Data Processing Addendum

Last updated October 3, 2023

US and Canada only

This Data Processing Addendum (formerly referred to as the Five9 Privacy Addendum), including its Annexes (this “Addendum”), forms the Parties’ agreement with regard to the processing of Personal Information under the Master Services Agreement between customer (“Customer”) and Five9, Inc., having offices at 3001 Bishop Drive, Suite 350, San Ramon, California 94583 USA (“Five9”), for the purchase of Services from Five9 (“Agreement”), which is incorporated by reference. This Addendum may refer to Customer and Five9 each as a “Party” and collectively as the “Parties.”

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. This Addendum is effective as of the date that the Master Services Agreement between the Parties is executed.  

1. DEFINITIONS

1.1 “Personal Information” means “personal information” and “personal data” as defined in the Privacy Laws, that is provided by Customer via the Services and processed by Five9.

1.2 “Privacy Laws” mean all applicable United States and Canadian province, state or federal statutes and regulations pertaining to privacy and information security, including but not limited to: the California Consumer Privacy Act, Cal. Civ. Code 1798.100 et seq., as amended including by the California Privacy Rights Act (the “CCPA”); the Virginia Consumer Data Protection Act, Code of Virginia title 59.1, Chapter 52 (the “VCDPA”); the Colorado Privacy Act, Colorado Rev. Stat. 6-1-1301 et seq. (the “CPA”); the Utah Consumer Privacy Act, Utah Code 13-61-101 et seq. (the ‘“UCPA”); the Connecticut Act Concerning Personal Data Protection and Online Monitoring, Conn. Gen. Stat. 42-515 et seq. (the ‘PDPOM’); the Indiana Consumer Data Protection Act, S.B. 5 (the “INCDPA”); the Iowa Consumer Data Protection Act, S.J. 708, (the “ICDPA”); the Montana Consumer Data Privacy Act, S.B. 384 (the “MCDPA”); the Tennessee Information Protection Act, H.B. 1181 (the “TIPA”); Personal Information Protection and Electronic Documents Act (“PIPEDA”); Personal Information Protection Act (Alberta) (“PIPA Alberta”); Personal Information Protection Act (British Columbia) (“PIPA BC”); An Act Respecting the Protection of Personal Information in the Private Sector (“Quebec Privacy Act”); or any regulations or guidance issued pursuant thereto, and any other applicable United States and Canadian laws or regulations regarding privacy and information security that are in effect or come into effect during the term of the Agreement.

1.3 The terms “business,” “collect,” “consent,” “consumer," “controller,” “process” or “processing,” “processor,” “sensitive data,” and “service provider” shall have the meanings given to those terms in the applicable Privacy Laws to the extent such meanings are materially similar to the meaning of terms in effect upon the execution of this Addendum. In the event of a conflict in the meanings of terms among the Privacy Laws, the Parties agree that only the meanings in applicable Privacy Law(s) will apply.

2. ROLES OF THE PARTIES

For the purposes of the Agreement and this Addendum, Customer is the sole Party that determines the purposes and means of processing Personal Information as the business or controller, and Five9 processes Personal Information on behalf of Customer as the service provider or processor. The details of the processing are provided in Annex 1 of this Addendum, including the duration, nature, and purpose of the processing, and the type(s) of Personal Information subject to the processing.

3. CUSTOMER INSTRUCTIONS

Customer instructs Five9 to process, and Five9 shall process, Personal Information in accordance with the Agreement, any Addendum thereto, any applicable Statement of Work or Service Order, and in compliance with other documented reasonable written instructions provided by authorized personnel of Customer, where such instructions are consistent with the terms of the Agreement. Five9 receives no monetary or other valuable consideration in exchange for Personal Information.

4. PARTIES’ RESPONSIBILITIES

4.1 Each Party is responsible (i) for its own compliance with the Privacy Laws, where applicable; and (ii) with respect to the processing of Personal Information hereunder, for ensuring its employees, agents, and sub-processors understand and comply with the Privacy Laws and this Addendum. Each Party agrees that it will notify the other Party upon determining that it is unable to process Personal Information in compliance with the Privacy Laws.

