1. Security Controls. A BC Entity will maintain security measures appropriate to the nature of the Personal Data including the following.
   1. Generally. A BC Entity will maintain an information security management system, maintain automated tools to identify attempts to exfiltrate data, use certificate-based security, and develop and maintain secure key management policies and procedures. A BC Entity will monitor, log, audit, and escalate threats after applicable risk assessments have been performed. A BC Entity will manage the secure lifecycle of systems and software.
   2. Boundary Defense and Security Segmentation. A BC Entity will monitor, detect, and restrict the flow of information on a multilayered basis. A BC Entity will design and implement multilayered and secure network and system segmentation.
   3. Physical Security. A BC Entity will maintain an access control system that enables the BC Entity to monitor and control physical access to the BC Entities facilities.
   4. Personnel. Where applicable to the Processing, a BC Entity will (a) subject to applicable law, perform or require background screening, (b) provide or require security training, and (c) require appropriate confidentiality and security obligations.
2. Verification of Security Controls.
   1. Penetration Testing. A BC Entity will conduct periodic penetration tests of BC Entity systems.
   2. Deficiencies. A BC Entity will at its own expense promptly cure deficiencies identified in any audit or vulnerability scan with a CVSS score of 4.0 or greater or that materially and adversely affects Customer Personal Data.
3. Security Incidents.
   1. Notification. Upon a BC Entity's discovery of a Security Incident and unless prohibited by applicable law, BigCommerce will notify Customer no later than 72 hours following its confirmation of a Security Incident, and provide the following information:
      1. a summary of the Security Incident,
      2. an expected resolution time (if known), except that if the resolution path is unknown at the time of notification, a BC Entity will advise Customer that the path is unknown, and
      3. a means to obtain continued incident updates, if applicable.
   2. Security Incident Procedures. In the event of a Security Incident caused by a material breach of a BC Entity’s obligations under this DPA, a BC Entity will, subject to the liability limits of the Agreement, (a) reasonably cooperate with any investigation concerning the Security Incident by Customer, regulators, or law enforcement, and (b) reasonably cooperate with Customer to comply with applicable law concerning such Security Incident, including any notification to affected data subjects. For the avoidance of doubt, a BC Entity shall not be liable for any Security Incident caused by Customer or by any third-party integrations or services elected by Customer.
   3. Customer Reporting. Customer may report Security Incidents to affected persons and/or any governmental authority or agency having supervisory or oversight authority over Customer or Security Incidents.
   4. Corrective Measures. a BC Entity will undertake a procedural review and audit to determine measures to avoid occurrence of a similar situation, notify Customer of the corrective measures undertaken, and take additional measures reasonably deemed appropriate by a BC Entity.

This schedule provides supplemental Security Procedures specific to BigCommerce Services and is incorporated into Exhibit A when such Services are applicable under the Agreement.

1. Security Controls.
   1. Information Security management Systems (“ISMS”). BigCommerce operates a comprehensive ISMS. BigCommerce’s ISMS is audited and certified annually by an independent third-party to meet or exceed ISO/IEC 27001 technical standards. BigCommerce will use commercially reasonable efforts to maintain such certification during the Agreement, as well as controls consistent with or substantially similar to the following technical and organizational measures:
      1. Encryption. Where applicable, BigCommerce encrypts Personal Data by default in-transit and at-rest.
      2. Minimization. BigCommerce minimizes Personal Data on its platform by design, including through anonymization, pseudonymization, and de identification where practicable.
      3. Cybersecurity. Where applicable, BigCommerce infrastructure includes perimeter and host-based firewalls, file integrity monitoring, access control monitoring, intrusion detection, and application firewalls.
      4. Integrity and Stability. BigCommerce infrastructure is logically segmented and replicated throughout multiple availability zones. Each store on the platform is protected by multiple layers of security and access control, including cloud security posture management and global cloud network protection.
      5. Testing. BigCommerce conducts frequent vulnerability scans and engages third-party providers to conduct substantive vulnerability assessments.
