Data Processing Addendum

How we process data with LiveKit's cloud-managed service.

Last Updated: 06/15/2023

---

This Data Processing Addendum (the “Addendum”) forms part of, and is subject to, the Terms of Service or other written or electronic terms of service or subscription agreement between LiveKit Incorporated (“LiveKit“) and the legal entity defined as 'Customer' thereunder together with all Customer Affiliates who are signatories to an Order Form for their own LiveKit account pursuant to such agreement (collectively, for purposes of this Addendum, “Customer”, and together with LiveKit, the “parties”) (such agreement, the “Agreement”). This Addendum shall be effective on the effective date of the Agreement, unless this Addendum is separately executed in which case it's effective on the date of the last signature (the “DPA Effective Date”). All capitalized terms not defined in this Addendum shall have the meanings set forth in the Agreement. LiveKit may update this Addendum from time to time, and it will provide reasonable notice of any such updates.

I. Introduction

1. Definitions

• “Applicable Data Protection Law” refers to all laws and regulations applicable to LiveKit's processing of personal data under the Agreement.
• “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “Customer Account Data” means personal data that relates to Customer's relationship with LiveKit, including the names or contact information of individuals authorized by Customer to access Customer's account.
• “Customer Content” means (a) personal data exchanged as a result of using the Services (as defined below), such as voice and video media, images, sound, and, where applicable, details Customer submits to the Services from its designated software applications and services and (b) data stored on Customer's behalf such as communication logs within the Services, including but not limited to recordings, or end user application metadata that Customer has uploaded to the Services (as defined below).
• “Customer Data” means Customer Account Data, Customer Usage Data, Customer Content, and Sensitive Data, each as defined in this Addendum.
• “Customer Usage Data” means data processed by LiveKit for the purposes of transmitting or exchanging Customer Content utilizing communication networks operated by LiveKit or its Affiliates. Customer Usage Data includes (a) data used to identify the source and destination of a communication, such as (i) data on the location of the device generated in the context of providing the Services, and the date, time, duration and type of communication, and (ii) activity logs used to identify the source of Services requests, optimize and maintain performance of the Services, and investigate and prevent system abuse; and (b) analytics and telemetry data generated by Customer's usage of the Services.
• “personal data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• “processor” means the entity which processes personal data on behalf of the controller.
• “processing” (and “process”) means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• “Security Incident” means a confirmed or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data while in LiveKit's possession or under its control.
• “Sensitive Data” means (a) social security number, passport number, driver's license number, or similar identifier (or any portion thereof); (b) credit or debit card number (other than the truncated (last four digits) of a credit or debit card), financial information, banking account numbers or passwords; (c) employment, financial, genetic, biometric or health information; (d) racial, ethnic, political or religious affiliation, trade union membership, or information about sexual life or sexual orientation; (e) account passwords, mother's maiden name, or date of birth; (f) criminal history; or (g) any other information or combinations of information that falls within the definition of “special categories of data” under GDPR or any other applicable law or regulation relating to privacy and data protection.
• “Services” means the products and services provided by LiveKit or its Affiliates, as applicable, that are (a) used by Customer, including, without limitation, products and services that are on a trial basis or otherwise free of charge or (b) ordered by Customer under an Order Form. Services include products and services that provide both (x) platform services, including access to any application programming interface (“LiveKit API”) and (y) where applicable, communications services used in connection with the LiveKit APIs.
• “sub-processor” means (a) LiveKit, when LiveKit is processing Customer Content and where Customer is a processor of such Customer Content or (b) any third-party processor engaged by LiveKit to process Customer Content in order to provide the Services to Customer.
• “Third-Party Request” means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.
• “LiveKit Privacy Policy” means the privacy policy for the Services, the current version of which is available at https://livekit.io/legal/privacy-policy.

Capitalized terms not defined in this Section 1 will have the meaning given to them in this Addendum or the Agreement, as applicable.

II. Controller and Processor

2. Relationship of the Parties

2.1 LiveKit as a Processor. The parties acknowledge and agree that with regard to the processing of Customer Content, Customer may act either as a controller or processor and LiveKit is a processor. LiveKit will process Customer Content in accordance with Customer's instructions as set forth in Section 5 (Customer Instructions).

2.2 LiveKit as a Controller of Customer Account Data. The parties acknowledge that, with regard to the processing of Customer Account Data, Customer is a controller and LiveKit is an independent controller, not a joint controller with Customer. LiveKit will process Customer Account Data as a controller in order to (a) manage the relationship with Customer; (b) carry out LiveKit's core business operations, such as accounting and filing taxes; (c) detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services; (d) perform identity verification; and (e) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the LiveKit Privacy Policy.

