SNOWFLAKE SUB-PROCESSOR DATA PROTECTION AGREEMENT

Last Updated: May 16, 2025

This Snowflake Sub-Processor Data Protection Agreement ("DPA") is entered into in connection with the Agreement (defined below) by and between the Vendor as described in the Agreement, on behalf of itself and its Affiliates who are approved Sub-processors hereunder (collectively, “Vendor”) and the member of the Snowflake Group that is a party to the Agreement with Vendor for Vendor’s services (“Snowflake”). Snowflake and Vendor agree that notwithstanding anything to the contrary in the Agreement, including an integration clause, this DPA is hereby incorporated into and made an essential part of the Agreement. Capitalized terms not otherwise defined herein have the meanings given to them in the Agreement.

Recitals

A.         Vendor has entered into one or more purchase orders, statements of work, contracts and/or agreements with Snowflake and/or Snowflake Affiliates to provide services that may involve the Processing of Personal Data (including Business Contact Data) (the “Services”).

B.         As part of its privacy policy and its contractual arrangements, Snowflake has provided certain assurances to its customers, contacts, partners and/or end-users to ensure the appropriate protection of Personal Data when Snowflake engages third party suppliers. Snowflake’s engagement of Vendor is conditioned upon Vendor’s compliance with this DPA.

Agreement

1.     DEFINITIONS

1.1           “Affiliate” means any entity that is directly or indirectly controlled by, controlling or under common control with an entity. “Control” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

1.2           “Agreement” means collectively the Professional Services Subcontracting Agreement under which Vendor provides Services to Snowflake which may include one or more purchase orders, contracts, statements of works and/or agreements, including any evaluation or pre-release agreements.

1.3           “Applicable Privacy Law(s)” means all data protection and privacy laws and regulations worldwide applicable to the Services and/or Personal Data in question, including, where applicable, European Data Protection Law and Applicable State Privacy Laws.

1.4           “Applicable State Privacy Law(s)” means individually and collectively, as applicable, those laws and regulations of the United States or states within the United States that govern the processing, transfer, sharing, or sale to a third party of the personal information or personal data of consumers, individuals, or households (as such activities and data are more fully defined in the applicable law), that are currently in effect or that become effective in the future, including, but not limited to, the California Consumer Privacy Act of 2018 as updated by the California Privacy Rights Act of 2020 (“CCPA”), the Colorado Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act, and in each case, any amendments, final regulations, and successor legislation.

1.5            “Authorized Persons” means any person who Processes Personal Data on Vendor’s behalf, including Vendor’s and its Sub-processors’ employees, officers, partners, principals, and contractors.

1.6           “Business Contact Data” means contact information relating to Snowflake's, its Affiliates’, customers’ and/or business partners’ personnel (including contractors, representatives, etc.) disclosed to Vendor in connection with the Agreement.

1.7           “Data Privacy Framework” or “DPF” means (as applicable) the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs as operated by the U.S. Department of Commerce, and their respective successors.

1.8           “DPF Principles” means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time.

1.9           “EEA+” means the European Economic Area and each of its member states, plus the United Kingdom and Switzerland.

1.10          “European Data Protection Law” means all data protection and privacy laws and regulations of EEA+, including, where applicable, (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (GDPR); (ii) the EU e-Privacy Directive (Directive 2002/58/EC); (iii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR); and (iv) the Swiss Federal Act on Data Protection (FADP); and (v) any national data protection laws made under or pursuant to (i), (ii) or (iii).

1.11          “SCCs” means (i) with respect to the European Economic Area and its member states and Switzerland, the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en (“EU SCCs”); and (ii) with respect to the United Kingdom, the EU SCCs as incorporated and amended by the UK Addendum as defined below (in each case, as updated, amended, or superseded from time to time).

1.12          “Personal Data” means any data that Vendor Processes in connection with the Agreement that (i) relate to an identified or identifiable natural person (data subject) and/or (ii) is personal data, personal information, including personal health information, personally identifiable information, or is similarly designated data under Applicable Privacy Laws.

1.13          “Processing” shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, access, viewing, use, disclosure by transmission, dissemination and "Process", "Processes" and "Processed" will be interpreted accordingly.