      6. Governance. As matter of policy and practice, BigCommerce takes organizational measures to promote:
         1. commercially reasonable internal IT and IT security governance, management, and training;
         2. commercially reasonable business continuity planning and management;
         3. commercially reasonable ability to restore availability and access in the event of an incident;
         4. regular testing, assessment and evaluation of the effectiveness of BigCommerce’s organizational measures;
         5. commercially reasonable user identification, authorization, and access control;
         6. commercially reasonable secure system configuration;
         7. assessment of Subprocessors in accordance with BigCommerce’s ISMS and obligations as a Processor, including with regard to security, privacy, and transfer impact;
         8. data deletion, where applicable, in accordance with BigCommerce’s contractual obligations, internal policies, obligations as a Processor, and Data Protection Laws; and
         9. re-evaluation of technical and organizational measures in light of relevant changes.
2. Verification of Security Controls.
   1. On an annual basis, BigCommerce will, at its sole cost and expense, retain an independent, appropriately-qualified auditor to undertake an assessment of and prepare a report of BigCommerce’s, information security controls related to BigCommerce’s ISMS.
   2. On an annual basis, BigCommerce will conduct a PCI-DSS audit and make the summary Attestation of Compliance available.

This Exhibit supplements the Data Processing Terms in the Data Processing Addendum for BigCommerce Services as applicable under Data Protection Laws.

1. Data Transfer. BigCommerce may transfer, process and store Personal Data in regions in which BigCommerce or its Subprocessors operate, subject to compliance with Data Protection Laws.
   1. BigCommerce is a participant in the EU-U.S. Data Privacy Frameworks as well as in the UK and Swiss Extension to the EU-U.S. Data Privacy Framework. To the extent such frameworks, or any successor frameworks, are deemed adequate as valid data transfer mechanisms under applicable Data Protection Laws, the Parties may utilize such frameworks to transfer Personal Data to a third country. BigCommerce will notify Customer if it can no longer meet its obligation to provide the level of protection required by the Data Privacy Framework principles.
   2. If and to the extent that any Processing of Personal Data subject to the EU GDPR by BigCommerce takes place in any country outside the EEA whose laws do not provide an adequate level of data protection and an independently valid data transfer mechanism does not exist, or either Party relies on a transfer mechanism that is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, then:
      1. the Standard Contractual Clauses approved by the European Commission on 4 June 2021 under Commission Implementing Decision (EU) 2021/914, Controller-to-Processor Clauses (Module Two) will apply when Customer is acting as a controller (“EU SCCs”):
         1. for the purposes of Annex I to the EU SCCs, BigCommerce will comply with the obligations of “data importer” and the Customer will comply with the obligations of “data exporter;”
         2. Clause 7 of the EU SCCs, the optional docking Clause will not apply;
         3. the activities of Customer as data exporter, of BigCommerce as data importer, and the details of the data subjects, types of data, special categories of data (if appropriate) and processing operations are as set out throughout this DPA and in the table on page 1 of this DPA;
         4. Clause 3 of this DPA (Subprocessing) shall apply for purposes of Annex III to the EU SCCs and for general written authorization of sub-processors under Clause 9(a) of the EU SCCs (Use of sub-processors);
         5. in Clause 11 of the EU SCCs, the optional language will not apply;
         6. the laws of the Republic of Ireland will govern the EU SCCs (Clause 17) and that the choice of forum and jurisdiction shall be the courts of the Republic of Ireland (Clause 18(b));
         7. for the purposes of Annex I.C. (Competent Supervisory Authority), the Competent Supervisory Authority will be determined in accordance with Clause 13 (a) of the EU SCCs. In case of doubt, the Competent Supervisory Authority will be the Irish Data Protection Commission; and
         8. Exhibit A and Schedule 1 of this DPA shall apply for the purposes of Annex II to the EU SCCs (Technical and Organizational Measures).
