Time til Skorum

the first-of-its-kind virtual sales kick-off for all sellers

Production Header (V3)

Privacy policy

Terms

Technical Security

Announcing our new integration with Apollo

Dialer

Salesfloor

Analytics

Call Library

Twitter

LinkedIn

Youtube

Build Pipeline

Increase call volume

Decrease Ramp-time

Coaching

Sales tips, content worth checking out, and some sarcasm in your inbox once a month

Prepare to consider opening up our newsletter.

Podcast

Podcasts

Find out where we'll be next both online and in-person. Access on-demand recordings to reach peak performance. 

Event

Events

Events and Webinars

Get the latest reports and guides from Orum’s team of sales experts. 

Guide

Reports & Guides

Reports and Guides

The latest content and news from Orum’s sales experts, designed to help you reach peak performance.

Blog

Info

”) may process Licensee Personal Data on behalf of the customer entity that is a party to Provider’s 

, or another written or electronic agreement including, without limitation 

, which govern the provision of the Service to Licensee, as such terms or agreement may be updated from time to time (the “

”). Where this is the case, the Provider will Process such Licensee Personal Data in accordance with the terms and conditions of this Data Protection Addendum (“

”), which is supplemental to and subject to the terms of the Agreement entered into between the parties.

Unless otherwise set out below, each capitalized term in this DPA will have the meaning set out in the Agreement.

” means a country, a territory or one or more specified sectors within a third country, or an international organization (each a "

") determined by a supervisory authority under applicable Data Protection Law as a Destination to which Licensee Personal Data may be transferred or made available on the basis that the Destination provides an adequate level of protection for Personal Data and without specific authorization but does not include a Destination where such a determination has been revoked or found invalid either by a supervisory authority or a court with applicable jurisdiction from the time of such revocation or finding.

” means an entity that directly or indirectly controls, is controlled by or is under common control with an entity. For purposes of this definition, “

” means an ownership, voting or similar interest representing fifty percent (50%) or more of the total interests then outstanding of the entity in question.

” means the Software License Terms and the related Order Form, which together govern the provision of the Services to Licensee.

” means any Personal Data that Provider processes on behalf of Licensee as a Data Processor in the course of providing the Services, as more particularly set out in Annex I.

” means the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code §§ 1798.100 to 1798.199.95), the CCPA Regulations (Cal. Code Regs. tit. 11, §§ 7000 to 7102), and any related regulations or guidance provided by the California Attorney General, as amended or superseded from time to time. Terms defined in the CCPA, including personal information and business purposes, carry the same meaning in this Agreement.

” shall have the same meaning as set out in the GDPR.

” means the California Privacy Rights Act of 2020 (2020 Cal. Legis. Serv. Proposition 24, codified at Cal. Civ. Code §§ 1798.100 et seq.), and its implementing regulations, as amended or superseded from time to time.

” means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“

”), the UK Data Protection Act 2018 and the UK GDPR, the CCPA, the CPRA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, and all applicable legislation protecting the fundamental rights and freedoms of persons and their right to privacy, in each case to the extent applicable to the Processing of Licensee Personal Data by Provider on behalf of Licensee pursuant to the Agreement.

” means the Member States of the European Union together with Iceland, Norway, and Liechtenstein.

” shall have the same meaning as set out in the GDPR or under the applicable Data Protection Laws.

” shall have the same meaning as set out in the GDPR and “

” means the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Licensee Personal Data.

” means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to GDPR, as officially published at 

https://eurlex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN

, as may be amended, superseded, or replaced from time to time, and which includes 

 (Technical and Organisational Measures) and 

” means any product or service provided by Provider to Licensee pursuant to the Agreement.

” means any Processor engaged by Provider to process Licensee Personal Data on Processor’s behalf.

” means the International Data Transfer Addendum (version B1.0) issued by the Information Commissioners Office under S.119(a) of the UK Data Protection Act 2018, as may be amended, superseded, or replaced from time to time, incorporated herein via ANNEX IV, attached hereto.

” means any individual accessing and/or using the Services through the Licensee’s Account.

The parties agree that this DPA will replace any existing data protection addendum or similar agreement the parties may have previously entered into in connection with the Services.

Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA will prevail to the extent of that conflict. In the event of inconsistency between the provisions of this DPA and mandatory provisions of the Data Protection Laws, or their interpretation by any court or regulatory agency with authority over the Licensee or Provider, such interpretation shall control. Where provisions of this DPA are different from those mandated in the Data Protection Laws but are nonetheless permitted by such rules as interpreted by courts or agencies, the provisions of this DPA shall control.

