Legal and Terms of Use

Spectra Logic Corporation and its subsidiaries (“Spectra”) make information and products available on this web site subject to the following terms and conditions. If you continue to browse and use this website you are agreeing to comply with and be bound by the following terms and conditions of use govern Spectra’s relationship with you in regards to accessing this web site. Spectra reserves the right to change these terms and conditions at any time, at its sole discretion, without notice. Spectra reserves the right to seek all remedies available by law and in equity for any violation of these terms and conditions. Any rights not expressly granted herein are reserved.

Contracts

The Customer Purchase Agreements – North America, EMEA, Asia-Pacific/Japan, Master Services Agreement, and Master License Agreement set forth the terms and conditions governing the purchase of Spectra products, the provision of services by Spectra, and licensing of software. Previously executed purchase, support, and license  agreements setting forth terms of purchase and/or license of products, and/or services from Spectra by end user purchasers (“Customer”) in effect at the time of purchase will take precedence over these Terms and Conditions. Otherwise, Spectra’s assent to any agreement between Spectra and Customer for any sale of license of products or services in connection with a Spectra Sales Quote (“Quote”) is expressly conditioned on Customer’s assent to the terms and conditions of the agreements referenced above. Customer’s assent will be conclusively presumed if Customer responds by issuance of a purchasing document. Any different, conflicting, or additional terms in Customer’s purchasing document are objected to and deemed rejected unless expressly approved in writing by an executive officer of Spectra and Customer.

Copyright

The information on this web site is protected by copyright. Except as specifically permitted, no portion of this web site may be distributed or reproduced by any means, or in any form, without Spectra’s prior written permission.

Copyright Notice © 2024 Spectra Logic Corporation. All rights reserved.

Trademarks

All product names, whether or not appearing in large print or with the trademark symbol, are trademarks of Spectra, its affiliates, related companies or its licensors or joint venture partners, unless otherwise noted. The use or misuse of these trademarks or any other materials, except as permitted herein, is expressly prohibited and may be in violation of copyright law, trademark law, the law of slander and libel, the law of privacy and publicity, and communications regulations and statutes. Please be advised that Spectra actively and aggressively enforces its intellectual property rights to the fullest extent of the law.

New Products

Spectra uses new or equivalent to new products in all new products sold.

Disclaimers

All information provided via this web site, including, without limitation, any product or service plans, software programs, software code, offerings, programs, statements of future directions, “white papers,” or other technical or marketing materials (collectively, “Information”) is intended for informational purposes only and is subject to change or withdrawal by Spectra at any time, at its sole discretion, without notice. Spectra assumes no responsibility for the accuracy or completeness of the Information. THE INFORMATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. SPECTRA FURTHER DISCLAIMS ANY LIABILITY IN CONNECTION WITH THE WEB SITE OR THE INFORMATION PROVIDED HEREIN. Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you. IN NO EVENT WILL SPECTRA BE LIABLE TO ANY PARTY FOR ANY DIRECT, INDIRECT, SPECIAL, OR OTHER CONSEQUENTIAL DAMAGES FOR ANY USE OF THE WEB SITE, THE INFORMATION, OR ANY OTHER HYPERLINKED WEB SITE, INCLUDING, WITHOUT LIMITATION, ANY LOST PROFITS, BUSINESS INTERRUPTION, LOSS OF PROGRAMS OR OTHER DATA ON YOUR INFORMATION HANDLING SYSTEM OR OTHERWISE, EVEN IF SPECTRA IS EXPRESSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Use of Information

Spectra hereby authorizes you to view, print, copy, and distribute Information published by Spectra on this web site; provided that (a) the Information may not be modified in any way; (b) no fee may be charged for distribution of any Information to any third party; (c) the Information may be used solely for informational, personal, and non-commercial purposes; (d) any and all copyright and other proprietary notices that appear herein, together with this Legal Notice, must appear on all copies that you make or distribute of the Information; and (e) Spectra reserves the right to revoke such authorization at any time.