      2. If the EU SCCs will be declared invalid the Parties will, to the extent necessary, cooperate in good faith to terminate the transfer or pursue a suitable alternate mechanism that can lawfully support the transfer.
   3. If and to the extent that any Processing of Personal Data subject to the UK GDPR by BigCommerce takes place in any country outside the UK whose laws do not provide an adequate level of data protection and an independently valid data transfer mechanism does not exist, or either party relies on a statutory mechanism to normalize international data transfers that is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, then:
      1. the terms of the International Data Transfer Addendum to the EU SCCs in force 21 March 2022 issued by the UK Information Commissioner’s Office pursuant to S119A(1) of the UK Data Protection Act 2018 (“UK IDTA”) will apply:
         1. for purposes of Part 1 of the UK IDTA, the terms of this DPA, including the relevant roles of the Parties as set forth in Section 1.2(b) and the technical and organizational measures set out in Exhibit A and Schedule 1, shall apply;
         2. the start date of the UK IDTA as set out in Table 1 of the UK IDTA shall be the effective data of the Agreement;
         3. both Customer and BigCommerce shall be allowed to end subscription to the UK IDTA as set out in Section 19 of the UK IDTA; and
         4. for purposes of Part 2 of the UK IDTA, the EU SCCs shall apply.
      2. If the EU SCCs or the UK IDTA will be declared invalid the Parties will, to the extent necessary, cooperate in good faith to terminate the transfer or pursue a suitable alternate mechanism that can lawfully support the transfer.
   4. If and to the extent that any Processing of Personal Data Subject to the jurisdiction of the Swiss Federal Data Protection and Information Commission (“FDPIC”) takes place in any country outside Switzerland whose laws do not provide an adequate level of data protection and an independently valid data transfer mechanism not exist, or either party relies on a statutory mechanism to normalize international data transfers that is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, then
      1. the EU SCCs and cognate roles, activities, and authorizations set forth in Section 1.2(b) will apply, except that:
         1. all references to the GDPR shall be read to include reference to the Swiss Data Protection Act;
         2. references to "EU", "Union", "Member State" and "Member State law" shall be replaced with references to "Switzerland" or "Swiss law" (as applicable);
         3. in Clause 18(c) of the EU SCC the term "member state" shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland);
         4. Clause 13(a) and Part C of Annex I are not used and the "competent supervisory authority" is the FDPIC;
         5. references to the "competent supervisory authority" and "competent courts" shall be replaced with references to the "FDPIC" and "applicable courts of Switzerland"; and
         6. in Clause 17, the EU SCCs shall be governed by the laws of Switzerland;
      2. If the EU SCCs will be declared invalid the Parties will, to the extent necessary, cooperate in good faith to terminate the transfer or pursue a suitable alternate mechanism that can lawfully support the transfer.
   5. BigCommerce will notify Customer if it can no longer meet its obligation to provide the level of protection required by Data Protection Laws.
   6. For a transfer to Subprocessor outside the EEA or the UK, Art. 44 et seqq. GDPR applies. 
2. Assistance/Inspections. BigCommerce will make relevant information necessary to demonstrate compliance with Article 28 of the GDPR reasonably available. At Customer’s written request, BigCommerce will, taking into account the nature of Processing and the information available to the Processor, reasonably assist the Customer in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR.
   1. For the avoidance of doubt, Customer agrees and understands that the resources available via the BigCommerce Platform Trust Center (currently available at: security.bigcommerce.com) or its successor page, including but not limited to BigCommerce’s most recent third-party audit attestations, certifications, and reports, will suffice for purposes of any required documentation under this provision.
   2. To the extent the documentation identified in Section 2.1 does not provide sufficient information under Data Protection Laws, then BigCommerce will, at Customer’s expense and subject to reasonable notice, scope, frequency, relevancy, and confidentiality requirements, allow for and contribute to audits, including inspections, conducted by Customer or an appropriately-qualified auditor, provided that the information sought is not reasonably available through less intrusive means. Customer will reimburse BigCommerce for any time expended on such audits or inspections.