4.2 Customer shall ensure any processing of Personal Information is in accordance with the requirements of the applicable Privacy Laws. Customer has the sole responsibility for the accuracy, quality, and legality of Personal Information and means by which Customer acquired Personal Information; Customer represents and warrants that it has provided and/or obtained, to the extent required by applicable Privacy Laws, all necessary notices, opt-out rights and/or consent to Personal Information being used and shared for the purposes described herein. Customer shall, in writing, direct any consumer requests to Five9, and (i) verify the identity of the consumer as required by applicable Privacy Laws; (ii) assist in locating Personal Information shared with Five9; and (iii) cooperate in good faith with Five9 to determine whether a request should be complied with or whether any exceptions for compliance with the request apply.  Five9 reserves all rights and asserts all exceptions and exemptions to which it is entitled under applicable Privacy Laws (such as preserving Personal Information in order to protect against malicious, deceptive, fraudulent or illegal activity; or to comply with a legal obligation, etc.).

4.3 Taking into account the context of the processing, Five9 will (i) implement and maintain appropriate technical and organizational security measures to safeguard Personal Information as described in Annex 2 (Technical and Organizational Measures Including Technical and Organizational Measures to Secure Data); and (ii) provide the level of privacy protection required by applicable Privacy Laws.

4.4 Five9, its employees, agents, and sub-processors are subject to a duty of confidentiality with respect to Personal Information.  Five9 will not (i) “sell” or “share” (as each is defined under the applicable Privacy Laws) Personal Information, (ii) retain, use, or disclose Personal Information outside of Customer’s instructions set forth in Section 3 above or for any commercial purpose not specified in the Agreement, or (iii) when prohibited by applicable Privacy Laws, combine Personal Information received from Customer with Personal Information that Five9 receives from, or on behalf of, another person or persons, or collects from its own interactions with consumers.

4.5 Customer understands and agrees that (i) it may store its customers’ telephone numbers in the Five9 Virtual Contact Center (“VCC”); (ii) storage of Protected Health Information (PHI) in the VCC database (e.g., contact records or agent notes) is strictly prohibited unless Customer orders Five9 encryption Services under an applicable Service Order; and (iii) storage of Payment Card Data in text format (e.g., Payment Card Data within contact records, agent notes, email, chat, SMS transcripts, etc.) is strictly prohibited. Notwithstanding anything to the contrary, Customer may not store designated record sets (as defined by the Health Insurance Portability and Accountability Act) in the VCC.

4.6 Customer, its affiliates, and agents agree that they will at all times (i) configure VCC technical security measures that include password requirements in a manner consistent with relevant industry standards, (ii) administer authentication and authorization based on relevant industry standards including least privilege and individual accountability for all users, and (iii) use only secure protocols as offered by Five9 including encryption of data in transit (e.g., sRTP, VPN, and sFTP) and encryption of call recordings at rest (e.g., Encrypted Storage).

5. SUB-PROCESSORS

5.1 Appointment. Customer acknowledges and agrees that Five9 may engage third-party sub-processors in connection with the provision of the Services. Five9 will enter into a written agreement with each sub-processor containing, in substance, data protection obligations no less protective than those in the Agreement and this Addendum with respect to the protection of Personal Information to the extent applicable to the nature of the Services provided by such sub-processor.

5.2 Notice. Five9 provides its current sub-processors on the Customer Support page at https://login.five9.com (Customer authentication required). Customer hereby consents to these sub-processors.

5.3 Objection. If Customer reasonably objects to Five9’s use of a new sub-processor which would result in Five9’s breach of this Addendum in relation to the protection of Personal Information, Customer shall promptly notify Five9 in writing no later than within thirty (30) days of receipt of Five9’s notice. If Customer so objects to a new sub-processor, and the Parties cannot resolve the objection within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the applicable Service Order(s) with respect to those Services which cannot be provided by Five9 without the use of the objected to new sub-processor by providing written notice to Five9. Five9 will refund Customer any prepaid fees covering the remainder of the term of such Services following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.