2.3 LiveKit as a Controller of Customer Usage Data. The parties acknowledge that, with regard to the processing of Customer Usage Data, Customer may act either as a controller or processor and LiveKit is an independent controller, not a joint controller with Customer. LiveKit will process Customer Usage Data as a controller in order to carry out the necessary functions as a communications service provider, such as: (a) LiveKit's accounting, tax, billing, audit, and compliance purposes; (b) to provide, optimize, and maintain the Services, platform and security; (c) to investigate fraud, spam, wrongful or unlawful use of the Services; (d) as required by applicable law or regulation; or (e) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the LiveKit Privacy Policy.

2.4 Responsibility for Affiliates. Customer shall be responsible for Affiliates' compliance with this Addendum and all acts and/or omissions by an Affiliate with respect to Customer's obligations in this Addendum shall be considered the acts and/or omissions of Customer. Affiliates shall not bring a claim directly against LiveKit. If an Affiliate seeks to assert a legal demand, action, suit, claim, proceeding or otherwise against LiveKit (“Affiliate Claim”): (i) Customer must bring such Affiliate Claim directly against LiveKit on behalf of such Affiliate, unless Applicable Data Protection Law requires the Affiliate be a party to such claim; and (ii) all Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including any aggregate limitation of liability.

3. Purpose Limitation. LiveKit will process personal data in order to provide the Services in accordance with the Agreement, or otherwise as set forth in the Agreement or as permitted by Applicable Data Protection Law. Schedule 1 (Details of Processing) of this Addendum further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of personal data and categories of data subjects.

4. Compliance. Customer is responsible for ensuring that (a) it has complied, and will continue to comply, with Applicable Data Protection Law in its use of the Services and its own processing of personal data and (b) it has, and will continue to have, the right to transfer, or provide access to, personal data to LiveKit for processing in accordance with the terms of the Agreement and this Addendum.

III. LiveKit as a Processor - Processing Customer Content

5. Customer Instructions. Customer appoints LiveKit as a processor to process Customer Content on behalf of, and in accordance with, Customer's instructions (a) as set forth in the Agreement, this Addendum, and as otherwise necessary to provide the Services to Customer, and which includes investigating security incidents and preventing spam, fraudulent activity, and violations of the LiveKit Acceptable Use Policy, the current version of which is available at https://livekit.io/legal/acceptable-use-policy, and detecting and preventing network exploits or abuse; (b) as necessary to comply with applicable law or regulation, including Applicable Data Protection Law; and (c) as otherwise agreed in writing between the parties (“Permitted Purposes”).

5.1 Lawfulness of Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Law. Customer acknowledges that LiveKit is neither responsible for determining which laws or regulations are applicable to Customer's business nor whether LiveKit's provision of the Services meets or will meet the requirements of such laws or regulations. Customer will ensure that LiveKit's processing of Customer Content, when done in accordance with Customer's instructions, will not cause LiveKit to violate any applicable law or regulation, including Applicable Data Protection Law. LiveKit will inform Customer if it becomes aware, or reasonably believes, that Customer's instructions violate any applicable law or regulation, including Applicable Data Protection Law.

5.2 Additional Instructions. Additional instructions outside the scope of the Agreement or this Addendum will be agreed to between the parties in writing, including any additional fees that may be payable by Customer to LiveKit for carrying out such additional instructions.

6. Confidentiality

6.1 Responding to Third-Party Requests. In the event any Third-Party Request is made directly to LiveKit in connection with LiveKit's processing of Customer Content, LiveKit will promptly inform Customer and provide details of the same, to the extent legally permitted. LiveKit will not respond to any Third-Party Request without Customer's prior consent, except as legally required to do so or to confirm that such Third-Party Request relates to Customer.

6.2 Confidentiality Obligations of LiveKit Personnel. LiveKit will ensure that any person it authorizes to process Customer Content (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

7. Sub-processors

7.1 Authorization for Onward Sub-processing. Customer provides a general authorization for LiveKit to engage onward sub-processors that is conditioned on the following requirements:

(a) LiveKit will restrict the onward sub-processor's access to Customer Content only to what is strictly necessary to provide the Services, and LiveKit will prohibit the sub-processor from processing the personal data for any other purpose;

(b) LiveKit agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Content to the standard required by Applicable Data Protection Law, including the requirements set forth in Schedule 4 (Jurisdiction Specific Terms) of this Addendum; and

(c) LiveKit will remain liable for any breach of this Addendum that is caused by an act, error, or omission of its sub-processors.