Any claims brought under or in connection with this DPA will be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement.

Any claims against Provider or its Affiliates under this DPA will be brought solely against the entity that is a party to the Agreement. Licensee further agrees that any regulatory penalties or other liability incurred by Provider in relation to the Licensee Personal Data that arise as a result of, or in connection with, Licensee’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws will count towards and reduce Provider’s liability under the Agreement.

Except as otherwise required under the Data Protection Laws, including Clause 3 of the Standard Contractual Clauses, no one other than a party to this DPA, its successors and permitted assignees will have any right to enforce any of its terms.

This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Laws.

 This DPA applies where and only to the extent that Provider Processes Licensee Personal Data that is subject to the Data Protection Laws on behalf of Licensee as Processor in the course of providing the Services pursuant to the Agreement. For clarity, where the concepts of Processor and Controller are not expressly contemplated by the applicable Data Protection Laws, the parties' obligations in connection with this DPA will be interpreted under those applicable Data Protection Laws to align as closely as possible with the scope of those roles while still complying fully with those Data Protection Laws.

 As between Provider and Licensee, Licensee is the Controller of Licensee Personal Data, and Provider will process Licensee Personal Data only as a Processor acting on behalf of Licensee.

 Licensee agrees that: (i) it will comply with its obligations as a Controller under Data Protection Laws in respect of its processing of Licensee Data and any processing instructions it issues to Provider; and (ii) it has provided notice and obtained (or will obtain) all consents and rights necessary under Data Protection Laws for Provider to process Licensee Personal Data and provide the Services pursuant to the Agreement and this DPA.

Provider Processing of Licensee Personal Data.

 Provider will process Licensee Personal Data in accordance with (i) the Agreement, to the extent necessary to provide the Services to the Licensee, and (ii) Licensee’s written instructions, unless Processing is required by Data Protection Laws, in which case Provider will, to the extent permitted by Data Protection Laws, inform Licensee of that legal requirement before Processing the Licensee Personal Data. Processing otherwise outside the scope of this DPA will require prior written agreement between the Licensee and the Provider on additional instructions for processing.

 The Parties acknowledge and agree that Provider will act as a “Service Provider” as such term is defined in the CCPA, in its performance of its obligations pursuant to the Agreement. Provider will Process Licensee Personal Information solely in accordance with the Agreement or other documented instructions of Licensee (whether in written or electronic form), or as otherwise required by applicable law or permitted by the CCPA. Provider is responsible for its compliance with its obligations as a Service Provider under the CCPA and the CPRA. Licensee is responsible for compliance with its own obligations as a Business under the CCPA and the CPRA and shall ensure that it has provided notice and has obtained (or shall obtain) all consents and rights necessary under the CCPA and the CPRA for Processor to Collect and process the Personal Information as set forth herein.

Provider will not (i) “sell” or “share” Licensee Personal Information, as such terms are defined in the CCPA/CPRA; (ii) shall not retain, use, or disclose such Personal Information for any purpose other than performing the Services under the Agreement or as otherwise permitted under CCPA/CPRA; (iii) retain, use, or disclose the Personal Information for a commercial purpose other than providing the Services unless otherwise permitted under the Agreement; or (iv) retain, use, or disclose such Personal Information outside of the direct business relationship between Licensee and Provider unless otherwise permitted under the Agreement. Provider understands and agrees to comply with the restrictions set forth in the CCPA and CPRA as applicable to Provider in its provision of the Services to Licensee under the Agreement. Provider grants Licensee the right to take reasonable and appropriate steps to help ensure Provider’s compliance with its obligations under the CCPA and CPRA. Provider will promptly notify Licensee in the event that it makes a determination that it can no longer meet its obligations under the CCPA/CPRA, in which case Licensee shall have the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Licensee Personal Information.

Provider will hold Licensee Personal Information in confidence pursuant to the confidentiality provisions of the Agreement and will require Provider personnel granted access to Licensee Personal Information to protect all Personal Information accordingly. At Licensee’s request, Provider will assist Licensee, where possible, with Licensee’s obligation to respond to Individuals’ requests to exercise their rights under the CCPA, including to respond to requests for access, knowledge, deletion, or rectification. If applicable, Provider will direct any affiliate or subcontractor that Processes such Licensee Personal Information to promptly and securely delete or destroy such Personal Information. Provider will confirm to Licensee in writing that Provider has complied with its obligations under this section. Upon termination or expiration of the Agreement for any reason, Provider will return, destroy, or Deidentify Licensee Personal Information at Licensee’s request. Notwithstanding the foregoing, Provider may retain Licensee Personal Information to the extent required by applicable laws.