For purposes of the foregoing, “Information” does not include the layout or design of this web site. Elements of this site are protected by trade dress or other laws and may not be imitated or reproduced in whole or in part. Further, “Information” does not include logos, graphics, sounds, or images on this web site, which may be reproduced or distributed only when expressly permitted by Spectra.

Third-Party Web Sites

This web site may provide links to third-party web sites that are not under Spectra’s control. Spectra makes no representations about such third-party web sites, and if you access such a third-party web site, you do so at your own risk. Spectra is not responsible for the reliability of any data, opinions, advice, or statements made on any third-party web site(s). The inclusion of such links does not imply that Spectra endorses, recommends, or accepts any responsibility for the content of any such third-party web site(s).

Third Party Products and Services

This web site may mention third-party products or services for informational purposes. Spectra makes no recommendations or endorsements about third-party products and services. References to third-party products and services are provided by Spectra “as is” without warranty of any kind, either express or implied. Should a customer migrate data to the public cloud as a storage target using a Spectra product, Spectra is not responsible for any associated public cloud costs as those are the responsibility of the customer.

Governing Law and Jurisdiction

You agree that all matters relating to your access to, or use of, this web site shall be governed by the laws of the State of Colorado, USA. With respect to such matters, you agree and hereby submit to the exclusive jurisdiction and venue of the state and federal courts in Denver and Boulder Counties in Colorado, USA.

Spectra makes no representation that Information on this web site is appropriate or available for use in all countries, and Spectra prohibits accessing Information from territories where contents are illegal. Those who access this web site do so on their own initiative and are responsible for compliance with all applicable laws.

You may not access, download, use or export the Information on this web site in violation of U.S. export laws or regulations, or in violation of any applicable local laws or regulations.

EEO

We proudly make reference to our adherence to the Equal Opportunity Clause required under Executive Order 11246, the affirmative action commitment for disabled veterans of the Vietnam Era set forth in 41 CFR 60-250.4, the affirmative action clause for disabled workers set forth in CFR 60-741.4, and the related regulations of the Secretary of Labor, 41 CFR Chapter 60.

Anti-Corruption Laws

Interactions between the Parties (including any and all officers, directors, employees, agents and any person under the Party’s control) shall comply with, and shall require its contractors, subcontractors and any contingent workers to comply with, any and all applicable anti-corruption laws and regulations, including but not limited to the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010. Without limiting the foregoing, the Parties (including any and all officers, directors, employees, agents and any person under its control) shall not, directly or indirectly, make, promise to make, or accept any payment, offer or transfer of anything of value in connection with this Agreement or any other business transaction relating to such Party, to: (i) anyone working in an official capacity for a non-U.S. government, government entity (including employees of government owned or controlled corporations) or public international organization; (ii) any political party, party official, or candidate for political office; (iii) an intermediary for payment to any of the foregoing; (iv) any officer, director, employee of any actual or potential customer of such Party; (v) any officer, director or employee of such Party or any of its affiliates; or (vi) any other person or entity if such payment, offer or transfer would violate the laws of the country in which made or the laws of the United States of America or of England. It is the intent of the parties that no payments, offers or transfers of value shall be made which have the purpose or effect of public or commercial bribery, acceptance or acquiescence in extortion, kickbacks or other unlawful or improper means of obtaining or retaining business or directing business to any person or entity. Each Party will cooperate fully with the other’s efforts to enforce the terms of this provision, including but not limited to (i) providing upon request from the other a certification of compliance with this provision; and (ii) providing reasonable co-operation at such other Party’s expense with respect to any investigation relating to this provision.

Data Protection and Privacy

Where the processing of personally identifiable information is subject to the Data Protection Legislation of the European Economic Area or Switzerland, existing Data Protection Legislation and the provisions of the following GDPR will apply.

GDPR DATA PROCESSING
EFFECTIVE 25 MAY 2018

Data Protection

Spectra Logic (Service Provider or data processor)) is appointed by you, the Company (data controller) to process Company Personal Data on behalf of Company (or an Affiliate of Company, as applicable) only as is necessary to provide the Services and as may subsequently be agreed by the parties in writing.

