Data Processing Addendum

This Data Processing Addendum ("DPA") is an agreement between Ably and Customer. This DPA incorporates, if applicable, the Standard Contractual Clauses and supplements the Ably Terms of Service (in which case "you" is the "Customer" and "we" refers to Ably Realtime Ltd ("Ably")), or the Ably Master Solution Agreement, as applicable (the Terms of Service or the Master Solution Agreement, and associated Orders and attachments, hereinafter the "Agreement"). Capitalised terms not otherwise defined herein will have the meanings given to them in the Agreement.

Customer acknowledges that Ably is a conduit of Content transmitted through the use of the Ably Solution, some of which may, unbeknownst to Ably, contain Personal Data as defined below. Such Personal Data is held only for as long as needed to transmit it (except if and to the extent the Customer elects to store such data, as data controller). Ably's processing of such Personal Data is incidental to, and arises from, the technical operation of that platform. Ably does not determine the purposes for which Content is created, transmitted or stored by Customer, nor does Ably inspect, select, modify or make decisions based on the substance of Content.

Customer may be the controller of Personal Data, or the processor of Personal Data. When Customer is the controller and shares Personal Data with Ably, Ably will be the processor of the Personal Data. When Customer is the processor and shares Personal Data with Ably, Ably will be the sub-processor of the Personal Data.

This DPA applies only to the extent that Ably processes Personal Data for Customer as Customer's processor or sub-processor, except section 9, which sets out where each party acts as an independent controller.

DEFINITIONS

DATA PROTECTION

1. Both parties will comply with their respective obligations under Data Protection Law. This DPA is in addition to, and does not relieve, remove, or replace, a party's obligations under Data Protection Law.

2. This DPA applies to Personal Data processed by Ably for Customer, if any. In this context, Ably may act as processor to Customer, who may act either as controller or processor with respect to Personal Data. If Customer acts as a processor, Customer represents and warrants on an ongoing basis that the relevant controller has authorised: (a) the Instructions; and (b) Customer's engagement of Ably and its Sub-processors. Customer will forward to the relevant controller promptly and without undue delay any notice provided by Ably under this DPA.

3. Details of Personal Data processing (constituting Annex I to the EU Standard Contractual Clauses and/or Appendix Information for the UK Addendum, as applicable):

Data Exporter: the Customer.

Data Importer: Ably Realtime Ltd

Subject Matter: Personal Data as described below, processed in connection with the provision of the Ably Solution.

Purpose: the provision of the Ably Solution initiated by Customer from time to time.

Nature of the Processing: message transit, realtime data delivery, and ancillary technical operations via provision of the Ably Solution as described in the Agreement and initiated by Customer from time to time.

Categories of Data Subjects: the data subjects may include Customer's (and its customers') end users, visitors, guests, other users, employees and staff, as well as any other individuals identified or identifiable within Content shared by such persons or whose Personal Data is captured in Content.

Types of Personal Data: in addition to Personal Data incidentally present in Content ("Captured Personal Data"), Ably collects and processes the following categories of data as a necessary incident in providing the Ably Solution:

• IP addresses

• End User login credentials (authentication tokens)

• client device descriptions/identifiers (via Ably push notification APIs (https://www.ably.com/documentation/realtime/push))

• end user identifiers supplied by Customer (such as the clientId), used to route messages

Special Categories of Data: the parties do not anticipate the processing of sensitive or special categories of Personal Data or data relating to criminal convictions or offences. Customer will not use the Ably Solution to process special category data or highly sensitive data as a deliberate feature of Customer's application or service, except as permitted by an Order Form or a Business Associate Agreement with Ably, and Customer is responsible for any such data that end users include in Content. In the event Customer does so in breach of this restriction, Ably will have no liability for any claim arising from or relating to such data.

Processing Operations: as described in this DPA, including Annex 1.

Duration of processing:

• Captured Personal Data: held by Ably momentarily (typically two minutes or less but up to 24 hours as necessary to provide the Ably Solution) except to the extent Customer elects to store such Personal Data for a longer period via the Instructions to Ably, or until Customer's account is deleted.

• IP addresses: up to 30 calendar days or until Customer's account is deleted, whichever occurs first.

• End User login credentials: up to 30 calendar days or until Customer's account is deleted, whichever occurs first.