1.14          “Restricted Transfer” means a transfer of Personal Data that is subject to European Data Protection Law to a country that does not provide an adequate level of protection for Personal Data within the meaning of European Data Protection Law.

1.15          “Security Incident” means any actual, suspected, or attempted accidental or unlawful destruction loss, alteration, unauthorized disclosure or access to Personal Data.

1.16          “Snowflake Group” means Snowflake Inc. and its Affiliates.

1.17          “Sub-processor” means any third party (including each applicable Vendor Affiliate) engaged directly or indirectly by Vendor to Process any Personal Data. 

1.18          “UK Addendum” means template addendum B.1.0 issued by the ICO and laid before UK Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, including “Part 2: Mandatory Clauses”, as it is revised under Section ‎‎18 of those Mandatory Clauses, available at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/ or successor website as designated by the ICO. 

1.19          The terms “Controller” and “Processor” have the meanings given to them in Applicable Privacy Laws. If and to the extent that Applicable Privacy Laws do not define such terms, then the definitions given in European Data Protection Law will apply.   

2.      ROLE AND SCOPE OF PROCESSING

2.1           Roles of the Parties and Details of Processing. Vendor shall Process Personal Data solely as a Processor acting on behalf of Snowflake. The description of the Personal Data Processed by Vendor is as described at Annex 1.B. Snowflake may be a Controller (e.g., for its own employees’ personal data) or Processor (e.g., for personal data provided to Snowflake by its customers) of the Personal Data.

2.2           Vendor’s Processing of Personal Data. Vendor shall Process the Personal Data only to the extent strictly necessary to provide the Services to Snowflake under the Agreement, and in accordance with Snowflake's documented instructions. Vendor shall comply with Applicable Privacy Laws. Vendor shall not Process or permit any third party to Process the Personal Data for its own purposes or those of any third party (including internal purposes such as improvement of services or any commercial purpose) other than for the specific purpose of Vendor’s performance under the Agreement. Vendor shall not aggregate, de-identify, anonymize, or perform any similar Processing on Personal Data without Snowflake’s advanced written consent in each instance.

2.3           Vendor’s Notification Obligations Regarding Snowflake Instructions. Vendor shall promptly notify Snowflake in writing, unless expressly prohibited from doing so under Applicable Privacy Law, if Vendor:

(a)            becomes aware or believes that (i) any Processing instruction from Snowflake violates Applicable Privacy Law or (ii) Vendor does not comply with Applicable Privacy Laws;

(b)            is unable to comply with Snowflake’s Processing instructions for any reason; and/or

(c)            is unable to comply with the terms of the Agreement (including this DPA) as they relate to the Processing or security of Personal Data.

Where Snowflake is itself a Processor of Personal Data acting on behalf of another Controller(s) or Processor(s) (i) Snowflake will serve as the sole point of contact for Vendor with regard to any such Controller(s) and/or Processor(s) and Vendor shall not interact directly with (including seeking any authorizations directly from) any such Controller(s) or Processor(s) for any permitted or required communications under this DPA unless pre-approved in writing by Snowflake; and (ii) where Vendor would (including for the purposes of the SCCs, if applicable) otherwise be required to provide information, assistance, cooperation, or other notification to such Controller(s) or Processor(s), Vendor shall provide it solely to Snowflake. Notwithstanding the foregoing, Vendor is entitled to follow the instructions of such Controller(s) with respect to such Controller(s) Personal Data instead of Snowflake's instructions if Vendor is required to do so under law but shall notify Snowflake in advance of any such instruction and Vendor’s actions proposed to be taken in response to them.

2.4           Business Contact Data. Vendor may also Process Business Contact Data to the extent necessary for Vendor’s purposes of (i) invoicing, billing and/or other business inquiries with Snowflake or its representatives, (ii) obtaining information on usage of the Services, and/or (iii) contract management.