7.2 Current Sub-processors and Notification of Sub-processor Changes. Customer consents to LiveKit engaging third party sub-processors to process Customer Content within the Services for the Permitted Purposes provided that LiveKit maintains an up-to-date list of its sub-processors at https://livekit.io/legal/sub-processors, which contains a mechanism for Customer to subscribe to notifications of new sub-processors. If Customer subscribes to such notifications, LiveKit will provide details of any change in sub-processors as soon as reasonably practicable. With respect to LiveKit's sub-processors, LiveKit will give written notice no less than ten (10) days prior to any such change.

7.3 Objection Right for new Sub-processors. Customer may object to LiveKit's appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is in writing and based on reasonable grounds relating to data protection. In such an event, the parties agree to discuss commercially reasonable alternative solutions in good faith. Customer acknowledges that certain sub-processors are essential to providing the Services and that objecting to the use of a sub-processor may prevent LiveKit from continuing to offer the Services to Customer. Such discontinuation will be without prejudice to any fees incurred by Customer prior to the discontinuation of the affected Services. If no objection has been raised prior to LiveKit replacing or appointing a new sub-processor, LiveKit will deem Customer to have authorized the new sub-processor.

8. Data Subject Rights. As part of the Services, LiveKit provides Customer with a number of self-service features, including the ability to delete, obtain a copy of, or restrict access to Customer Content. Customer may use these self-service features to assist in complying with its obligations under Applicable Data Protection Law with respect to responding to requests from data subjects via the Services at no additional cost. To the extent Customer does not have the ability to resolve a data subject request through the self-service features, upon Customer's request, LiveKit will provide reasonable additional and timely assistance to assist Customer in complying with its data protection obligations with respect to data subject rights under Applicable Data Protection Law.

9. Impact Assessments and Consultations. LiveKit will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer's expense only if such reasonable cooperation will require LiveKit to assign significant resources to that effort) or consultations with regulatory authorities that may be required in accordance with Applicable Data Protection Law.

10. Return or Deletion of Customer Content. LiveKit will, in accordance with Section 3 (Duration of the Processing) of Schedule 1 (Details of Processing) of this Addendum, delete or return to Customer any Customer Content stored within the Services.

10.1 Extension of Addendum. Upon termination of the Agreement, LiveKit may retain Customer Content in storage for the time periods set forth in Schedule 1 (Details of Processing) of this Addendum, provided that LiveKit will ensure that Customer Content (a) is processed only as necessary for the Permitted Purposes and (b) remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.

10.2 Retention Required by Law. Notwithstanding anything to the contrary in this Section 10, LiveKit may retain Customer Content, or any portion of it, if required by applicable law or regulation, including Applicable Data Protection Law, provided such Customer Content remains protected in accordance with the terms of the Agreement, this Addendum, and Applicable Data Protection Law.

IV. Security and Audits

11. Security

11.1 Security Measures. LiveKit has implemented and will maintain the technical and organizational security measures as set forth in the LiveKit Security Overview document. Additional information about LiveKit's technical and organizational security measures to protect Customer Data is set forth in Schedule 2 (Technical and Organizational Security Measures) of this Addendum.

11.2 Determination of Security Requirements. Customer acknowledges the Services include certain features and functionalities that Customer may elect to use which impact the security of Customer Data processed by Customer's use of the Services, such as, but not limited to, end-to-end encryption or egress. Customer is responsible for reviewing the information LiveKit makes available regarding its data security, including its audit reports, and making an independent determination as to whether the Services meet the Customer's requirements and legal obligations, including its obligations under Applicable Data Protection Law. Customer is further responsible for properly configuring the Services and using features and functionalities made available by LiveKit to maintain appropriate security in light of the nature of Customer Data processed as a result of Customer's use of the Services.

11.3 Security Incident Notification and Response. LiveKit will provide notification of a Security Incident in the following manner:

(a) LiveKit will, to the extent permitted by applicable law, notify Customer without undue delay, but in no event later than seventy-two (72) hours after LiveKit's discovery of a Security Incident impacting Customer Data of which LiveKit is a processor;

(b) LiveKit will, to the extent permitted and required by applicable law, notify Customer without undue delay of any Security Incident involving Customer Data of which LiveKit is a controller; and

(c) LiveKit will notify Customer of any Security Incident via email to the email address(es) designated by Customer in Customer's account.

LiveKit will make reasonable efforts to identify a Security Incident, and to the extent a Security Incident is caused by LiveKit's violation of this Addendum, remediate the cause of such Security Incident. LiveKit will provide reasonable assistance to Customer in the event that Customer is required under Applicable Data Protection Law to notify a regulatory authority or any data subjects impacted by a Security Incident.