• client device descriptions/identifiers: for the duration of Customer's subscription or until Customer's account is deleted, whichever occurs first.  Customer agrees to delete such data as soon as it is no longer needed.

• end user identifiers supplied by Customer (such as the clientId): for as long as needed to route messages and, for the purposes described in section 9, up to 13 months from the end of the billing month to which they relate.

Competent Supervisory Authority: the supervisory authority determined in accordance with Clause 13 of the EU Standard Contractual Clauses (EU); Information Commission (UK); and Autoridade Nacional de Proteção de Dados (Brazil), as applicable.

 4. Customer will ensure and warrants on an ongoing basis that it has all necessary and appropriate consents, lawful bases, and notices, in any form required by Data Protection Law in place to enable lawful transfer of the Personal Data to Ably for the duration and purposes of the Agreement. The parties agree that Personal Data processing is required as a part of Ably's provision of the Ably Solution, and that Personal Data is not exchanged for monetary or other valuable consideration.

5. Customer will ensure and warrants that where Personal Data is transferred outside the European Economic Area ("EEA"), Switzerland, Brazil, or outside the UK, as part of Customer's use or deployment of the Ably Solution, adequate measures will be taken to ensure the Personal Data will be protected to an adequate level and the data subjects' rights under the Data Protection Law will not be prejudiced by such a transfer. Subject to Ably's obligation in section 10.5 below with respect to Ably's Sub-processors, and section 12 below with respect to the Standard Contractual Clauses if applicable, Customer acknowledges that Customer is solely responsible for ensuring that Personal Data is transferred out of the EEA, Switzerland, Brazil, or the UK in full compliance with the Data Protection Law.

6. Customer will ensure and warrants that Customer utilises appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by Customer's processing of Personal Data, including, as appropriate, the measures referred to in the Data Protection Law.

7. Customer confirms that it has assessed any security measures in place at the time of entering into the Agreement, and that it will continue to do so on an ongoing basis to ensure its obligations under this DPA. Customer is solely responsible (as between the parties) if such measures fail to meet the standards required by Data Protection Law.

8. Customer undertakes and confirms that any information required to be provided to a data subject has been so provided or an applicable exemption is available and is being relied upon by Customer.

9. Customer and Ably agree that to the extent each party processes any Personal Data of the other party's personnel in connection with entry into the Agreement or the management of their business relationship, such party processes such data as an independent controller. Ably processes end user identifiers supplied by Customer (such as the clientId), and the usage data associated with them, to the extent they are Personal Data, as an independent controller for the purposes of metering, invoicing and verifying Customer's usage of the Ably Solution (including monthly active users) under the Agreement. Customer will ensure that its privacy notice to its end users discloses that Ably processes those identifiers for those purposes.

10. Ably shall, in relation to any Personal Data processed in connection with the provision of the Ably Solution:

10.1. process that Personal Data only on the written instructions of Customer in the form of (a) the Agreement (including this DPA), (b) Customer's use of the Ably Solution including Customer's preferences, settings and controls within the Ably Solution, and (c) any other written instructions provided by Customer and acknowledged by Ably as valid instructions with which Ably agrees to comply (collectively the "Instructions"), except to the extent Ably is required to process data by applicable law or if in Ably's reasonable opinion such Instructions infringe Data Protection Law. In either case, Ably will without undue delay notify Customer unless applicable law prohibits Ably from so notifying Customer;

10.2. not access or use, or disclose to any third party, any Personal Data, except, in each case, as necessary to maintain or provide the Ably Solution, to meter, invoice and verify Customer's usage under the Agreement, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order);

10.3. ensure that it has in place appropriate technical and organisational measures set forth in Annex 1 to this DPA designed to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;

10.4. ensure that all Ably personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential;

10.5. ensure that where Sub-processors are used outside the EEA, Switzerland, the UK or Brazil, such that Personal Data is transferred outside the EEA, Switzerland, the UK or Brazil, and such transfer is not to a third country recognised as providing an adequate level of protection under applicable Data Protection Law, Ably will use commercially reasonable efforts to ensure that appropriate transfer mechanisms are in place, which may include without limitation use of the Standard Contractual Clauses;

10.6. maintain general records of processing activities carried out on behalf of Customer as required by Data Protection Law;