3.     SUBPROCESSING

3.1           Appointment of Sub-processors. Vendor shall not subcontract, or otherwise engage a Sub-processor, for any Processing of Personal Data without the prior written consent of Snowflake expressly set forth in each relevant Statement of Work or in this DPA. With respect to each permitted Sub-processor, Vendor must:

(a)            enter into a written agreement imposing the same or more stringent data protection obligations as those related to this DPA (including the SCCs) to the extent applicable to the nature of the services provided by such Sub-processor;

(b)           remain fully liable for any act, error, and/or omission of such Sub-processor, including any breach by the Sub-processor of obligations described in this DPA, the Agreement, and/or Applicable Privacy Law(s); and

(c)           upon request, provide Snowflake with copies of and all relevant information in connection with its applicable Sub-processor agreements as necessary to demonstrate Vendor’s compliance with this DPA and/or Applicable Privacy Law(s).

3.2       Objection Right for New Sub-Processors. Snowflake may withhold consent for the appointment or replacement of a Sub-processor. In such event, the parties shall discuss in good faith commercially reasonable alternative solutions. If the parties cannot reach resolution within a reasonable period of time, which shall not exceed 30 days or a longer period as set by Snowflake, Vendor will not appoint or replace the Sub-processor or, if this is not possible, Snowflake may terminate the Agreement (in whole or in part), by providing written notice to Vendor. Vendor will refund Snowflake any prepaid unused fees under the Agreement following the effective date of termination.

3.3       Contact and Processing Details. Vendor shall make its contact and Processing details, including legal name, address, contact person (name, position, contact details), purposes, description, and locations of the Processing (“Contact and Processing Details”) as well as its Sub-processors’ Contact and Processing Details available to Snowflake at all times as long as it Processes Personal Data. Vendor shall include its Sub-processors’ Contact and Processing Details in all lists of such Sub-processors it makes available or provides to Snowflake. Vendor shall promptly notify Snowflake by sending an email to privacy@snowflake.com of all changes to its and its Sub-processors’ Contract and Processing Details. For the avoidance of doubt, if purposes, locations, or scope of Processing regarding the Sub-processor engaged by Vendor materially change, such changes shall constitute change to Sub-processors and Vendor shall follow conditions of engagement of such Sub-processor for respective Processing specified in Section 3.1 above, while Snowflake may withhold its consent and has objection rights hereunder.       

4.     DATA SUBJECT RIGHTS AND COOPERATION  

4.1       Data Subject and Other Requests. Vendor shall reasonably cooperate with Snowflake to enable Snowflake to respond to any requests, complaints and/or other communications from data subjects, regulatory or judicial bodies, Snowflake customers, or any other third party relating to the Processing of Personal Data under the Agreement, including requests to exercise rights under Applicable Privacy Laws. If any such request, complaint, or communication is received by Vendor, Vendor shall immediately forward it to Snowflake together with all relevant details of such communication and shall not respond to such communication without Snowflake's express written pre-authorization. Snowflake shall have full control and discretion as to all the decisions regarding responding to such communications received by Vendor.

4.2       Subpoenas and Court Orders. If Vendor receives a subpoena, court order, warrant or other demand or request from a third party (including law enforcement or other public or judicial authorities) seeking Personal Data, Vendor shall, to the extent not prohibited by applicable law, immediately notify Snowflake in writing of such request, reasonably cooperate with Snowflake if Snowflake wishes to limit, challenge or protect against such demand, and shall not respond to such demand or provide the Personal Data unless expressly instructed to do so by Snowflake. If Vendor cannot notify Snowflake, Vendor shall challenge such request on Snowflake’s behalf and shall not respond to such demand or provide Personal Data until all legal mechanisms of challenging such demand had been exhausted by Vendor.

4.3       Privacy Assessments and Consultations. Vendor will provide assistance to Snowflake to allow Snowflake and/or Snowflake’s customer to conduct a data protection impact assessment, transfer impact assessment, and/or other assessments or consultations that may be required by Snowflake, including with applicable data protection authorities in respect of any Processing under this DPA.

5.     DATA ACCESS & SECURITY MEASURES

5.1           Confidentiality and Limitation of Access. Vendor shall ensure that any Authorized Person is sufficiently knowledgeable and trained on privacy and security before allowing them to Process Personal Data. Vendor shall also ensure the Authorized Person is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and that they Process the Personal Data only as allowed by the Agreement and this DPA.

