10. MISCELLANEOUS
10.1 To the extent permitted by Applicable Law, any claims brought under or in connection with this DPA will be subject to the exclusions and limitations of liability set forth in the Agreement.
10.2 Except as expressly permitted by the SCCs or other applicable transfer instruments, no one other than a Party to this DPA will have any right to enforce its terms, but each Party may enforce its terms on behalf of its Affiliates, if applicable.
10.3 Except as otherwise specified herein, this DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement.
10.4 This DPA will remain in force as long as We Process Customer Personal Data under the Agreement.
SCHEDULE 1
ANNEX I to the Standard Contractual Clauses
A. LIST OF PARTIES
Module Selection
Select Applicable SCC Module
Module One: Controller to Controller
✓ Module Two: Controller to Processor
Module Three: Processor to Processor
Module Four: Processor to Controller
Data exporter(s):
Name: The entity identified as “Customer” in the DPA.
Address: The address for Customer associated with its account or as otherwise specified in the DPA or the Agreement.
Contact person’s name, position, and contact details: The contact details associated with Customer’s account, or as otherwise specified in the DPA or the Agreement.
Activities relevant to the data transferred under these Clauses: The activities are specified in Section 2 of the DPA.
Signature and date: By using the Online Services or products the data exporter will be deemed to have signed this Annex I.
Role (controller/processor): Controller.
Data importer(s):
Name: Ryan as identified in the DPA.
Address: The address for Ryan is specified in the Agreement.
Contact person’s name, position, and contact details: The contact details for Ryan are specified in the DPA or the Agreement.
Activities relevant to the data transferred under these Clauses: The activities are specified in Section 2 of the DPA.
Signature and date: By transferring Customer Personal Data to Third Countries on Customer’s instructions, the data importer will be deemed to have signed this Annex I.
Role (controller/processor): Processor
B. Details of Data Processing
Categories of data subjects whose personal data is transferred: | Customer Personal Data may relate to the following categories of natural persons: 1. Prospects, customers, business partners, and vendors of Customer (who are natural persons). 2. Employees or contact persons of Customer’s prospects, customers, business partners, and vendors. 3. Customer’s employees, agents, advisors, contractors, and freelancers (who are natural persons). 4. Any other natural persons whose information Customer uploads, transmits, or otherwise provides to the Online Services consistent with the Agreement. |
Categories of personal data transferred: | Customer Personal Data may include, without limitation: • Business contact information (e.g., name, title, company, work email, work phone). • IP address and other online identifiers or system-generated metadata. Login, account ID, and authentication-related information. |
SCHEDULE 2
ANNEX II to the Standard Contractual Clauses
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
Ryan, LLC (“Ryan,” “We,” “Us”) offers a wide variety of business tax solutions through its tax.com™ platform and operating division. This Annex II sets forth the baseline contours of the information security posture with respect to these solutions. Online Services obtained through an Order Form may include additional security measures as appropriate for the sensitivity of the data and nature of the engagement. The definitions set forth in the Agreement will have the same meaning in this Annex II, except or as otherwise defined herein. Nothing in this Annex II alters the obligations or rights under the Agreement concerning Customer Data.
Information Security Program
Information Security Program. We maintain an enterprise-wide information security program that utilizes documented policies, procedures, and standards to protect the confidentiality, integrity, and availability of information and data in electronic and tangible form. We designed the information security program based on ISO/IEC 27001 standards.
Organizational and Administrative Security /Risk Management
Information Security Policies. We maintain internal, documented, comprehensive information security policies, including incident response plans, data retention plans, and segregation of duties policies, and regularly review and update them.
Employee Screening. Ryan ensures that all of its employees handling Customer Data have undergone a background screening, to the extent permissible under local laws and regulations.
Awareness and Education Program. We provide security awareness and technology use training for employees, at hire and annually, including routine anti-phishing training.
Vendor Management. We subject vendors authorized to perform services on Our behalf involving Our systems, data, or technology to (1) a risk assessment process, (2) obligations of confidentiality, and (3) restrictions on such vendor’s access to Personal Data consistent with Applicable Data Protection Laws and Our security requirements. We remain responsible for the compliance of its subcontractors with the terms of this Annex II.
Business Continuity/Disaster Recovery. We maintain and regularly test a business continuity and disaster recovery program designed to reduce the effects of a significant disruption in operations based on generally accepted industry practices.
Data Disposal. We maintain internal, documented, comprehensive data retention and disposal policies.
Data Security
Authentication. We logically segregate Customer Data by application security group access rules. Customer accounts must utilize unique usernames and complex passwords and enter them at each login to Our resources.
Passwords. We demand minimum password length, complexity, and expiration requirements, disabling features for failed login attempts, and rejection of previously used passwords.
Encryption at Rest. We encrypt Our employees’ laptop full disk drives using at least AES-256 for data encryption. We encrypt all non-public Customer Data in the hosted systems using at least AES-256 for data encryption.
Encryption in Transit. By default, Our web-accessible Online Services have Transport Layer Security (TLS) enabled to encrypt Your traffic. Our web application endpoints use TLS for secure transport.
Access. We operate the Online Services in a multitenant architecture designed to segregate and restrict Your data access based on business needs. We assign access controls to Personal Data in our databases, systems, and environments on a need-to-know / least privilege necessary basis. We employ multi-factor authentication (MFA) controls or similar compensating controls to limit access.
Device Access. We limit network access to authorized devices only. We prohibit access to systems with Customer Data from mobile devices.
Physical Security
Data Center. We host critical information systems and Our product platform in high-security data centers that meet SSAE18 and ISO 270001 standards. Data center security includes physical security measures designed to minimize disruption and prevent theft, tampering, and damage including:
Fire detection systems, and
Dedicated cages for Ryan to separate our equipment from other tenants in the data center.
Facilities. We protect Our public workplace facilities using entry and authentication controls as technically and commercially feasible, such as visitor logs, automated badging access controls, color-coded badges with photo ID, keyed entries, alarmed access points, and security cameras. Additional restricted access requirements exist for Our computer systems’ rooms. We maintain a documented clear desk policy.
Availability Control
Connectivity. We maintain fully redundant IP network connections with multiple independent connections to a range of Tier 1 Internet access providers for Our data centers.
Power. Our servers possess redundant internal and external power supplies. Our data centers can draw power from multiple substations on the grid, backup generators, and backup batteries in the event of power failures.
Uptime. We continuously monitor uptime, with escalation to Our staff for any downtime.
Backup Frequency. Our system backups occur at least daily to geographically disparate sites.
Disaster Recovery. We establish system recovery times on a product-line basis, but at a minimum no later than 8 hours.
Network Security
Firewalls. We route network traffic through firewalls to restrict access to approved ports.
Intrusion Prevention. We use Network and Host-based Intrusion Prevention systems (NIPS/HIPS).
End Point Controls. We protect its systems from malware/viruses utilizing enterprise-class endpoint control software.
E-mail Systems. We scan email using an enterprise-class email security gateway system.
Access Control. We protect workstations and laptops from unauthorized access via secure VPN and 2FA (two-factor authentication). We enforce role-based access control (RBAC) for systems management. Network devices are configured to prevent unauthorized updates via access controls and limit access to authorized individuals.
Logging and Auditing. We maintain security audit logs on our computing systems that process and store information that captures key security events including suspicious system and /or user behaviors.
Change Management and Application Control
Application Control. We maintain policies and procedures for managing changes and updates to production systems, applications, and databases, including processes for documenting security patching, authentication, and testing and approval of changes into production.
Key Management. We maintain a key management program that addresses the need to promptly revoke or disable lost, corrupted, or expired keys.
Coding Practices. We use logically or physically separate environments for development, testing, and production. Our developers undergo secure development training on best practices twice annually.
Secure Development. We employ a secure software development methodology that incorporates security throughout the systems development lifecycle in connection with the development and maintenance of its information systems. Minimally, applications have controls to protect against known vulnerabilities and threats, and secure coding standards are employed that comply with industry standards such as the Open Web Application Security Project (OWASP).
Vulnerability Management
Patching. We apply the latest security patches to all operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities.
Third-Party Scans. We continuously scan Our environments using industry-leading security tools. These tools provide configured network vulnerability assessments, which test for patch status and basic misconfigurations of systems and sites.
Penetration Testing. We perform penetration tests of Ryan applications using qualified independent third parties; Our hosting service providers perform penetration tests on their own infrastructure.
Program. We maintain a Vulnerability Management program in which risk analyses are performed for critical systems and requirements exist for prompt response to critical incidents.
Security Incident Management
Security Incident Management Process. Our controls include a Chief Information Security Officer (CISO) tasked with maintaining a comprehensive information security program built on a multi-layered, defense-in-depth approach to security. We maintain an internal, documented, comprehensive information security incident management process in place based on an incident framework that includes key elements (e.g., identification, response, recovery, and post-incident review) to be followed in the event of a Security Incident.
SCHEDULE 3
ANNEX III to the Standard Contractual Clauses
SUB-PROCESSORS
I. SUB-PROCESSOR LIST
The following table identifies the sub-processors currently authorized by Ryan, LLC, its Affiliates, and its tax.com operating division to process Customer Personal Data for Our Online Services. This list is also made available at: https://ryan.com/trust-center/legal-compliance/subprocessors (or any successor URL designated by Ryan).
Name | Description | Location |
Microsoft Azure | Cloud computing, hosting, platform services | U.S., Canada, E.U. |
AWS | Cloud computing and storage | U.S. |
Cloudera | |
II. SUBSCRIPTION TO SUB-PROCESSOR UPDATES AND RIGHT TO OBJECT
1. Notice of New or Replacement Sub-Processors
Ryan may update the list of Sub-Processors from time to time as necessary to support the Online Services.
Ryan will provide Customer with advance notice of any intended addition or replacement of a Sub-Processor by:
Email notification to the Customer contact on record;
Posting an update on the Ryan Trust Center; or
Any other reasonable method permitted under the Agreement.
2. Customer Right to Object
If Customer objects to a new Sub-Processor on reasonable data protection grounds:
Customer must notify Ryan in writing within the time period specified in the Agreement or in the Sub-Processor notice;
The Parties will work together in good faith to address Customer’s concerns through:
alternative technical measures,
avoidance of the Sub-Processor for Customer’s instance, or
other mutually agreed mitigation measures.
If no resolution is commercially feasible:
Customer may terminate the affected Online Service(s) in accordance with the Agreement; and
Ryan will refund any prepaid fees for the terminated portion, if required under the Agreement.
3. Responsibility for Sub-Processors
Ryan remains responsible for:
ensuring Sub-Processors are bound by written agreements with obligations no less protective than those in this DPA; and
the performance of Sub-Processors’ obligations as between Ryan and Customer.
III. ADDITIONAL INFORMATION REQUIRED BY THE SCCs
For purposes of Annex III to the Standard Contractual Clauses:
Subject matter: Processing necessary to support the Online Services.
Nature and duration: Same as described in Schedule 1 (Annex I) and for as long as the Sub-Processor is engaged.
Type of Processing: Hosting, storage, transmission, backup, support, analytics, troubleshooting, logging, security monitoring, and related service operations.
Categories of Personal Data: As described in Schedule 1 (Annex I).
Security Measures: As described in Schedule 2 (Annex II).