Service Provider will comply with its obligations under the Data Protection Laws in respect of any Company Personal Data it processes under or in relation to this Agreement and shall not process Company Personal Data in a manner that will, or is likely to, result in Company or an Affiliate of Company breaching its obligations under the Data Protection Laws.

The categories of Company Personal Data to be processed by Service Provider and the processing activities to be performed under this Agreement are set out in Schedule 1.

In addition to and not in lieu of those representations, warranties, and covenants in the Agreement, Service Provider represents, warrants, covenants, and undertakes in respect to Company Personal Data that it will at all times: only process Company Personal Data in accordance with the documented instructions given from time to time by Company, including with regard to transfers, unless required to do otherwise by EU law or the national law of an EU member state to which Service Provider is subject. In which event, Service Provider shall inform Company of the legal requirement before processing Company Personal Data other than in accordance with Company’s instructions, unless that same law prohibits Service Provider from doing so on important grounds of public interest; implement, maintain, and comply with the minimum security requirements set out in Schedule 2; ensure that such Service Provider Personnel, prior to such access, meet and remain in compliance with the requirements detailed in the confidentiality clause of the Agreement; at no additional cost, provide full cooperation and assistance to Company as Company may require to allow Company (or an Affiliate of Company) to comply with its obligations as a Data Controller, including in relation to data security; data breach notification; data protection impact assessments; prior consultation with supervisory authorities; the fulfilment of data subjects’ rights; and any enquiry, notice or investigation by a supervisory authority; and at the request and option of Company (whether during or following termination of this Agreement), promptly and as specified by Company return or destroy all Company Personal Data in the possession or control of Service Provider; and provide an adequate level of security and protection for Company Personal Data, wherever processed, in accordance with the requirements of the Data Protection Laws.

Service Provider appoints Microsoft Dynamics as its current data processor. Notwithstanding any provisions of the Agreement, Service Provider shall not appoint any other third party to process Company Personal Data (“Subprocessor”) without Company’s prior written consent, and subject in all cases to Service Provider: provide reasonable prior notice to Company of the identity and location of the Subprocessor and a description of the intended processing to be carried out by the Subprocessor sufficient to enable Company to evaluate any potential risks to Company Personal Data; and impose legally binding contract terms on the Subprocessor which are the same as those contained in this Amendment including the referenced Schedules.

Service Provider acknowledges and agrees that it shall remain liable to Company for a breach of the terms of this Agreement by a Subprocessor and any other subsequent third party processors appointed by it.

Service Provider shall make available to Company promptly upon request all information necessary to demonstrate compliance with this Amendment (including the referenced Schedules) and the Data Protection Laws. Service Provider shall also, upon reasonable prior notice, allow for, permit and contribute to audits, including physical inspections, conducted by Company or its representatives bound by appropriate obligations of confidentiality.

Security Breaches

Cooperation

Service Provider agrees to provide all assistance reasonably required by Company to enable Company to respond to, comply with, or otherwise resolve, within any timeframes set by the Data Protection Laws or other applicable law, any request, question, complaint, enquiry or binding instruction that is received from: (a) any living individual whose Personal Data is processed by Service Provider on Company’s behalf; and (b) any regulator or data protection authority. In the event that any such communication is received by Service Provider in connection with its processing of Personal Data under this Agreement, Service Provider will immediately inform Company and will not respond to such communication unless required by law or expressly authorized by Company in writing. In the event that Service Provider is required by law, court order, warrant, subpoena, or other legal judicial process to disclose any Company Personal Data to any third party, Service Provider will notify Company immediately, unless and to the extent prohibited by law. Service Provider will furnish all reasonable assistance to Company to enable Company to respond to, object to or challenge any such request. If Company is unable to or otherwise does not receive a protective order or other remedy pursuant to this Section, Service Provider may disclose only that portion of Company Personal Data that it is legally required to disclose and will use reasonable efforts to ensure that Company Personal Data that is disclosed will be handled in accordance with the Agreement and accorded confidential treatment.

