DORA ADDENDUM
This addendum (“DORA Addendum”) is incorporated into the Data Protection Addendum (“DPA”), which forms part of the Services Agreement that governs Customer’s use of Egnyte’s Services (“Agreement”). This DORA Addendum shall apply solely to the extent Customer is subject to DORA and solely to the extent any provisions of this DORA Addendum are applicable to Egnyte in its delivery of Customer’s purchased Services under the Agreement. This DORA Addendum supplements, and remains subject to the terms of, the Agreement.
Definitions
Capitalized terms that are used but not defined in this DORA Addendum have the meanings given to them in the DPA and/or the Agreement.
“DORA” means Regulation (EU) 2022/2554, otherwise known as the Digital Operational Resilience Act, that covers digital operational resilience for Financial Entities.
“Financial Entity” means an entity captured by Article 2 of DORA, for so long as such an entity remains subject to DORA.
“ICT-related Incident” and “ICT Services” shall have the meanings set forth under DORA.
“Regulator” means a government, regulatory body, or competent authority with binding authority to regulate Customer’s activities as a Financial Entity to the extent such activities directly implicate purchased Services under the Agreement.
Agreement to DORA’s Key Contractual Provisions
The parties hereby agree, to the extent applicable, that the delivery of Egnyte’s Services is subject to the following key contractual provisions as set forth in Article 30 of DORA.
Description of functions and ICT Services – Art. 30(2)(a). All functions and services are described and set forth in the applicable Agreement (including relevant Documentation) and Order Form.
Service Location – Art. 30(2)(b). The locations where the Egnyte Services are provided shall be as configured by the domain Administrator and can be viewed within domain settings. A link detailing Egnyte’s subcontractors is included within the DPA.
Availability, Authenticity, Integrity, and Confidentiality of Customer Content – Art. 30(2)(c). As set forth in the DPA, Egnyte will employ and maintain security protections in accordance with industry standards, including, but not limited to, technical and organizational measures to protect the availability, authenticity, integrity, and confidentiality of Customer Content.
Access, recovery and return in an easily accessible format of Customer Content – Art. 30(2)(d). In the event of a Egnyte insolvency, resolution in bankruptcy, or discontinuation of Egnyte’s business that results in termination of the Egnyte Services, Egnyte will provide reasonable assistance to access, recover, and retrieve Customer Content in an orderly manner. Subject to the Agreement, Content shall be accessible throughout a paid Subscription Term, and the destruction of Content following termination shall be as stated in the Agreement.
Service Level Descriptions – Art. 30(2)(e). Egnyte’s service levels for the Services are as stated in the SLA linked within the Agreement.
Assistance in the Event of an ICT-related Incident – Art. 30(2)(f). As described in the DPA, if Egnyte becomes aware of an ICT-related Incident, Egnyte will promptly notify Customer without undue delay, and Egnyte shall promptly take reasonable steps to investigate, mitigate, and remediate the ICT-related Incident. Egnyte’s notice to Customer shall include, to the extent known, the nature and consequences of the ICT-related Incident, the measures taken and/or proposed by Egnyte to mitigate or contain the ICT-related Incident, the status of Egnyte’s investigation, and the categories and approximate number of data records concerned. For clarity, communications by Egnyte in connection with an ICT-related Incident are not an acknowledgement by Egnyte of fault or liability with respect to the ICT-related Incident.
Cooperation – Art. 30(2)(g). Taking into account the nature of Egnyte Services and information provided by Customer to Egnyte, Egnyte shall, to the extent strictly required under applicable law and to the extent Customer cannot assist such authorities independently, cooperate with the competent authorities and the resolution authorities of Customer.
Termination Rights – Art. 30(2)(h) and Art. 28(7).
The termination provisions of the Agreement shall remain unaffected.