10.7. taking into account the nature of the processing, insofar as reasonable and practicable, assist the Customer in responding to any request from a data subject and in ensuring compliance with its obligations under Data Protection Law with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators. Ably agrees to provide, upon reasonable request, information reasonably necessary for Customer to conduct transfer impact assessments. Ably's obligation to provide assistance under this section 10.7 is limited to the Personal Data processed by Ably and the processing Ably performs. Ably is not obligated to provide legal advice or to assess the compliance of Customer's broader processing activities;

10.8. notify Customer without undue delay, and in any event within 72 hours, after becoming aware of and validating a Personal Data security incident, and provide the information reasonably required for Customer to meet its obligations under Data Protection Law, to the extent then available to Ably, supplementing that information as it becomes available. Where the incident occurs at a Sub-processor, Ably becomes aware of it for the purposes of this section 10.8 on receiving notice from the Sub-processor, and the information Ably provides will be limited to that which the Sub-processor makes available to Ably. Ably is not obligated to report unsuccessful incidents or incidents that result in no unlawful or accidental destruction, loss, alteration, disclosure of, or unauthorised access to Personal Data or any of Ably's equipment or facilities storing Personal Data. Such non-reportable incidents may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorised access to traffic data that does not result in access beyond headers), or similar incidents. Ably's obligation to report or respond to a security incident under this section is not and will not be construed as an acknowledgement by Ably of any fault or liability of Ably with respect to the incident. Ably has no obligation to assess or inspect data in order to identify information subject to any specific legal requirements;

10.9. make available to Customer information reasonably necessary to demonstrate compliance with Ably's obligations under this section 10. Ably may satisfy this obligation by providing: (a) summaries or attestation letters derived from third-party audits or certifications (including SOC 2 Type II reports) conducted within the preceding twelve months; and/or (b) written responses to reasonable written questions submitted by Customer. If Customer reasonably demonstrates that the foregoing measures are insufficient to verify compliance, Ably will permit an audit or inspection of the processing activities covered by this DPA, subject to the following conditions: (i) Customer will provide not less than 60 days' prior written notice; (ii) such audit will be conducted no more than once per calendar year; (iii) such audit will be conducted at Customer's sole expense (including any reasonable fee charged by Ably for staff time and resources); (iv) the auditor must be a reputable third-party audit firm mutually agreed upon by the parties (such agreement not to be unreasonably withheld), which has entered into a confidentiality agreement acceptable to Ably; (v) the audit will be limited in scope and duration to that which is reasonably necessary to verify compliance with this DPA and will not extend to Ably's other customers' data, proprietary systems, source code, or trade secrets; (vi) the auditor's findings will be shared with Ably and will be treated as Ably's confidential information; and (vii) Customer will use reasonable efforts to minimise disruption to Ably's operations. Customer's audit and inspection rights under this section 10.9 do not extend to the facilities, systems or personnel of any Sub-processor, and as to Sub-processors Ably may satisfy this section 10.9 by making available the third-party audit reports and certifications that each Sub-processor makes available to Ably, to the extent its Sub-processor Terms (as defined in section 17.7) permit Ably to share them. The parties agree that this section 10.9 sets out the manner in which any audit rights under the Standard Contractual Clauses will be exercised; and

10.10. at the written direction of Customer, delete Personal Data on termination of the Agreement in accordance with Ably's standard deletion processes (and, for Personal Data held by a Sub-processor, that Sub-processor's deletion processes), unless required by applicable law to store the Personal Data.

11. Customer will use reasonable endeavours to notify Ably if any necessary appropriate consents and notices required to enable lawful transfer of Personal Data to Ably for the duration and purposes of the Agreement have been breached, terminated, withdrawn, or are otherwise no longer valid.