Data Transfers

Company hereby consents to Company Personal Data being processed outside the EEA, subject to Service Provider’s continued compliance throughout the duration of this Agreement.

To the extent that Company Personal Data is processed outside the EEA and/or Switzerland, the terms of the transfer shall be governed by the standard contractual clauses for the transfer of personal data to processors, approved by Commission Decision C(2010)593, or any replacement clauses approved by the Commission from time to time (the “EU Model Clauses”) attached as Schedule 2, which are hereby incorporated into this Agreement. The parties acknowledge and agree that Company is entering into the EU Model Clauses on its own behalf and on behalf of the other Affiliates of Company. Service Provider further agrees to enter into the EU Model Clauses with any other Affiliates of Company on request.

If, for whatever reason, the transfer of Company Personal Data under Section 4.2 above ceases to be lawful, Service Provider shall either: with Company’s consent, implement an alternative lawful transfer mechanism; or allow Company to terminate the Agreement at no additional cost to Company.

Liability

Each party’s liability for one or more breaches of this Exhibit shall be subject to the limitations and exclusions of liability set out in the Agreement. In no event shall either party’s liability for a breach of this Exhibit exceed the liability cap set out in the Agreement.

Neither party limits or excludes any liability that cannot be limited or excluded under applicable law.

General Terms

Nothing in this Exhibit reduces Service Provider’s obligations under the Agreement in relation to the protection of Company Personal Data or permits Service Provider to process (or permit the processing of) Company Personal Data in a manner which is prohibited by the Agreement. In the event of any conflict or inconsistency between this Exhibit and the EU Model Clauses, the EU Model Clauses shall prevail.

Subject to Section 6.1, with regard to the subject matter of this Exhibit, in the event of inconsistencies between the provisions of this Exhibit and any other agreements between the parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this Exhibit, the provisions of this Exhibit shall prevail.

Company may by at least 30 calendar days’ written notice to Service Provider from time to time propose any variations to this Exhibit which Company reasonably considers to be necessary to address the requirements of the Data Protection Laws. If the Company gives such notice, the parties shall promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified in the Company’s notice as soon as reasonably practicable.

Definitions

The terms “Data Controller”, “Data Processor”, “Personal Data”, “data subject”, “supervisory authority”, “process” and “processing” have the meanings given to them under all applicable Data Protection Laws from time to time.

“Data Protection Laws” means any applicable law relating to the processing, privacy and use of Personal Data, as applicable to either party or the Services, including: the EU Data Protection Directive (95/46/EC) and/or the EU General Data Protection Regulation (2016/679) (“GDPR”) and/or the UK Data Protection Act 1998 and/or the EU Privacy and Electronic Communications Directive (2002/58/EC); any laws which implement any such laws in each applicable jurisdiction; any laws that replace, extend, re-enact, consolidate or amend any of the foregoing; and all guidance, guidelines, codes of practice and codes of conduct issued by any relevant supervisory authority relating to such Data Protection Laws (in each case whether or not legally binding).

“Company Personal Data” means any Personal Data processed by Service Provider (and its Subprocessors (if applicable)) on behalf of the Company pursuant to or in connection with the Agreement.

Schedule 1: Description of Personal Data Processing

The data processing activities carried out by Service Provider under this Agreement may be described as follows:

• Customers: Customer relationship management and analysis, and related legal, regulatory and tax compliance analysis and all things ancillary or supplemental thereto.
• Business Contacts: Cross border business generation, pre-transaction background checks.
• Investigations: Internal investigations related to fraud or misconduct; Sanctions list reviews.