5.2           Security Measures. Vendor must implement and maintain all appropriate technical, administrative, and organizational security measures to protect Personal Data from Security Incidents and to preserve the security, integrity, availability, and confidentiality of such data, including but not limited to, incident response, business continuity, and a disaster recovery plans (collectively, "Security Measures"). Security Measures shall be regularly tested to ensure they are effective and shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Vendor’s Security Measures shall also include all measures identified at Annex 2.

6.     SECURITY INCIDENTS

6.1           Notification of Security Incidents. In the event of a Security Incident, Vendor shall (i) where the Security Incident solely involves Business Contact Data, notify Snowflake as soon as possible, but in no event later than forty-eight (48) hours after becoming aware; and (ii) where the Security Incident involves Personal Data other than Business Contact Data, notify Snowflake immediately, but in no event later than twenty-four (24) hours of becoming aware. Such notifications shall include written details of the Security Incident, including, to the extent possible, all information necessary for Snowflake to fulfill its obligations under Applicable Privacy Laws, including data breach reporting and risk assessment obligations, and shall be sent to security@snowflake.com.

6.2           Vendor’s Obligations Following Security Incident. Furthermore, in the event of a Security Incident, Vendor shall:

 (a)          collect and preserve all evidence pertaining to the Security Incident and the investigation conducted by or on behalf of Vendor, and provide such information and further timely information and cooperation as Snowflake may reasonably require;

(b)          take such measures and actions as are appropriate to remedy or mitigate the effects of the Security Incident and keep Snowflake up-to-date about all significant information and developments in connection with the Security Incident; and

(c)           reimburse Snowflake, subject to applicable limitations on liability (if any) under the Agreement, for the reasonable costs (i) to prepare and send all notifications that are legally required or Snowflake determines are reasonably necessary; and (ii) to provide credit monitoring and identity theft protection services to affected individuals for at least one (1) year or such longer time as may be required under law.

6.3           Third Party Notifications. Vendor shall not notify any third party of the Security Incident without Snowflake’s advanced written approval, other than third parties necessary to Vendor’s response and investigation obligations under the Agreement and this DPA who are also bound by obligations of non-disclosure in connection with the Security Incident. In the case of any permitted notification, public/regulatory communication or press release to any other third-party, all aspects of the communication or release shall be solely at Snowflake’s discretion and must be pre-approved by Snowflake, except to the extent such notification is required to be made by Vendor under Applicable Privacy Laws, in which case Vendor shall make best efforts to allow Snowflake to review and approve the notification and content in advance and where possible not to identify Snowflake in such notification.

7.     SECURITY REPORTS & INSPECTIONS

7.1           Vendor Security Standards. Vendor shall maintain records of the details of its information security management system ("ISMS"). Upon request, Vendor shall provide copies of any existing external ISMS certifications, audit report summaries and/or other documentation or information reasonably required by Snowflake to verify Vendor’s Security Measures and compliance with this DPA.

7.2           Right of Inspection. While it is the parties' intention ordinarily to rely on Vendor’s obligations set forth in Section 7.1 to verify Vendor’s compliance with this DPA, Snowflake may require Vendor to periodically complete a written security questionnaire. Also, Snowflake (or its appointed representatives) may carry out an inspection of the Vendor's operations and facilities during normal business hours and subject to reasonable prior notice where Snowflake considers it necessary or appropriate (for example, without limitation, where Snowflake or the applicable Snowflake customer has reasonable concerns about Vendor’s data protection compliance, a Security Incident has occurred or is suspected, receipt of instruction from a data protection authority or Snowflake customer, or Vendor’s responses to a security questionnaire reveals a deficiency in Vendor’s security and/or privacy controls). This section should not limit Snowflake’s rights of inspection under international transfer mechanisms established in Section 8 of this DPA.

8.     INTERNATIONAL TRANSFERS

8.1           International Transfers. Vendor shall not (and shall ensure that any permitted Sub-processor shall not) transfer any Personal Data to a country, or Process the Personal Data from a country, other than that country in which the Personal Data is held by Snowflake or the applicable Snowflake customer, unless expressly agreed in writing in a mutually executed SOW or amendment to this DPA. Notwithstanding the foregoing, Vendor may transfer and Process Business Contact Data where necessary for Services and/or the purposes set forth in Section 2.4 (Business Contact Data) so long as Vendor takes all measures necessary to ensure such Processing and/or transfer is in full compliance with Applicable Privacy Laws. Vendor shall disclose all countries in which storage and any other Processing of Business Contact Data take place on written request by Snowflake.

