DORA ADDENDUM

THIS DORA ADDENDUM (the “DORA Addendum”) forms a binding and effective part of the Agreement (as defined below) and is entered into by and between: (1) the Red Sift contracting entity who is a counterparty to the Agreement (as determined in accordance with the terms and conditions thereof) (LEI: 984500LEI4D85F0C3A69) (“Red Sift”); and (2) the entity or other person who is a counterparty to the Agreement (“Customer”), together the “Parties” and each a “Party”.

HOW AND WHEN THIS DORA ADDENDUM APPLIES

If and to the extent DORA applies to Customer and Red Sift constitutes an ICT third-party service provider (as defined in Article 2(19) of DORA), then to the extent required by DORA, this DORA Addendum shall apply in accordance with its terms. If and where the DORA Addendum applies, to the extent of any inconsistency or conflict between any provision(s) of the Agreement and any provision(s) of the DORA Addendum, the relevant provision(s) of the DORA Addendum shall govern and prevail in preference to any relevant provision(s) of the Agreement.

1. INTERPRETATION

1.1 Definitions.

In this DORA Addendum the following terms shall have the meanings set out in this Paragraph  1, unless expressly stated otherwise:

“Agreement” means, as applicable, the End User Licence Agreement or any similar commercial agreement(s) entered into by the Parties with respect to the use of the Services.

“Competent Authority” means the competent authority having authority over Customer as determined pursuant to Article 46 of DORA.  

“Customer Handbook” means the handbook setting out, among other things, the standard Support terms and conditions in respect of each of the Cloud Services available here, as updated from time to time.

“DORA” means Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011.

“Insolvency Event” means, in relation to Red Sift, Red Sift: (i) becoming insolvent or unable to pay its debts; (ii) proposing a voluntary arrangement, having a receiver, administrator or manager appointed over the whole or any part of its business or assets; (iii) suffering the presentation of any petition, the making of any order or the passing of any resolution for its winding up (except for the purposes of a bona fide solvent amalgamation or reconstruction), bankruptcy or dissolution or otherwise proposing or entering into any composition or arrangement with its creditors or any class of them; (iv) ceasing to carry on business or claiming the benefit of any statutory moratorium; or (v) in respect of (i) to (iv), undergoing any similar or equivalent process in any jurisdiction. 

“Resolution Authority” means the competent resolution authority having authority over Customer as determined pursuant to Article 19(6)(d) of DORA.  

“Services” means those services to be provided by Red Sift to Customer under the Agreement if and to the extent that they amount to ICT Services.

In this DORA Addendum the terms “ICT-Related Incident”, “ICT Risk”, “ICT Services”, and “ICT Third-Party Risk” shall have the meaning ascribed to the corresponding terms in DORA; and unless otherwise defined in this DORA Addendum, all capitalised terms in this DORA Addendum shall have the meaning given to them in the Agreement.

2. SERVICES AND LOCATIONS

2.1 Services. The Parties acknowledge that the Agreement sets out a clear and complete description of all Services.

2.2 Locations. The Parties acknowledge that the Sub-Processor List (available here or any successor page) to the Agreement sets out (a) the locations, namely the regions or countries, from which the Services, including sub-contracted functions, are provided; and (b) the locations where Customer Data is processed, including storage location (the locations in (a) and (b) together, the “Locations”). Notices regarding changes to any Locations shall be made through the mechanism provided for in Section 7.2 and 7.3 of the DPA.

2.3 Service Levels. Red Sift shall perform the Services so as to meet or exceed any relevant service levels as set out from time to time in the Customer Handbook (the "Service Levels"). Changes to the Service Levels shall become effective within thirty (30) days of referral of this matter to the Customer.

3. RED SIFT OBLIGATIONS

3.1 Security. Red Sift has implemented the security measures set out in Annex 3 (Security Measures) to the DPA of the Agreement (“Security Measures”) designed to protect the availability, authenticity, integrity and confidentiality of Customer Data. Customer Data shall be protected by the Security Measures to the same extent as Customer Personal Data. Red Sift may freely update or modify these Security Measures from time to time provided that such updates and modifications do not materially decrease the overall security of the Customer Data.