12. The parties agree that (a) the EU Standard Contractual Clauses apply if Personal Data from the EEA and/or Switzerland is transferred via the use of the Ably Solution to Ably in a country outside of the EEA or Switzerland, and such transfer is not to a third country recognised under Data Protection Law as providing an adequate level of protection; (b) the UK Addendum applies if Personal Data from the UK is transferred via the Ably Solution to Ably in a country that is outside of the UK, and such transfer is not to a country that the UK Secretary of State considers to provide an adequate level of protection (such outbound transfers of Personal Data from the EEA, Switzerland, or the UK, each an "EU/UK Outbound Transfer"). If no EU/UK Outbound Transfer occurs, the Standard Contractual Clauses and this section 12 will not apply. As used in this section, the terms "Data Importer" and "Data Exporter" will have the meanings given to them in the Standard Contractual Clauses. The parties acknowledge that for the purposes of the Standard Contractual Clauses Ably is acting in the capacity of a Data Importer and Customer is the Data Exporter (notwithstanding that Customer may be located outside of the EEA, Switzerland, or the UK or is acting as a processor on behalf of third-party controllers). Each party will comply with the applicable obligations of the Standard Contractual Clauses in their respective roles as Data Exporter and Data Importer. The data subjects, categories of data, and processing operations (as required to be disclosed in Annex I of the Standard Contractual Clauses) are as set forth in this DPA.  Annex 1 to this DPA details the technical and security measures Ably has implemented, as required to be disclosed in Annex II of the Standard Contractual Clauses.

13. The parties further agree that for all EU/UK Outbound Transfers, the governing law of the Standard Contractual Clauses entered into by Ably and the Customer will be: (a) the laws of Ireland, if the Customer is located in the EEA or Switzerland, or (b) the laws of England and Wales, if the Customer is located in the UK. If any inconsistency arises between this section 13 and any other provision for the governing law of the Standard Contractual Clauses entered into between Customer and Ably, this section 13 will take precedence.

14. To the extent required by applicable Data Protection Law, in the event of any conflict between this DPA and the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will prevail, and in the event of any conflict between this DPA and the UK Addendum, the UK Addendum will prevail.

15. Customer agrees that it shall exercise any audit rights under this DPA (including any audit rights granted by the Standard Contractual Clauses or Data Protection Law) in accordance with section 10.9 above.

16. Ably warrants that, as of the date on which this DPA takes effect, and except as disclosed in writing to Customer, it has not received any legally binding order from a public authority requiring the disclosure of Customer's Personal Data, and it shall:

16.1. if it receives such order, request, or other communication, attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Ably may provide Customer's basic contact information to the relevant body. If compelled to disclose Personal Data to a governmental body, then Ably will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Ably is legally prohibited from doing so;

16.2. publish a transparency report or provide information to Customer on request regarding: (a) the number of orders, requests, or other communications from governmental bodies for the disclosure of Personal Data and/or assistance in surveillance processes and the type of information requested, (b) its responses to the foregoing, and (c) its process for challenging such confidential and non-confidential orders, requests, and communications; and

16.3. notify Customer if Ably becomes aware that its ability to maintain the confidentiality and security of Personal Data has been materially compromised for any reason.

17. Customer agrees that Ably may use Sub-processors to fulfil its contractual obligations under this DPA or to provide certain services on its behalf, such as providing support services, and consents to the use of Sub-processors as described in this section. The Ably website (currently posted at https://www.ably.com/legals/sub-processors/) lists Sub-processors that are currently engaged by Ably to deliver the Ably Solution. (Such webpage constitutes Annex III to the EU Standard Contractual Clauses and the corresponding Appendix Information for the UK Addendum, if and as applicable.) 

17.1. At least ten business days before Ably engages any new Sub-processor to carry out processing activities on Personal Data on behalf of Customer, Ably will update the applicable website and provide Customer notice of that update as per the means specified for notices in the Agreement. The notice will identify the new Sub-processor, describe in reasonable detail the processing activities to be performed, specify the country or countries in which the processing will take place, and include a summary of the new Sub-processor's technical and organisational measures.

17.2. Customer may object to a new Sub-processor by notifying Ably in writing within ten days of receiving Ably's notice under section 17.1. An objection must set out in reasonable detail the reasonable data protection or information security grounds on which it is based (a "Qualifying Objection"). For the avoidance of doubt, objections based on grounds unrelated to data protection or information security do not constitute Qualifying Objections.

17.3. If Customer does not notify Ably of an objection within the period specified in section 17.2, or notifies an objection that is not a Qualifying Objection, Customer will be deemed to have consented to the new Sub-processor's appointment.