8.2           Data Privacy Framework. Snowflake is self-certified to the Data Privacy Framework. Accordingly, to the extent that Vendor is a recipient of Personal Data that is within scope of Snowflake’s DPF certification, Vendor agrees that it shall (i) only process such Personal Data for the limited and specified purposes described in this DPA, and (ii) provide at least the same level of protection for such Personal Data as is required by the DPF Principles by complying with its obligations set forth in this DPA.

8.3           Transfer Mechanism. To the extent that the transfer of Personal Data from Snowflake to Vendor is a Restricted Transfer, Vendor shall comply with the following:

(a)        If Vendor is self-certified to the Data Privacy Framework and the Personal Data is within the scope of such certification, Vendor represents and warrants that it shall (i) provide at least the same level of protection for such Personal Data as is required by the DPF Principles, (ii) promptly notify Snowflake if it can no longer meet its obligations under the DPF Principles and, (iii) in such event, work with Snowflake and promptly take all reasonable and appropriate steps to stop and remediate (if remediable) any Processing until such time as the Processing complies with Data Protection Law.

(b)        Alternatively, if European Data Protection Law requires that appropriate safeguards are put in place (for example, if Vendor is not self-certified to the Data Privacy Framework, the Data Privacy Framework does not cover the Restricted Transfer, and/or the Data Privacy Framework is invalidated), the SCCs shall automatically be incorporated into this DPA and apply to the Restricted Transfer as set forth in Section 8.4.  

8.4           Standard Contractual Clauses. Pursuant to Section 8.3 above, the parties agree that the SCCs shall be incorporated into this DPA by reference and form an integral part of this DPA as follows:

(a)            Snowflake (acting on behalf of itself and all Snowflake Affiliates) shall be the "data exporter" and Vendor shall be the "data importer";

(b)            Module Two and Module Three of the SCCs shall apply, with the description of the transfers set out in Annex 1.B, and the same shall apply for Table 2 of the UK Addendum;

(c)            in Clause 9 of the SCCs, Option 1 shall apply and the time period for requests shall be at least 30 days, and the same shall apply for Table 2 of the UK Addendum;

(d)            in Clause 11 of the SCCs, the optional language shall be deleted;

(e)            in Clause 17 of the EU SCCs, Option 1 shall apply and the EU SCCs shall be governed by laws of the Netherlands;

(f)            in Clause 18(b) of the EU SCCs, disputes shall be resolved before the courts of the Netherlands; and

(g)            the Annexes of the EU SCCs and Table 3 of the UK Addendum shall be populated with the relevant information set out at Annex 1, Annex 2, and Annex 3 to this DPA.

8.5           Disclosure of Terms. Vendor acknowledges that Snowflake may disclose this DPA and any relevant privacy and security related provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, European data protection authorities or any other applicable judicial or regulatory body, as well as Snowflake’s customers, upon their request.

9.     DELETION & RETURN               

9.1           Deletion of Data. Upon Snowflake's request, or upon termination or expiry of this DPA, Vendor shall, at Snowflake’s choice, permanently and securely delete or return to Snowflake all Personal Data (including copies) in its possession or control (including any Personal Data Processed by its Sub-processors). Until the Personal Data is permanently and securely deleted, Vendor shall continue to ensure compliance with this DPA. If Snowflake elects the return of Personal Data, Vendor shall permanently and securely delete any remaining Personal Data (including copies thereof) within sixty (60) days of such return.          

10.    UNITED STATES PRIVACY LAWS

10.1           Specific Defined Terms. Snowflake and Vendor agree that, for solely the purposes of this Section 10, the terms “aggregate consumer information,” “deidentified,” “process,” “processor,” “sell” (and similarly defined terms such as “sale”), “service provider,” and “share” shall have the respective meanings ascribed to them in the Applicable State Privacy Law. For avoidance of doubt, the obligations under this Section 10 are in addition to those obligations under Applicable Privacy Laws, as provided in this DPA.