3.2 ICT-Related Incident Assistance. In the event of an ICT-Related Incident arising in relation to the Services, Red Sift shall without undue delay inform Customer of the ICT-Related Incident and provide reasonable assistance to Customer in the event of an ICT-Related Incident that is related to the Services (“Incident Assistance”). The cost of providing Incident Assistance shall be chargeable by Red Sift to Customer and shall be calculated on a time and material basis by applying Red Sift’s then-current rates for consultancy services.

3.3 Co-operation with Competent Authorities and Resolution Authorities. As far as reasonably practicable and to the extent it is permitted to do so by applicable law and regulatory requirements, Red Sift shall provide full cooperation in respect of the Services to Customer’s Competent Authorities and Resolution Authorities, including persons appointed by them, on a time and material basis by applying Red Sift’s then-current rates for consultancy services. 

3.4 Training. Where appropriate, and if reasonably requested by Customer on reasonable advance written notice, Red Sift shall procure that its personnel participate in Customer's relevant ICT security awareness programs and digital operational resilience training schemes relevant to the Services. The conditions for the participation of Red Sift’s personnel in such programs and training schemes shall be agreed in writing in advance between Red Sift and Customer reasonably in advance, provided however that it will be at Red Sift’s discretion (acting reasonably and in good faith) which personnel should attend. Red Sift may charge Customer all reasonable costs and expenses incurred by Red Sift in complying with the obligations set out in this Paragraph 3.4 and shall be charged on a time and material basis by applying Red Sift’s then-current rates for consultancy services.

4. TERMINATION AND CONSEQUENCES OF TERMINATION

4.1 Termination. Notwithstanding anything to the contrary set out in the Agreement, Customer may terminate the Agreement in respect of the affected Services on written notice to Red Sift: 

(i) if Red Sift commits a material breach of (a) applicable laws and regulations, or (b) any provisions of the Agreement, related to the performance of the Services which is incapable of remedy, or, if capable of remedy, Red Sift fails to remedy such breach within thirty (30) days after receipt of a written notice specifying the breach and requiring it to be remedied; 

(ii) if circumstances exist which are identified by or on behalf of Customer through its authorized monitoring of ICT Third-Party Risk, that would alter Red Sift’s performance of the Services in a manner that would have a material adverse effect on Customer or its business with respect to ICT Third-Party Risk, including material changes that affect the arrangement or situation of Red Sift relevant to ICT Third-Party Risk; 

(iii) in the event of evidenced weakness relating to Red Sift’s overall ICT Risk management, in particular in respect of the measures implemented to protect the availability, authenticity, integrity and confidentiality of Customer Data; or 

(iv) where the Competent Authority can no longer effectively supervise Customer as a result of the conditions of, or circumstances related to, the Agreement.

Any termination in accordance with this Paragraph 4.1 shall take effect only after receipt of a written notice specifying the facts, matters or circumstances giving rise to the termination notice (in complete and accurate detail) and requiring remediation, and Red Sift having failed to remedy such facts, matters or circumstances within sixty (60) days after receipt of that written notice.

4.2 Consequences of Insolvency, Resolution, Discontinuation of the Services or Termination. Upon the occurrence of an Insolvency Event or upon the termination of the Agreement, Red Sift shall, at Customer’s option, either return to Customer or securely delete or anonymize (and certify this in writing), all Customer Data within the control of Red Sift. Red Sift shall return any physical copies of Customer Data in its extant format and any electronic copies of Customer Data in an easily accessible format. Notwithstanding the foregoing, Customer Data in archival systems shall be deleted in line with Red Sift’s standard back-up deletion routines. This Paragraph 4.2 shall survive termination or expiry of the Agreement.

5. INCORPORATION AND PRECEDENCE

This DORA Addendum shall be incorporated into and form part of the Agreement. In the event of any conflict or inconsistency between this DORA Addendum and the Agreement, this DORA Addendum shall prevail to the extent of such conflict or inconsistency relating to the DORA Addendum.