17.4. On receipt of a Qualifying Objection, the parties will engage in good faith discussions for a period of not more than 30 days (the "Resolution Period") to resolve the objection. During the Resolution Period, Ably may (a) use on an interim basis an existing Sub-processor listed under this section 17 whose technical and organisational measures address the grounds of the objection; or (b) continue with the current Sub-processor, if any.

17.5. If the Qualifying Objection cannot be resolved through good faith discussions under section 17.4, and Ably reasonably determines that use of the new Sub-processor is reasonably necessary to provide the affected part of the Ably Solution, Ably may terminate the affected portion of the Ably Solution or, if that is not practicable, the relevant subscription, on 30 days' written notice without liability to Customer for such termination. Where Ably terminates under this section 17.5, Ably will refund to Customer the lesser of (i) the prepaid fees for the terminated portion of the Ably Solution or the terminated subscription (as applicable) attributable to the period after the effective date of termination, and (ii) the prepaid fees for the terminated portion of the Ably Solution or the terminated subscription (as applicable) to the extent attributable to committed capacity or usage that Customer has not consumed as of the effective date of termination, determined by reference to Customer's actual consumption. Committed capacity or usage allocated to any billing period ending on or before the effective date of termination is treated as consumed. Section 5.7 (Refunds) of the Master Solution Agreement or section 8.6 (Refunds) of the Ably Terms of Service, as applicable, applies to that refund. If Ably does not terminate under this section 17.5, Ably will not use the new Sub-processor to process Customer's Personal Data.

17.6. Ably shall engage each Sub-processor under a written contract that imposes data protection obligations that are, in substance, the same as those in this DPA, to the extent relevant to the services the Sub-processor provides. Customer acknowledges that certain Sub-processors, including Ably's cloud hosting provider under the CHP Agreement (as defined in the Agreement), provide their services only on their standard published terms, which Ably is unable to negotiate. Ably will engage such a Sub-processor only where those terms impose data protection obligations that are, in substance, the same as those in this DPA to the extent relevant to the services it provides.

17.7. Ably will be responsible to Customer for the performance by each Sub-processor of that Sub-processor's data protection obligations under its contract with Ably (its "Sub-processor Terms"), only to the extent that a failure of that performance causes Ably to breach this DPA. Ably will not be responsible for any act or omission of a Sub-processor that does not constitute a failure to perform its Sub-processor Terms. If Ably becomes aware of any failure by a Sub-processor to fulfil its Sub-processor Terms that affects Customer's Personal Data, Ably will notify Customer. Ably's liability under this section 17.7 is subject to section 24.

17.8. This section 17 applies to Sub-processors engaged directly by Ably. The engagement or replacement by a Sub-processor of its own sub-processors is governed by its Sub-processor Terms, and Ably will, on Customer's request, direct Customer to the information that Sub-processor publishes about its sub-processors.

17.9. Where Ably is required to replace a Sub-processor urgently for reasons of security, legal compliance or continuity of the Ably Solution that are beyond Ably's reasonable control, Ably may engage the replacement Sub-processor immediately and will give notice under section 17.1 as soon as reasonably practicable afterwards, and sections 17.2 to 17.5 will apply as if that notice had been given in advance.

17.10. The parties intend the notice-and-objection process in this section 17 to be the means by which the general written authorisation under Clause 9(a) (Option 2) of the EU Standard Contractual Clauses, and any corresponding provision of any other standard contractual clauses incorporated into this DPA, is given and maintained, and the time period for the purposes of that clause is the period set out in section 17.1.

18. Ably may propose revisions to this DPA by replacing it with any applicable controller-to-processor standard clauses or similar terms forming part of an approved code of conduct or applicable certification scheme (which will apply when replaced by attachment to the Agreement). Customer and Ably will negotiate such changes in good faith as soon as reasonably practicable.

19. The parties agree that, if any new versions or revisions to the EU Standard Contractual Clauses are approved by the European Commission, or new versions or revision of the UK Addendum are approved and published by the Information Commission (or its predecessor, the Information Commissioner), such that the implementation of the Standard Contractual Clauses in this DPA no longer applies or is no longer appropriate, the parties shall work together to enter into new standard contractual clauses as appropriate.

