Serval will notify Customer of new Subprocessors by updating its Subprocessor list at trust.serval.com (the "Subprocessor Website"), where Customer may also subscribe to email notifications. Customer may object within fifteen (15) days of notice (the "Objection Window") only on the grounds that the Subprocessor would cause (i) Customer to be in material breach of Data Protection Laws, or (ii) Serval to be in breach of Section 9.1. On a timely objection, Serval will either resolve the grounds for the objection or not permit the Subprocessor to Process Personal Data; if Serval cannot reasonably do so, Customer may terminate this Addendum and the Agreement as specified in the Agreement.

10. Processing Details

10.1. Subject Matter. The subject matter of the Processing is the provision of Serval’s AI-native IT service management platform, including help desk ticketing, knowledge base queries, access provisioning, workflow automation, and related support services, pursuant to the Agreement.

10.2. Duration. The Processing will continue until the expiration or termination of the Agreement.

10.3. Categories of Data Subjects. Customer’s employees, contractors, and other authorized users of Customer’s IT systems who interact with the Services.

10.4. Nature and Purpose of the Processing. The Processing is carried out for the purpose of providing the Services, including: receiving and routing help desk requests; querying knowledge bases; executing automated workflows at Customer’s direction; provisioning and deprovisioning access to Customer’s designated applications; and related operational support.

10.5. Types of Personal Data. Contact and professional information (name, email address, employee ID, job title, department); IT help desk ticket content including communications submitted through the Services; access management records including application entitlements and approval records; and any other Personal Data submitted to the Services by or on behalf of Customer.

11. Limitation of Liability

Serval’s total liability for any Claims arising out of this Addendum is subject to Section 12.3 (Excluded Claims) in the Agreement.

12. Entire Agreement; Conflict

Except as amended by this Addendum, the Agreement will remain in full force and effect. If there is a conflict between the Agreement and this Addendum, the terms of this Addendum will control.

13. Law and Jurisdiction

This Addendum shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Laws. For the purposes of Clause 13 of the Standard Contractual Clauses, the Supervisory Authority shall be the data exporter’s applicable Supervisory Authority. Data exporter shall notify data importer of the applicable Supervisory Authority by email at security@serval.com and shall provide any necessary updates without undue delay.

EXHIBIT A to the Data Processing Addendum

This Exhibit A forms part of the Addendum and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have the meaning set forth in the Addendum.

The parties agree that the following terms shall supplement the Standard Contractual Clauses:

1. SUPPLEMENTAL TERMS. The parties agree that: (i) a new Clause 1(e) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with Section 9.2 of the Addendum; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).

2. ANNEX I. Annex I to the Standard Contractual Clauses shall read as follows:

A. List of Parties

Data Exporter: Customer.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: Customer Designated POC.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Controller.

Data Importer: Serval.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: Serval Designated POC.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Processor.

B. Description of the Transfer:

Categories of data subjects whose personal data is transferred: The categories of data subjects whose personal data is transferred under the Clauses including, but not limited to, users of data exporter’s or its client’s IT systems.

Categories of personal data transferred: Data exporter may submit personal data to the Services, the extent of which is determined and controlled by data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: name, email address, phone number, professional details.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: Any sensitive data that is transferred under the Clauses, the extent of which is determined and controlled by data exporter in its sole discretion.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.

Nature of the processing: The Services, as further described in Section 10 of the Addendum.

Purpose(s) of the data transfer and further processing: The Services, as further described in Section 10 of the Addendum.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer will retain personal data in accordance with the Addendum.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter, nature, and duration as described in Section 9 of the Addendum.

C. Competent Supervisory Authority: The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

D. Clarifying Terms: The parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses will be provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of the Clauses will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried out in accordance with Section 7 of the Addendum; (iv) the termination right contemplated by Clause 14(f) and Clause 16(c) of the Clauses will be limited to the termination of the Clauses; (v) unless otherwise stated by data importer, data exporter will be responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Clauses; and (vi) the information required under Clause 15.1(c) of the Clauses will be provided upon data exporter’s written request.

3. ANNEX II. Annex II of the Standard Contractual Clauses shall read as follows:

Data importer shall implement and maintain technical and organizational measures designed to protect personal data in accordance with the Addendum.

Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the Addendum.


4. ANNEX III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:

The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.

Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.

Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.

Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.

Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.