Data Categories

The Personal Data transferred may concern the following categories of data:

• Non-employee worker information, Personal information including personal information, contact information (home address, telephone and fax numbers, and email address) and additional emergency contact information, gender, date of birth, citizenship, nationality and residency information, national or social insurance number or its local equivalent (e.g., social security number, identity type and/or citizen service number) (to the extent permitted by applicable law), bank account details, photographs, or other identification information and certain tax-related information;
• Work-related information, including work contact information (office location and address, telephone and fax numbers and email address), user ID and password to the extent provided to the independent worker, independent worker contract information, compensation data, qualifications and work history, and educational background;
• and Professional information about business captured through legitimate review of technology resource systems (including information pertaining to business contained in professional email and voicemail messages and attachments, documents or files saved on company technology resource systems, internet searches, and/or information contained on relevant individuals’ work station, phone, laptop or other company issued devices, including technical information (including internal security clearances and authorization, IP address, domain, browser type, operating system, click-stream data and system logs);
• Length of service or assignment information, including contract information, compensation, and information needed to assess worker performance, status and compliance with applicable laws, global directory information, security and system access information, financial and budgeting data, and other information relevant to the contractual employment relationship.

Business Contacts

Name, work contact information (telephone and fax numbers, address, and email address), employer, and position/ job title; Background check information, including credit checks (in accordance with and where permitted or required by applicable law); Lists of literature, information, or products requested by, or sent to, or events attended by Business Contacts; IP address, security and systems access information (e.g., user ID and password) (for users of the websites); and Other data collected as required or permitted by applicable law.

Customers

Customer information relating to individual customers, including without limitation names, addresses, telephone numbers, dates of birth, citizenship, residence, tax identification numbers, other government-issued identification numbers.

Hotline information, including identity, title and contact information of the individual making the complaint, the person incriminated in the complaint, and the person responsible for the collection and the treatment of the complaint, and incriminating/alleged facts.

Monitoring and internal investigation information, including incriminating/alleged facts in connection with an internal investigation, professional information pertaining to business obtained via legitimate review of information relevant to an internal investigation (including hard copy documentation pertaining to business, as well as responses to interviews), professional information pertaining to business captured through legitimate review of technology resource systems (including information pertaining to business contained in professional email and voicemail messages and attachments, documents or files saved on company technology resource systems, internet searches, and/or information contained on relevant individuals’ work station, phone, laptop or other company issued devices, including technical information (including internal security clearances and authorization, IP address, domain, browser type, operating system, click-stream data and system logs)).

Data Subjects

The Personal Data transferred concern the following categories of Data Subjects:

• Non-employee workers
• Contractors
• Apprentices and interns
• Applicants
• Customers (including prospective customers)
• Business contacts
• Business partners
• Suppliers and service providers
• Consultants
• Visitors
• Press representatives

Schedule 2: EU Model Clauses

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, the parties have agreed on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Clause 1
Definitions

For the purposes of the Clauses:

• ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;’the data exporter’ means the controller who transfers the personal data;
• ‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
• ‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
• ‘the applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
• ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2
Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause

The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter

The data exporter agrees and warrants:

• that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
• that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
• that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
• that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; that it will ensure compliance with the security measures; that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC; to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
• to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and that it will ensure compliance with Clause 4(a) to (i).

Clause 5
Obligations of the data importer

The data importer agrees and warrants:

• to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses;
• if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
• that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
• that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;that it will promptly notify the data exporter about: any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation, any accidental or unauthorised access, andany request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
• to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
• to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
• that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
• that the processing services by the subprocessor will be carried out in accordance with Clause 11; to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6
Liability

The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.

If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity. The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction

The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject: to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority; to refer the dispute to the courts in the Member State in which the data exporter is established.

The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities

The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9
Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10
Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11
Subprocessing

The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor’s obligations under such agreement.

The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12
Obligation after the termination of personal data processing services

The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Clauses.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

Data exporter

The transfers are made for the following purposes:

• Business correspondence
• Expanding customer and supplier relationships
• Exploring new opportunities with customers and suppliers
• Organisation of competitions and promotional events
• Management of complaints
• Marketing and direct sales
• Communications with marketing agencies

Transfers made for the following purposes:

Data subjects

The Personal Data transferred concern the following categories of Data Subjects:

• Advisors, consultants and other professional experts
• Agents and intermediaries
• Beneficiaries / assignees / payees / claimants
• Business and other contacts
• Complainants, correspondents and enquirers
• Customers and clients
• Employees of other organisations
• Parties with contractual or business interest
• Shareholders
• Staff including volunteers, agents, temporary and casual workers (current, past and future)
• Suppliers
• Opinion formers
• Guests at promotional events