20. Where the EU Standard Contractual Clauses apply to transfers of Personal Data governed by this DPA, the following options will be deemed to be selected and incorporated, each clause reference in this section being a reference to a clause in the EU Standard Contractual Clauses: (a) Clause 7 will not apply; (b) at Clause 9, option 2 will apply for both Module 2 and Module 3, with the time period being that set out in section 17.1; (c) at Clause 11, the optional redress mechanism will not apply; and (d) the competent supervisory authority under Clause 13 will be: (i) for transfers subject to EU GDPR, the supervisory authority determined in accordance with Clause 13(a); or (ii) the Information Commission for transfers subject to UK GDPR.

21. This section 21 applies to the extent that Ably processes Personal Data that is subject to the CCPA ("California Personal Data"). For the purposes of the CCPA, Ably is a "Service Provider" as defined in California Civil Code §1798.140(ag). In its capacity as Service Provider, Ably:

21.1 shall process California Personal Data solely for the specific business purpose of providing the Ably Solution to Customer as described in the Agreement, or as otherwise permitted by the CCPA;

21.2 shall not sell or share (as those terms are defined by the CCPA) California Personal Data;

21.3 shall not retain, use or disclose California Personal Data for any purpose other than the business purpose specified in the Agreement, including any commercial purpose other than providing the Ably Solution and metering, invoicing and verifying Customer's usage under the Agreement, except as permitted by the CCPA;

21.4 shall not combine California Personal Data received from or on behalf of Customer with personal information received from any other person or collected from Ably's own interaction with data subjects, except as permitted by the CCPA;

21.5 shall provide reasonable assistance to Customer (at Customer's expense) in responding to verifiable consumer requests under the CCPA, to the extent that such requests relate to Personal Data processed by Ably;

21.6 shall notify Customer if Ably makes a determination that it can no longer meet its obligations under the CCPA;

21.7 shall permit Customer to take reasonable and appropriate steps to help ensure that Ably uses California Personal Data in a manner consistent with Customer's obligations under the CCPA, provided that such steps do not require Ably to disclose its confidential information or trade secrets; and

21.8 hereby certifies that it understands and will comply with the restrictions and obligations set out in this section 21.

22. Customer agrees not to process any HIPAA Data via the Ably Solution unless Customer has entered into a Business Associate Agreement (BAA) with Ably. Unless a BAA is in place, Ably will have no liability under the Agreement for HIPAA Data. "HIPAA Data" means any patient, medical or other protected health information regulated by US Health Insurance Portability and Accountability Act of 1996 or any similar US federal or state laws, rules or regulations.

23. Where the UK Addendum applies to transfers of Personal Data governed by this DPA, the parties agree that:

23.1. the UK Addendum will be populated by reference to this DPA and its Annex and that any changes in formatting (including for the avoidance of doubt with respect to Part 1: Tables) will not adversely affect the validity of the DPA or the compliance with Data Protection Law of any international transfers of Personal Data made thereunder;

23.2. any formatting changes do not reduce the standard of Appropriate Safeguards (as defined in the UK Addendum) provided; and

23.3. neither party will be entitled to end the UK Addendum pursuant to Section 19 of the UK Addendum except where a revision under Section 18 of the UK Addendum materially reduces the Appropriate Safeguards.

24. Each party's maximum aggregate liability arising under or in connection with this DPA (including any claims under the Standard Contractual Clauses, the Brazilian SCCs (as defined in the Brazil Supplement) and the data protection laws of any applicable jurisdiction), whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability set out in the Agreement. As between the parties, liability will be apportioned, allocated and limited in accordance with the Agreement, and each party will be responsible for its own acts and omissions, subject to section 17.7. Neither party will be liable to reimburse the other for any administrative fine imposed on that other party except to the extent the fine results from the first party's breach of this DPA. Nothing in this DPA constitutes an indemnity by Ably.

25. This DPA is governed by and construed in accordance with the governing law and jurisdiction provisions of the Agreement, except to the extent that a different governing law is mandated by the Standard Contractual Clauses or by applicable Data Protection Law.

26. In the event of any conflict between this DPA and the Agreement, this DPA will prevail with respect to matters of data protection, except that nothing in this section 26 overrides section 24, the limitations and exclusions of liability in the Agreement, or any indemnity given by Customer in the Agreement (including section 6.6 of the Master Solution Agreement). In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail to the extent required by Data Protection Law.

27. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will continue and remain in full force and effect.

28. Ably may update this DPA from time to time to reflect changes in law, regulatory guidance, or Ably's practices. Notice of material changes will be provided in accordance with the Agreement, such changes to take effect upon the next renewal of Customer's Ably Solution subscription. Customer's renewal of its subscription indicates Customer's acceptance of and agreement to the modified DPA. Where the Agreement is the Master Solution Agreement, a modified DPA binds Customer when an Order Form signed by Customer refers to it, and that Order Form satisfies section 8.10 of the Master Solution Agreement.

29. This DPA will be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns. Ably may assign or transfer this DPA in connection with any assignment of the Agreement permitted under the Agreement, without requiring Customer's separate consent. Customer agrees that any such assignment or transfer includes the transfer of all rights, obligations, and associated data (including Personal Data) to the extent necessary to ensure continuity of service under the Agreement. Any assignee or successor shall be bound by the obligations of this DPA to the same extent as Ably. For the avoidance of doubt, following any such assignment, references to "Ably" in this DPA will be read as references to the assignee or successor entity, and the Instructions will continue in effect as defined in section 10.1.

Brazilian Supplement

This Brazilian Data Protection Supplement ("Brazil Supplement") supplements the Data Processing Addendum between Ably and Customer. Capitalised terms not defined in this Brazil Supplement will have the meanings given to them in the DPA or the Agreement.

This Brazil Supplement applies to the extent that Ably processes Personal Data that is subject to the Brazilian General Data Protection Law, Lei Geral de Proteção de Dados Pessoais, Federal Law No. 13,709/2018, as amended ("LGPD"). This includes circumstances where: (i) the processing is carried out in Brazil; (ii) the processing relates to Personal Data of data subjects located in Brazil; or (iii) the Personal Data was collected in Brazil. If applicable, the term Data Protection Law includes the LGPD.

Where Personal Data subject to the LGPD is transferred internationally (i.e., to a country outside Brazil), the parties agree to comply with Article 33 of the LGPD and Resolution CD/ANPD No. 19/2024. The parties agree that international transfers of Personal Data subject to the LGPD shall be carried out in accordance with one of the following mechanisms: (a) to countries or international organisations recognised by Autoridade Nacional de Proteção de Dados, Brazil's National Data Protection Authority, or any successor authority ("ANPD") as providing an adequate level of data protection; (b) pursuant to the standard contractual clauses approved by the ANPD (the "Brazilian SCCs"), which Ably will enter into with Customer, in full and without modification, as a separate contract on Customer's request, and Customer will make that request before any transfer that requires them; (c) where the transfer is necessary for international legal cooperation between public intelligence, investigation, or prosecution bodies; (d) where the transfer is necessary to protect the life or physical safety of the data subject or a third party; (e) where the ANPD has authorised the transfer; or (f) where the data subject has provided specific and prominent consent to the transfer, having been informed of the international nature of the transfer and the risks involved.

For the purposes of Personal Data subject to the LGPD, the competent supervisory authority is the ANPD. Ably shall, taking into account the nature of the processing and the information available, provide reasonable assistance to Customer (at Customer's expense) in responding to requests or enquiries from the ANPD concerning Personal Data processed under this Brazil Supplement.

The ANPD has recognised the European Union as providing an adequate level of protection (Resolution CD/ANPD No. 32/2026). Where the ANPD has issued or issues an adequacy decision applicable to a jurisdiction where Ably or its Sub-processors process Personal Data, the parties may rely on that decision as a valid transfer mechanism. That decision does not cover the United Kingdom, so transfers of Personal Data subject to the LGPD to Ably in the United Kingdom, and any other transfer to a jurisdiction that the ANPD has not recognised as adequate, require the Brazilian SCCs.

The parties acknowledge that, pursuant to Articles 42 and 43 of the LGPD, both controllers and processors may be held jointly and severally liable for damages caused by processing that violates LGPD. Notwithstanding the foregoing, as between the parties, liability will be apportioned, allocated and limited in accordance with the terms of the Agreement, and each party will be responsible for its own acts and omissions.

a) Access Control

i) Preventing Unauthorised Product Access

Outsourced processing: Ably hosts the Ably Solution with AWS and/or applicable affiliates. Additionally, Ably maintains contractual relationships with vendors in order to provide the Ably Solution. Ably relies on contractual agreements, privacy policies, and vendor compliance programmes in order to protect  data processed or stored by these vendors.