Licensee agrees that Provider has Licensee’s general authorisation for the engagement of Subprocessors to process Licensee Data on Licensee’s behalf from an agreed list, which current list is set forth on Annex III (“Subprocessor List”).

Provider will inform Licensee in writing, or by posting such updates here, of any intended changes to the Subprocessor List through the addition or replacement of sub-processors at least five (5) business days’ in advance. If a Licensee objects to Provider's change in such other Subprocessors, Licensee may, as its sole and exclusive remedy, terminate the portion of any Agreement relating to the Services that cannot be reasonably provided without the objected to new Subprocessor by providing 30 days’ prior written notice to Provider. If Provider wishes to be notified via email or through another method, please email privacy@orum.com with such request.

Subprocessor Obligations. Provider will: (i) enter into a written agreement with the Subprocessor imposing similar data protection terms as set out in this DPA that require the Subprocessor to protect the Licensee Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Provider to breach any of its obligations under this DPA.

Data Security, Audits, and Security Notifications.

 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Provider will implement and maintain appropriate technical and organizational security measures designed to ensure a level of security appropriate to the risk including, where applicable by virtue of Article 28(3)(c) of the GDPR, and as appropriate, the measures referred to in Article 32(1) of the GDPR. Without limiting the generality of the foregoing, Provider shall put in place and maintain technical and organisational measures designed to protect Licensee Personal Data against any Security Incidents.

 Licensee is responsible for reviewing the information made available by Provider relating to data security and making an independent determination as to whether the Services meet Licensee’s requirements and legal obligations under Data Protection Laws.

 Notwithstanding the above, Licensee agrees that except to the extent expressly provided in this DPA, Licensee is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Licensee Personal Data when in transit to and from the Services and taking any appropriate steps to securely encrypt or backup any Licensee Personal Data uploaded to the Services.

 Provider shall limit access to Licensee Personal Data to those employees or other personnel who have a business need to have access to such Licensee Personal Data. Further, Licensee shall ensure that such employees or other personnel are bound by a duty of confidentiality.

 Provider shall notify Licensee without undue delay, and in any event within seventy-two (72) hours, of any Security Incident of which Provider becomes aware. Provider shall provide commercially reasonable cooperation in identifying the cause of such Security Incident and take commercially reasonable steps to remediate the cause to the extent the remediation is within Provider's ​control. In addition, Provider shall provide Licensee with information reasonably required by Licensee to enable it to comply with its obligations relating to ‘eligible data breaches’ under applicable Data Protection Laws.

 To the extent expressly required in writing by a competent data protection authority or following a Security Incident involving Licensee Personal Data, the Licensee may, at Licensee’s cost and upon reasonable notice and at reasonable times no more than once per year, audit Provider’s compliance with the security measures set out in this DPA.

 Provider may process data anywhere in the world where Provider, its Affiliates or its Subprocessors maintain data processing operations, provided that Provider will at all times provide an adequate level of protection for the Licensee Personal Data processed, in accordance with the requirements of applicable Data Protection Laws.

 To the extent that the Processing of Licensee Personal Data by Provider involves the export of such Licensee Personal Data to a third party to a country or territory other than an Adequate Data Protection Destination , such export shall be governed by the Standard Contractual Clauses, which are hereby incorporated into and form part of this DPA. In the event of a conflict between any of the provisions of the Standard Contractual Clauses and this DPA, the provisions of the Standard Contractual Clauses shall prevail.

 In relation to transfers of Licensee Personal Data originating from the EEA and subject to GDPR to any country other than an Adequate Data Protection Destination, the Standard Contractual Clauses shall apply as follows:

the Module Two terms shall apply where Licensee is the controller of Licensee Personal Data and the Module Three terms shall apply where Licensee is a processor of Licensee Personal Data;

in Clause 7, the optional docking clause shall apply and Authorized Affiliates may accede to the Standard Contractual Clauses under the same terms and conditions as Licensee, subject to the mutual agreement of the parties;

in Clause 9, option 2 (“General Authorization”) is selected and the time period for prior notice of Subprocessor changes shall be five (5) business days, and the process for Sub-processor changes shall be as set out in the DPA;

in Clause 11, the optional language shall not apply;

in Clause 17, option 1 shall apply and the Standard Contractual Clauses shall be governed by Irish law;

in Clause 18, disputes shall be resolved before the courts of Ireland; and

ANNEX I and ANNEX II shall be deemed completed with the information set out in ANNEX I and ANNEX II to this DPA, respectively.

