Common use of Content and Data Protection Clause in Contracts

Content and Data Protection. a. Content consists of all data, software, and information that Client or its authorized users provides, authorizes access to, or inputs to the Cloud Service or information or data Client may provide, make available or grant access to, in connection with IBM providing other Services, such as consulting, maintenance, or Program support. Providing Content or otherwise using Cloud Services will not affect Client’s ownership or license rights in such Content. IBM, its affiliates, and contractors of either may access and use the Content solely for the purpose of providing and managing the applicable Cloud Services or other Services. IBM will treat all Content as confidential by not disclosing Content except to IBM employees and contractors and only to the extent necessary to deliver the Cloud Services or perform other Services. b. Client is responsible for obtaining all necessary rights and permissions to enable, and grants such rights and permissions to, IBM, its affiliates, and contractors of either to use, provide, store and otherwise process Content in the Cloud Services or other Services. This includes Client providing required information, making necessary disclosures and obtaining consent, if required, before providing individuals’ information, including personal or other regulated data in such Content. Client is responsible for adequate back-up of Content. If any Content could be subject to governmental regulation or may require security measures beyond those specified by IBM for Cloud Services or other Services, Client will not input, provide, or allow access to such Content unless specifically permitted in the terms of the relevant TD or unless IBM has otherwise first agreed in writing to implement additional security and other measures. c. IBM’s Data Security and Privacy Principles for IBM Cloud Services (DSP), at hxxx://xxx.xxx.xxx/xxxxx/data-security, apply for generally available Cloud Service offerings. Specific security features and functions of a Cloud Service may be provided in an Attachment and TDs. Client is responsible to assess the suitability of each Cloud Service for Client’s intended use and Content and to take necessary actions to order, enable, or use available data protection features for a Cloud Service appropriate for the Content being used with a Cloud Service. By using the Cloud Service, Client accepts responsibility for use of the Cloud Services, and acknowledges that it meets Client's requirements and processing instructions to enable compliance with applicable laws. d. IBM’s Data Processing Addendum at hxxx://xxx.xxx/xxx (DPA) and applicable DPA Exhibit(s) apply to personal data contained in Content, if and to the extent: i) European General Data Protection Regulation (EU/2016/679) (GDPR); or ii) other data protection laws identified at hxxx://xxx.xxx/xxx/dpl apply. e. Upon request by either party, IBM, Client, affiliates of either, will enter into additional agreements as required by law in the prescribed form for the protection of personal or regulated personal data included in Content. The parties agree (and will ensure that their respective affiliates agree) that such additional agreements will be subject to the terms of the Agreement. f. IBM will return or remove Content from IBM computing resources upon the expiration or cancellation of the Cloud Service, other Services, or earlier upon Client’s request. IBM may charge for certain activities performed at Client’s request (such as delivering Content in a specific format). IBM does not archive Content, however some Content may remain in backup files until expiration of such files as governed by IBM’s backup retention practices.

Content and Data Protection. a. Content consists of all data, software, and information that Client or its authorized users provides, authorizes access to, or inputs to the Cloud Service or information or data Client may provide, make available or grant access to, in connection with IBM providing other Services, such as consulting, maintenance, or Program support. Providing Content or otherwise using Cloud Services will not affect Client’s ownership or license rights in such Content. IBM, its affiliates, and contractors of either may access and use the Content solely for the purpose of providing and managing the applicable Cloud Services or other Services. IBM will treat all Content as confidential by not disclosing Content except to IBM employees and contractors and only to the extent necessary to deliver the Cloud Services or perform other Services. b. Client is responsible for obtaining all necessary rights and permissions to enable, and grants such rights and permissions to, IBM, its affiliates, and contractors of either to use, provide, store and otherwise process Content in the Cloud Services or other Services. This includes Client providing required information, making necessary disclosures and obtaining consent, if required, before providing individuals’ information, including personal or other regulated data in such Content. Client is responsible for adequate back-up of Content. If any Content could be subject to governmental regulation or may require security measures beyond those specified by IBM for Cloud Services or other Services, Client will not input, provide, . or allow access to such Content unless specifically permitted in the terms of the relevant TD or unless IBM has otherwise first agreed in writing to implement additional security and other measures. c. IBM’s Data Security and Privacy Principles for IBM Cloud Services (DSP), at hxxx://xxx.xxx.xxx/xxxxx/data-securityxxxx://xxx.xxx.xxx/cloud/data-security, apply for generally available Cloud Service offerings. Specific security features and functions of a Cloud Service may be provided in an Attachment and TDs. Client is responsible to assess the suitability of each Cloud Service for Client’s intended use and Content and to take necessary actions to order, enable, or use available data protection features for a Cloud Service appropriate for the Content being used with a Cloud Service. By using the Cloud Service, Client accepts responsibility for use of the Cloud Services, and acknowledges that it meets Client's requirements and processing instructions to enable compliance with applicable laws. d. IBM’s Data Processing Addendum at hxxx://xxx.xxx/xxx xxx.xxx.xxx/xxx (DPA) and applicable DPA Exhibit(s) apply to any personal data contained in Contentthat the Government requires IBM to process, if and to the extent: i) the European General Data Protection Regulation (EU/2016/679) (GDPR); or ii) other data protection laws identified at hxxx://xxx.xxx/xxx/dpl xxxx://xxx.xxx/dpa/dpl apply. Please contact your IBM representative for the applicable Data Processing Exhibit. For Cloud Services, the applicable Data Processing Exhibit(s), known as a “Data Sheet”, may be accessed here: xxxx://xxx-00.xxx.xxx/software/sla/sladb.nsf/sla/dpa/ For Technical Support Services (TSS) and Software Subscription and Support (S&S), the applicable Data Processing Exhibit may be accessed here: xxxxx://xxx.xxx.xxx/mysupport/s/article/support- privacy?language=en_US For other IBM Products Services, including custom IT Professional Services, please contact your IBM representative for the applicable Data Processing Exhibit. e. Upon request by either party, IBM, Client, affiliates of either, will enter into additional agreements as required by law in the prescribed form for the protection of personal or regulated personal data included in Content. The parties agree (and will ensure that their respective affiliates agree) that such additional agreements will be subject to the terms of the Agreement. f. IBM will return or remove Content from IBM computing resources upon the expiration or cancellation of the Cloud Service, other Services, or earlier upon Client’s request. IBM may charge for certain activities performed at Client’s request (such as delivering Content in a specific format). IBM does not archive Content, however some Content may remain in backup files until expiration of such files as governed by IBM’s backup retention practices.