10.2           Service Provider. Vendor is acting as a “service provider” or “processor” to Snowflake and will not (i) “sell” or “share” Personal Data, (ii) combine the Personal Data with any other Personal Data, unless expressly instructed to do so in writing by Snowflake for a specific purpose, and sole benefit of Snowflake or (iii) retain, use, or disclose Personal Data for any purpose (including any commercial purpose) other than for the specific purpose of (and solely to the extent necessary for) Vendor’s performance of the Services under the Agreement. Vendor certifies that it understands the preceding restrictions.

10.3           Level of Privacy Protection. Vendor shall provide the same level of privacy protection as required of businesses by Applicable State Privacy Laws. 

11.     REPRESENTATIONS

11.1           Vendor Representations. With respect to personal data or personal information that Vendor Processed on behalf of another party (e.g., in a ‘data processor’ or ‘service provider’ role), Vendor represents that:

(a)            Vendor has not had a security or privacy incident in the five (5) years preceding the date of this DPA;

(b)            Vendor is not aware of any complaints, objections, notices, or enforcement actions from a regulatory authority;

(c)            Vendor has and shall continue to maintain an internal privacy and/or data protection policy for handling personal data;

(d)            Vendor has and shall continue to maintain qualified individuals with designated responsibility for oversight and management of Vendor’s information security and privacy programs; and

(e)            Vendor has and shall continue to maintain cyber liability insurance of not less than five million dollars ($5,000,000 USD) per claim and in the aggregate, which covers security and privacy incidents arising from Processing of Personal Data by Vendor under the Agreement.

12.     LIABILITY

12.1           Losses. Subject to the applicable limitations of liability (if any) in the Agreement, Vendor acknowledges and agrees that it shall be liable for any loss, disclosure, or similar detrimental consequence of or to Personal Data to the extent such loss results from a Security Incident or any failure of Vendor (or its Sub-processors) to comply with its obligations under this DPA and/or Applicable Privacy Laws.

12.2           Material Breaches. The parties acknowledge and agree that a material breach by Vendor of this DPA shall constitute a material breach of the Agreement, in which event and without prejudice to any other right or remedy available to it, Snowflake may elect to immediately terminate the Agreement and this DPA, in whole or in part.

12.3           Liability to Data Subjects. In no event shall either party limit its liability with respect to any individual's data protection rights under this DPA (including the SCCs, if applicable) or otherwise.

13.     GENERAL

13.1           Survival. The obligations placed upon Vendor under this DPA shall survive so long as Vendor and/or its Sub-processors Processes Personal Data on behalf of Snowflake. The provisions contained in this DPA and its attachments, exhibits, appendixes and schedules that by their context are intended to survive termination or expiration will survive.

13.2           Modifications. This DPA may not be modified by the parties except by a subsequent written instrument signed by both parties.

13.3           Severability. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.

13.4           Order of Precedence. In the event of any conflict or inconsistency between this DPA and any other agreements between the parties, including the Agreement, the parties agree that this DPA governs. In the event of any conflict or inconsistency between this DPA and the SCCs or DPF (as applicable), the parties agree that the SCCs or DPF (as applicable) shall govern.

13.5           Prior Agreements. The parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment, exhibit, or standard contractual clauses that Snowflake and Vendor may have previously entered into in connection with the provision of Services.

13.6           Jurisdiction. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions set forth in the Agreement or this DPA (as applicable), unless otherwise required by, Applicable Privacy Laws.  

13.7           Counterparts. This DPA may be executed in two or more counterparts, each of which shall be deemed an original and all of which taken together shall be deemed to constitute one and the same document. The Parties may sign and deliver this DPA by facsimile or email transmission.

ANNEX 1

DESCRIPTION OF PROCESSING

Annex 1(A): List of parties

Annex 1(B): Description of the transfer

Annex 1(C): Competent supervisory authority

The supervisory authority of the Member State in which the data exporter's representative is established, namely the Netherlands.

ANNEX 2

SECURITY MEASURES

Description of the technical and organisational security measures implemented by Vendor (i.e., data importer) shall be as set forth in the Security Agreement as defined in the Agreement. 

ANNEX 3

List of Vendor's Sub-processors