 In relation to transfers of Licensee Personal Data originating from the UK to any country other than an Adequate Data Protection Destination, the Standard Contractual Clauses as implemented by Subsection (a) above shall apply, as modified and interpreted in accordance with the UK Addendum.

 To the extent that the Processing of Licensee Personal Data for an Australian data subject involves the export by the Provider of such Licensee Personal Data to a country outside Australia, Provider will take reasonable steps to ensure that the recipient will not breach the Australian Privacy Principles in relation to that Licensee Personal Data.

 If Provider receives a request from a governmental authority for access to any Licensee Personal Data, Licensee will evaluate challenging such request before transferring such data to the governmental authority.

 Licensee Personal Data will be encrypted at rest using AES-256 or better and in transit using HTTPS and TLS 1.2 or later.

 Upon termination of the Agreement, Provider shall, upon Licensee's request, return all Licensee Personal Data in Provider's possession to Licensee or securely destroy such Licensee Personal Data, unless applicable law prevents it from returning or destroying all or part of Licensee Personal Data.

 Unless otherwise required by applicable law, Provider shall promptly notify Licensee of any request received by Provider or any Subprocessor from a data subject in respect of the Licensee Personal Data and shall not respond to the data subject. Provider shall, where possible, assist Licensee with ensuring its compliance under applicable Data Protection Laws by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Licensee’s obligation to respond to requests for exercising data subject rights laid down in the Data Protection Laws and in particular shall:

provide Licensee with the ability to correct, delete, block, access, or copy the Licensee Personal Data, or

promptly correct, delete, block, access, or copy Licensee Personal Data within the Services at License’s request.

 If a law enforcement agency sends Provider a demand for Licensee Personal Data (for example, through a subpoena or court order), Provider will attempt to redirect the law enforcement agency to request that data directly from Licensee. As part of this effort, Provider may provide Licensee’s basic contact information to the law enforcement agency. If compelled to disclose Licensee Personal Data to a law enforcement agency, then Provider will give Licensee reasonable notice of the demand to allow Licensee to seek a protective order or other appropriate remedy unless Provider is legally prohibited from doing so.

 To the extent Provider is required under applicable Data Protection Laws, Provider will (at Licensee’s expense to the extent legally permitted) provide reasonably requested information regarding the Services to enable the Licensee to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.

Name:
Address:
Contact person’s name, position and contact details:
Activities relevant to the data transferred under these Clauses:
Signature and date:
Role (controller/processor): Controller

Name: Orum Inc.
Address: 1401 Lavaca Street, #685 Austin, TX 78701 United States
Contact person’s name, position and contact details: Ryan Melvin, SVP, Operations & General Counsel, ryan.melvin@orum.com
Activities relevant to the data transferred under these Clauses: The provision of the Services to the Licensee and the performance by Provider pursuant to the Agreement (including the DPA).
Signature and date:
Role (controller/processor): Processor

Categories of data subjects whose personal data is transferred:

Any individual: (i) whose personal data is provided by Licensee for use with the Services; (ii) whose information is stored on or collected via the Services, or (iii) to whom Users call via telephone or otherwise engage or communicate with via the Services.

Identification and contact data such as name, email address, IP address, telephone number; employment details such as employer, job title, geographic location, area of responsibility; such other personal data that may be provided by Licensee in its sole discretion

Transmitting, collecting, storing and analysing data in order to provide the Services to the Licensee, and any other activities related to the provision of the Services or specified in the Agreement.

Purpose(s) of the transfer and further processing

The provision of the Services by Provider to Licensee, as described in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Until the termination of the Agreement in accordance with its terms.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:

Identify the competent supervisory authority/ies in accordance with Clause 13:

..............................................................................................

The parties shall follow the rules for identifying such authority under Clause 13 and, if a competent supervisory authority is not listed above, the parties hereby select the Irish Data Protection Commission to the extent legally permissible.

TECHNICAL AND ORGANISATIONAL SECURITY MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons:

Provider will maintain administrative, technical, and organizational safeguards for protection of the security, confidentiality and integrity of Licensee Personal Data, such measures are outlined below. Provider will not materially decrease the overall security of the Services during a subscription term.

Provider’s data protection and security concepts around technical and organizational measures follow International Organization for Standardization (ISO) and National Institute of Standards and Technology (NIST) standards. The following measures are subject to change based on operational requirements and the evolution of technology and security threats. These measures apply generally to all transfers contemplated by this Agreement.

Data Processing Addendum