Physical and environmental security: Ably hosts its product infrastructure with multi-tenant, outsourced infrastructure provider Amazon Web Services, Inc. The physical and environmental security controls are audited for SOC 2 Type II (https://aws.amazon.com/compliance/soc-faqs/) and ISO 27001 (https://aws.amazon.com/compliance/iso-27001-faqs/) compliance, among other certifications. Physical, environmental and underlying infrastructure controls are implemented and maintained by Ably's infrastructure providers under their own terms, and are described here by reference to their published certifications; Ably's measures in respect of those controls consist of selecting, contracting with and monitoring the compliance programmes of those providers.

Authentication: Ably has implemented a uniform password policy for its customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public customer data.

Authorisation: Customer data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorisation model in each of Ably's products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customisation options. Authorisation to data sets is performed through validating the user's permissions against the attributes associated with each data set.

Application Programming Interface (API) access: Public product APIs may be accessed using an API key.

ii) Preventing Unauthorised Product Use

Ably implements industry standard access controls capabilities for the internal networks that support its products.

Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorised protocols from reaching the product infrastructure. The technical measures include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.

Intrusion detection and prevention: Ably has implemented a Web Application Firewall (WAF) solution to protect internet-accessible applications. The WAF is designed to identify and prevent attacks against publicly available network services.

Static code analysis: Security reviews of code stored in Ably's source code repositories are performed, checking for identifiable software flaws, and known vulnerabilities.

Penetration testing: Ably maintains relationships with industry recognised penetration testing service providers for regular penetration tests. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.

iii) Limitations of Privilege & Authorisation Requirements

Product access: A subset of Ably's employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Access is enabled through "just in time" requests for access; all such requests are logged.

Staff: All employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.

b) Transmission Control

In-transit: All connections to the Ably dashboard use TLS, and all connections to the Ably service endpoints (realtime and REST) use TLS by default. Ably's TLS implementation uses industry standard algorithms and certificates.

At-rest: All persisted data is encrypted at rest, including Content, metadata associated with use of the Ably Solution, account, user and configuration details, logs and backups. Ably stores user passwords following policies that follow industry standard practices for security, and ensure that all passwords are never stored in plain text formats.

c) Input Control

Detection: Ably designed its infrastructure to log extensive information about the system behaviour, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Ably personnel, including security, operations, and support personnel, are responsive to known incidents.

Response and tracking: Ably maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Ably will take appropriate steps to minimise product and Customer damage or unauthorised disclosure.

Communication: If Ably becomes aware of unlawful access to Personal Data stored within its systems, Ably will: (1) notify affected Customers in accordance with section 10.8 of this DPA; (2) provide a description of the steps being taken to resolve the incident; and (3) provide status updates to Customer as Ably deems necessary. Notification of supervisory authorities and data subjects is Customer's responsibility, except where Data Protection Law requires Ably to notify them directly. Notifications will be delivered to Customer's designated contact in a form selected by Ably, which may include email or telephone.  

d) Availability Control

Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.95% uptime. As Ably's service is designed to be available across many regions simultaneously, the availability offered is much higher than the underlying infrastructure provider in any single region.  The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services. These infrastructure-level measures are implemented by the infrastructure providers under their own terms.

Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Content that a customer configures to be persisted is stored in multiple geographic regions.

Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry standard methods.

Ably's products are designed to ensure redundancy and continuity in spite of failures. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists Ably operations in maintaining and updating the product applications and backend without downtime.

e) Transparency

Ably is regularly audited by independent third-party auditors. Upon written request, and subject to the confidentiality obligations in the Agreement, Ably will supply a summary copy of its most current audit report(s) or applicable compliance certifications (such as SOC 2 Type II). The provisions of section 10.9 of this DPA govern all audit and inspection rights.

f) Back Doors

Ably has not purposefully created back doors, or changed its business processes, in a manner that facilitates systematic access to Personal Data. 

• Terms of Service

• Privacy Policy

• Data Protection

• Acceptable Use Policy

• Audit Trail