In addition to the termination provisions of the Agreement, in the following circumstances, Customer may terminate this Addendum and the impacted Egnyte Services by providing written notice to Egnyte:
where Egnyte is in material breach of its contractual obligations under this Addendum and where Egnyte fails to correct such breach within thirty (30) days of Egnyte’s receipt of notice from Customer specifying the breach in sufficient detail for Egnyte to understand Customer’s concern and the nature of the breach;
where Customer provides Egnyte with written evidence of a material deficiency in Egnyte’s ICT risk management and, in particular, in the way Egnyte ensures the availability, authenticity, integrity, and confidentiality of Customer Content (whether personal or otherwise sensitive data, or non-personal data) and where Egnyte fails to take reasonable steps to remediate such deficiency within thirty (30) calendar days of Egnyte’s written receipt of notice from Customer specifying the deficiency in sufficient detail for Egnyte to understand Customer’s concern and the nature of the deficiency; or
where a Regulator can no longer effectively supervise Customer as a result of the conditions of, or circumstances related to, the contractual arrangements between Egnyte and Customer concerning the Egnyte Services and where such Regulator mandates that Customer terminate the Agreement with respect to such Services. If exercising a termination right under this Section 2(h)(ii)(3), Customer must provide Egnyte with written evidence of such mandate from the Regulator.
Training – Art. 30(2)(i). Egnyte shall maintain security awareness programs and digital operational resilience training appropriate for the purpose of Art. 13(6) of DORA. Where additional training is strictly required under applicable law, Customer may, subject to mutually agreed terms, request that Egnyte personnel participate in Customer’s virtual security awareness programs or digital operational resilience training, as appropriate and relevant to the Services.
ICT Services supporting Critical or Important Functions – Art. 30(3). Solely to the extent the Egnyte Services support critical or important functions, as defined under DORA, the following provisions shall apply:
Service Level Descriptions – Art. 30(3)(a). The service levels and performance targets for the Services are as described in the Agreement and, in particular, the SLA linked therein.
Notification of Material Impact - Art. 30(3)(b). Egnyte will notify Customer, in accordance with the Agreement, in the event of any development that, in Egnyte’s reasonable judgment, might have a material impact on Egnyte’s ability to effectively provide the ICT Services supporting critical or important functions in line with agreed service levels under the Agreement.
Business Contingency Plans - Art. 30(3)(c). Egnyte shall implement and routinely review and test business contingency plans, as well as maintain security measures, tools, and policies for the ICT Services that provide an appropriate level of security for the provision of Services under the Agreement.
Threat-Led Penetration Testing (TLPT) - Art. 30(3)(d). To the extent strictly required under applicable law and in all cases without derogating from Egnyte’s confidentiality and security obligations to other entities (including other customers), Egnyte will participate and cooperate with Customer’s requests for information regarding independent threat-led penetration testing that Egnyte has conducted as part of its routine auditing processes, including a summary of findings or any reasonably requested attestations, along with other auditing documentation that Egnyte maintains in the normal course of business. Customer acknowledges, agrees, and confirms that, absent a specific mandate from a Regulator to the contrary, the delivery of such materials upon request by Egnyte shall satisfy the requirements of Articles 26 and 27 of DORA.
Right to Monitor - Art. 30(3)(e). As further described in the DPA, to the extent strictly required under applicable law, and subject to Egnyte’s confidentiality and security protocols, Egnyte’s performance under the Agreement – as evidenced by the documentation provided and/or generated by Egnyte in the normal course of providing its Services – may be monitored as follows:
unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority, and the right to take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider;
the right to agree on alternative assurance levels if other customers’ rights are affected;
the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by the competent authorities, the Lead Overseer, financial entity, or an appointed third party; and
the obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits;
Transition Period - Art. 30(3)(f). In the event that Customer cannot complete its transition away from Egnyte prior to the termination of the Agreement, the parties will work in good faith to mutually agree to a paid transition period, during which the Services will be maintained until such transition is complete. This transition period shall remain subject to Customer’s payment of then-current fees for the duration of the transition period. Egnyte shall have no obligation to assist with such transition absent a mutually executed Statement of Work to such effect.
With respect to Section 2.d, 2.f [above and beyond what is required under the Agreement], and 2.i, as well as for any other items in this DORA Addendum where permissible under applicable law, in order to receive assistance from Egnyte in connection with the exercise of the rights thereunder, Customer agrees to pay any fees, costs, and expenses for such assistance as reasonably determined by Egnyte.