6. CONSUMER REQUESTS

Taking into account the nature of processing and the information available to Five9, Five9 shall assist Customer by taking appropriate technical and organizational measures, insofar as this is reasonably practicable, for the fulfillment of Customer’s obligations under Privacy Laws to respond to consumers’ requests to exercise their rights.

7. INCIDENT MANAGEMENT AND NOTIFICATION

Five9 shall promptly notify Customer without undue delay, but no later than 72 hours, upon confirmation of unauthorized disclosure, use, or access to Personal Information transmitted, stored or otherwise processed by Five9 (a “Personal Data Breach”). Five9 shall make reasonable efforts to identify the cause of such Personal Data Breach and take such steps as Five9 deems necessary and reasonable to remediate the cause of such Personal Data Breach to the extent the remediation is within Five9’s reasonable control. In accordance with applicable Privacy Laws, Customer has the right, upon reasonable written notice to Five9, to take reasonable and appropriate steps to stop and remediate Five9’s unauthorized use of Personal Information.  

8. DATA RETENTION, USE, AND DESTRUCTION

Five9 retains data according to Five9’s data retention practices, which are set forth at https://www.five9.com/legal/dataretention.   

9. DATA PROTECTION IMPACT ASSESSMENT

The Services may contain features designed to interoperate with non-Five9 Services (“Non-Five9 Services”).  Customer is solely responsible for the use of such Non-Five9 Services and any data loss or other losses it may suffer as a result of using any such Non-Five9 Services, and Customer shall ensure that its use of any such integration or interoperability complies with the terms of use of those Non-Five9 Services. Five9 makes no warranty or guarantee with regards to any Non-Five9 Services, any interoperation between the Services and any Non-Five9 Services, or the continued availability of such features, and may cease providing such features for any reason without incurring fault or liability, for example, and without limitation, if the provider of the Non-Five9 Services ceases to make the Non-Five9 Services available for interoperation with the Services. Any cessation of such features will not entitle Customer to any refund of fees for Services or other compensation.

10. AUDIT RIGHTS

At Customer’s written request, Five9 shall provide third party attestations demonstrating compliance with its obligations under the Privacy Laws with respect to Personal Information. To the extent such attestations do not adequately address Five9’s compliance with such Privacy Laws, Five9 shall permit and contribute to remote audits of information reasonably necessary to demonstrate Five9’s compliance with its obligations under such Privacy Laws. Customer shall make reasonable efforts to minimize disruption to Five9’s business during any such audit. Such audits shall be conducted during normal business hours and shall occur no more than once per year or in the confirmed event of non-compliance, and be limited to Personal Information. Customer shall provide Five9 written notice of any such audit at least sixty (60) days in advance with a finalized audit scope and evidence request list provided in writing no less than thirty (30) days in advance of such audit.  

11. MISCELLANEOUS

11.1 Severability. If any provision of this Addendum shall be found to be void by a court of law, such provision shall be deemed to be severable from the other provisions of this Addendum, and the remainder of this Addendum shall be given effect, as if the Parties had not included the severed provision.

11.2 Survival. All representations, warranties, and indemnities shall survive the termination and/or expiration of this Addendum and shall remain in full force and effect. All of a Party’s rights and privileges — to the extent they are fairly attributable to events or conditions occurring or existing on or prior to the termination and/or expiration of this Addendum — shall survive termination and shall be enforceable by that Party.

11.3 General.  The terms and conditions of the Agreement are incorporated by reference into this Addendum with full force and effect.  Except as expressly set forth herein, the terms of the Agreement shall remain unmodified and in full force and effect. In the event of a conflict between the terms of the Agreement and the terms of this Addendum, the terms of this Addendum shall control.  Headers are for convenience and do not affect the interpretation of the terms of this Addendum.

ANNEX 1: DETAILS OF THE PROCESSING

ANNEX 2: TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA