Data Processing Addendum

Check Point Software Technologies Ltd, of Shlomo Kaplan, Tel-Aviv, Israel (“Check Point”) and you, an authorized distributor or authorized reseller of Check Point and the entity you represent (“Partner”) agree to the terms set out in this Data Processing Addendum (this “Addendum”). This Addendum shall become effective with respect to the Partner upon the effective date of the Agreement (as defined below) (the “Effective Date”), provided that this Addendum is incorporated to the Agreement by reference.

1. Definitions

1.1 Agreement

The agreement governing Partner’s relations with Check Point as follows:
(i) with respect a Partner which is distributor, such Partner’s Distribution Agreement with Check Point; and
(ii) with respect to a Partner which is a reseller of Check Point, Check Point’s Reseller Terms, as available at Check Point’s Partner MAAP and/or Check Point’s website, and/or any other agreement signed between such Partner and Check Point;
(iii) in the absence of such agreement or terms, this Addendum shall serve as a stand-alone agreement, provided that the following clauses of Check Point’s End-user License Agreement as available at Check Point’s website, shall be an integral part of, mutatis mutandis: Limited Warranty, Warranty Disclaimers and Limitation of Liability (currently, Section 7), Miscellaneous (Section 10.1, and Modifications (Section 10.7).

1.2 Affiliate

Any entity that directly or indirectly controls, is controlled by, or is under common control with the relevant Party.

1.3 Check Point Personal Data

Personal Data provided by Check Point to Partner or generated through Check Point’s portal and provided to Partner by Check Point.

1.4 Partner Personal Data

Personal Data provided by the Partner to Check Point or generated by Check Point in connection with the offering or provision of Check Point products and services by Partner to its customers and which is used solely by Check Point for the Permitted Purposes.

1.5 Data Protection Laws

All applicable laws and regulations relating to the processing of Personal Data including the Electronic Communications Data Protection Directive (2002/58/EC) and the EU’s General Data Protection Regulation (“GDPR”) (2016/679/EC), including all law and regulations implementing or made under them and any amendment or re-enactment of them. The terms “Controller”, “Personal Data”, “Process”, “Processor” and “Supervisory Authority” shall have the meanings given to them in the GDPR;

1.6 EU Standard Contractual Clauses

Means the model clauses incorporated into this Addendum under clause 9 (International Transfers of Data) for the transfer of Personal Data in the EU to third countries where the exporter is a Processor and the importer is a Sub-processor as approved by the European Commission by its Implementing Decision (EU) 2021/914 of June 04, 2021 or any additional replacement model clauses approved by the European Commission from time to time;

1.9 Privacy Policy

Check Point’s Privacy Policy, as available at Check Point’s public website (currently at: https://www.checkpoint.com/privacy/).

1.10 Sub-processor

A third Party engaged by Check Point or one of its Affiliates to undertake some or all of Check Point’s obligations under the Agreement, including but not limited to Processing of Personal Data;

1.11 UK Standard Contractual Clauses Addendum

Means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses incorporated into this Addendum under clause 9 (International Transfers of Data) for the transfer of Personal Data in the UK to third countries and where the exporter is a Controller and the importer is a processor as approved by the UK Government.

2. Processing of Personal Data

2.1 Roles of the Parties

The Parties acknowledge and agree that their respective roles shall be as follows:
• with regard to the Processing of Personal Data exchanged between the Parties, which includes the order details and contact details of the Partner’s personnel, and the Parties’ mutual customers and mutual partners, each Party acts as an independent and separate Controller.
• with regard to the Processing of Personal Data which relates to collaborative support, or any services provided by Partner to its customers in connection with Check Point’s products and services, each of Check Point and Partner is an independent and separate Processor. • with regard to the Processing of Personal Data exchanged between the Parties, which includes contact details of potential customers and partners (which are not mutual customers or partners of Parties), the disclosing Party shall act as a Controller, and the receiving Party shall act as Processor.
• Check Point or Check Point Affiliates may engage Sub-processors pursuant to this Addendum.

2.2 Party’s Processing of Personal Data

Each Party shall ensure that it processes Personal Data in accordance with the requirements of applicable Data Protection Laws. Each Party shall obtain all necessary authorizations, approvals, consent and permits required under Data Protection Laws for its respective Processing activities. Each Party shall rely on a valid legal ground under the Data Protection Laws for its Processing of Personal Data.

2.3 Check Point Processing of Personal Data

Check Point shall only Process Partner Personal Data in the following ways:
(i) Processing for the purposes of provision of the Check Point products and services and/or other Permitted Purposes and otherwise in accordance with the Agreement;
(ii) offering and provide support or technical services with respect to the Check Point products and services;
(iii) when Partner acts as Controller, Processing to comply with other documented reasonable instructions provided by the Partner; and/or (iv) as described in the Privacy Policy.

2.4 Partner Processing of Personal Data

Partner shall only Process Check Point Personal Data in the following ways:
(i) Processing for the purposes of provision of the Check Point products and services and/or other Permitted Purposes and otherwise in accordance with the Agreement;
(ii) offering and provide support or technical services with respect to the Check Point products and services; and
(iii) when Check Point acts as Controller, Processing to comply with other documented reasonable instructions provided by Check Point.

2.6 Data Protection Impact Assessment

Each Party shall assist the other Party with reasonable cooperation and assistance needed to fulfil obligations under the GDPR to carry out a data protection impact assessment related to such Party’s Processing of Personal Data but only to the extent that the other Party does not otherwise have access to the relevant information, and only to the extent that such information is available to Check Point.

2.7 Description of the Processing

Processing by Check Point

(i) Subject-matter of Processing, the nature and purpose of the Processing: the provision and/or offering of Check Point products and services to the Partner’s customers and/or or other Permitted Purposes.
(ii) Duration of the Processing: for as long as necessary in connection with the provision of Check Point products and services to the Partner’s customers and/or for the Permitted Purposes.
(iii) Types of Personal Data: the Partner can control the types of data it shares with Check Point.
(iv) Categories of Data Subjects: the Partner can control the types of Data Subjects whose Personal Data may be collected by Check Point.

Processing by Partner

(i) Subject-matter of Processing, the nature and purpose of the Processing: the provision and/or offering of Check Point products and services to the Partner’s customers.
(ii) Duration of the Processing: for as long as necessary in connection with the provision and/or offering of Check Point products and services to the Partner’s customers.
(iii) Types of Personal Data: contact details, and/or other information required for offering, providing, installing and supporting Check Point’s products and services.
(iv) Categories of Data Subjects: Partner’s customers, employees, and service providers.

1. Rights of Data Subjects

Each Party shall, to the extent legally permitted, promptly notify the other Party if it receives a request from a Data Subject to exercise the Data Subject's right of access, rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, or to not be subject to an automated individual decision or automated decision-making in relation to Partner Personal Data (each “Data Subject Requests”). In the event that a Party is not itself able to fully comply with the Data Subject Request, the other Party shall, at its cost, provide reasonable assistance to fulfil the obligation to respond to a Data Subject Request under Data Protection Laws.

2. Check Point Personnel

2.1 Confidentiality

Check Point shall ensure that its personnel engaged in the Processing of Partner Personal Data are informed of the confidential nature of the Partner Personal Data, have received appropriate training on their responsibilities and are subject to confidentiality undertakings.

2.2 Reliability

Each Party shall take commercially reasonable steps to ensure the reliability of any personnel engaged in the Processing of Partner Personal Data.

3. Sub-Processors

3.1 Sub-Processor Acknowledgment

The Partner acknowledges and agrees that when Partner serves as a Controller and Check Point serves as a Processor
(i) Check Point Affiliates may be used as Sub-processors; and
(ii) Check Point and Check Point Affiliates respectively may engage third-Party Sub-processors. Check Point shall appoint and make changes to Sub-processors at Check Point’s sole discretion subject to the terms and conditions of this Agreement. The list of Sub-processors is available at Check Point’s website (currently at: https://www.checkpoint.com/sub-processors-list/).

3.2 Partner as Processor

When Partner serves as a Processor and Check Point serves as a Controller, Partner shall not use any sub-Processor unless notified to Check Point in writing or another mechanism to be agreed by the Parties from time to time.

3.3 Objection Right for New Sub-processors

Where the Partner serves as a Processor and Check Point serves as a Controller, Check Point may object to Partner’s use of a new Sub-processor by notifying Partner promptly in writing within ten (10) business days after receipt from Partner of a written notice to change its Sub-processor. In the event the Partner objects to a new Sub-processor (limited to reasonable privacy considerations), Partner will not use such Sub-processor in connection with the Personal Data it processes as a Processor for Check Point in its capacity as a Controller.

3.4 Compliance

Each Party acting as a Separate Controller may engage or replace Sub-processors at its sole discretion without any obligation to notify or seek approval from the other Party. Each Party remains responsible for ensuring that its Sub-processors comply with applicable data protection laws.

4. Security

4.1 Controls for the Protection of Partner Data

Each Party shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing, and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Partner Personal Data), confidentiality, and integrity of Partner Personal Data. Specific description of technical and security measures applied to ensure the security of data at Check Point is available at https://www.checkpoint.com/privacy/security/ as updated from time to time.

4.2 Third-Party Certifications and Audits

Upon written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, each Party shall make available to the other Party (or the Partner’s independent, third-Party auditor that is not a competitor of Check Point) a summary of their most recent third-Party certifications and/or security related audits, as applicable; and as may be available in respect of the products and/or services being provided.

4.3 Right of Audit and Inspection

Upon prior request, each Party agrees to cooperate and within reasonable time afford to the other Party access on reasonable notice and at reasonable intervals (except where there has been an actual or reasonably suspected breach of this Addendum by Check Point), to books and records relevant to the Party’s Personal Data to ensure that the other Party is complying with its obligations under this Addendum.

5. Incident Notification

In case of a Personal Data Breach involving a Party Personal Data of a Party (in the capacity as a Controller Processor relations), the other Party shall notify such Party without undue delay, and use reasonable efforts to identify the cause of such Personal Data Breach and take those steps as reasonably practicable to remediate the cause of such Personal Data Breach.

7. International Transfers of Data

7.1 Transfer mechanisms for data transfers

The Parties acknowledge that either a Party or any of its sub-processors (as defined above under 1.5) may transfer Partner Personal Data to locations outside the European Economic Area and/or the UK. Where this is the case, and to the extent that the data is transferred to a country which does not ensure an adequate level of data protection within the meaning of Data Protection Law, such transfers shall be subject to the Module Three Transfer (processor to processor) terms in either the EU Standard Contractual Clauses or the UK Standard Contractual Clauses Addendum, as applicable.

7.2 Precedence of Clauses

In the event that there is a conflict between the provisions of this Addendum and the provisions of the UK Standard Contractual Clauses Addendum or EU Standard Contractual Clauses, as applicable, the provisions of the UK Standard Contractual Clauses Addendum or EU Standard Contractual Clauses, as applicable, shall take precedence.

7.3 Updates and Compliance

In the event that a relevant Supervisory Authority with jurisdiction over the Parties or this Addendum revises, updates or replaces the UK Standard Contractual Clauses Addendum or EU Standard Contractual Clauses, or requires transfers of Personal Data made pursuant to the standard contractual clauses to be suspended, the Parties will work in good faith to enter into updated standard contractual clauses or rely on an alternative safeguard under the Data Protection Laws in respect of such transfers.

8. Agreement

This Addendum supplements the Agreement. Except as explicitly amended herein all the other terms of the Agreement shall apply as an integral part hereto. This Addendum shall be valid only with respect to a Partner which is an authorized distributor or authorized reseller, and solely in the scope of distributing and/or reselling Check Point’s products and services to the Partner’s customers. When Partner uses any product or service for its internal usage or provides such products and services as a managed service provider to its service customers, Check Point’s Customers Data Processing Addendum shall apply (as currently available at: https://www.checkpoint.com/customersdpa/ ). Nothing in this Addendum grants authorization or right to distribute or resell Check Point’s products and services in any territory, and if Partner does not already hold such right, then it shall not be deemed a “Partner”, and this Addendum shall be null and void.