The Personal Data transferred concern the following categories of data:

• Advice, opinions, views and other comments
• Assets other than financial
• Business activities
• Business travel and movement details
• Compliant, incident, accident details
• Court, tribunal, inquiry proceedings
• Education and training details
• Employment details
• Financial details
• Goods or services provided/obtained
• Immigration status
• Licenses, permits held
• Membership of professional bodies and committees
• Personal details (including name and address)
• Publications

Data importer

The data importer is (please specify briefly activities relevant to the transfer):

1. Management of customers and suppliers

• Business correspondence
• Expanding customer and supplier relationships
• Exploring new opportunities with customers and suppliers
• Organisation of competitions and promotional events
• Management of complaints
• Marketing and direct sales
• Communications with marketing agencies

2. Ancillary functions
Transfers made for the following purposes:

Data subjects

The Personal Data transferred concern the following categories of Data Subjects:

• Advisors, consultants and other professional experts
• Agents and intermediaries
• Beneficiaries / assignees / payees / claimants
• Business and other contacts
• Complainants, correspondents and enquirers
• Customers and clients
• Employees of other organisations
• Parties with contractual or business interest
• Shareholders
• Staff including volunteers, agents, temporary and casual workers (current, past and future)
• Suppliers
• Opinion formers
• Guests at promotional events

The Personal Data transferred concern the following categories of data:

• Advice, opinions, views and other comments
• Assets other than financial
• Business activities
• Business travel and movement details
• Compliant, incident, accident details
• Court, tribunal, inquiry proceedings
• Education and training details
• Employment details
• Financial details
• Goods or services provided/obtained
• Immigration status
• Licenses, permits held
• Membership of professional bodies and committees
• Personal details (including name and address)
• Publications

Appendix 2 to the Standard Contractual Clauses

This Appendix forms part of the Clauses.

Without prejudice to its other obligations, Service Provider shall implement and maintain at least the following technical and organisational security measures to protect Company Personal Data:

• In accordance with the Data Protection Laws, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Company Personal Data to be carried out under or in connection with this Agreement, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons and the risks that are presented by the processing, especially from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Company Personal Data transmitted, stored or otherwise processed, Service Provider shall implement appropriate technical and organisational security measures appropriate to the risk, including as appropriate those matters mentioned in Articles 32(a) to 32(d) (inclusive) of the GDPR.

Anti-Human Trafficking Policy

Purpose

Spectra Logic condemns and prohibits human trafficking. It is the company’s position to respect human rights and adhere to policies such as the Trafficking Victims Protection Act of 2000 (US), the UK Modern Slavery Act of 2015, the Modern Slavery Act of 2018 (Australia), or other similar laws that may be promulgated around the world.

Spectra is committed to a work environment that is free from human trafficking and slavery, including forced labor and unlawful child labor. It is expected that employees, contractors, suppliers, and vendors will comply with international standards of human decency.

Procedures

Report any conduct that you believe to be a violation of this policy to Spectra Logic’s Legal or Human Resources department. Employees in the US may also report violations to the National Human Trafficking Hotline at (888) 373-7888 or text to 233733.

Summary of Policy

Spectra Logic’s policy prohibits trafficking in persons and slavery. This includes, but is not limited to, the following activities:

• Engaging in any form of trafficking in persons.
• Procuring commercial sex acts.
• Using forced labor or involuntary servitude as a means to demand performance of any work.
• Destroying, concealing, confiscating, or otherwise denying access by an employee to the employee’s identity or immigration documents, such as passports or drivers’ licenses, regardless of issuing authority.
• Using misleading or fraudulent practices during the recruitment of employees or offering of employment/contract positions.
• Using recruiters that do not comply with local labor laws of the country in which the recruiting takes place.
• Charging applicant recruitment fees or other financial agreements that arise from a pledge of services as a security for debt.
• If required by law or contract, failing to provide an employment agreement, recruitment agreement, or other required work document in writing with legally required information and in a language the employee understands.