The obligations described in this Section 11.3 shall not apply in the event to the extent that a Security Incident results from the actions or omissions of Customer. LiveKit's obligation to report or respond to a Security Incident under this Section 11.3 will not be construed as an acknowledgement by LiveKit of any fault or liability with respect to such Security Incident.

12. Audits. The parties acknowledge that Customer must be able to assess LiveKit's compliance with its obligations under Applicable Data Protection Law and this Addendum, insofar as LiveKit is acting as a processor on behalf of Customer.

12.1 LiveKit's Audit Program. LiveKit uses external auditors to verify the adequacy of its security measures with respect to its processing of Customer Content. Such audits are performed at least once annually at LiveKit's expense by independent third-party security professionals at LiveKit's selection and result in the generation of a confidential audit report (“Audit Report”).

12.2 Customer Audit. Upon Customer's written request at reasonable intervals, and subject to reasonable confidentiality controls, LiveKit will make available to Customer a copy of LiveKit's most recent Audit Report. Customer agrees that any audit rights granted by Applicable Data Protection Law will be satisfied by these Audit Reports. To the extent that LiveKit's provision of an Audit Report does not provide sufficient information or Customer is required to respond to a regulatory authority audit, Customer agrees to a mutually agreed-upon audit plan with LiveKit that: (a) ensures the use of an independent third party; (b) provides written notice to LiveKit in a timely fashion; (c) requests access only during business hours; (d) accepts billing to Customer at LiveKit's then-current rates; (e) occurs no more than once annually; (f) restricts its findings to only data relevant to Customer; and (g) obligates Customer, to the extent permitted by law or regulation, to keep confidential any information gathered that, by its nature, should be confidential.

V. International Provisions

13. Jurisdiction Specific Terms. To the extent LiveKit processes personal data originating from and protected by Applicable Data Protection Law in one of the jurisdictions listed in Schedule 4 (Jurisdiction Specific Terms) of this Addendum, the terms specified in Schedule 4 with respect to the applicable jurisdiction(s) apply in addition to the terms of this Addendum.

14. Cross Border Data Transfer Mechanisms for Data Transfers. To the extent Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction (i.e., the European Economic Area*,* the United Kingdom, Switzerland, or any other jurisdiction listed in Schedule 4 (Jurisdiction Specific Terms) of this Addendum) to LiveKit located outside of that jurisdiction (“Transfer Mechanism”), the terms set forth in Schedule 3 (Cross Border Transfer Mechanisms) of this Addendum will apply.

VI. Miscellaneous

15. Liability. Notwithstanding anything to the contrary in the Agreement or this Addendum, each party's and all of its Affiliates' liability, taken together in the aggregate, arising out of or relating to this Addendum, the EU Standard Contractual Clauses, and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. Without limiting the parties' obligations under the Agreement, each party agrees that any regulatory penalties incurred by one party (the “Incurring Party”) in relation to the Customer Data that arise as a result of, or in connection with, the other party's failure to comply with its obligations under this Addendum or any Applicable Data Protection Law shall count toward and reduce the Incurring Party's liability under the Agreement as if it were liability to the other party under the Agreement.

16. Cooperation and Data Subject Rights. In the event that either party receives (a) any request from a data subject to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, objection, erasure, and data portability, as applicable) or (b) any Third-Party Request relating to the processing of Customer Account Data or Customer Usage Data conducted by the other party, such party will promptly inform such other party in writing. The parties agree to cooperate, in good faith, as necessary to respond to any Third-Party Request and fulfill their respective obligations under Applicable Data Protection Law.

17. Conflict. In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) the applicable terms set forth in Schedule 4 (Jurisdiction Specific Terms) of this Addendum; (2) the terms of this Addendum outside of Schedule 4 (Jurisdiction Specific Terms); (3) the Agreement; and (4) the LiveKit Privacy Policy. Any claims brought in connection with this Addendum will be subject to the terms and conditions, including, without limitation, the exclusions and limitations set forth in the Agreement.

18. Updates. LiveKit may, from time to time, update the terms of this Addendum; which contains a mechanism for Customer to subscribe to notifications of updates. If Customer subscribes to such notifications, LiveKit will provide notice at least thirty (30) days in advance when an update is required as a result of (a) changes in Applicable Data Protection Law; (b) a merger, acquisition, or other similar transaction; or (c) the release of new products or services or material changes to any of the existing Services. The then-current terms of this Addendum are available at https://livekit.io/legal/data-processing-addendum.

---

SCHEDULE 1

DETAILS OF PROCESSING

1. Nature and Purpose of the Processing. LiveKit will process personal data as necessary to provide the Services under the Agreement. LiveKit does not sell Customer's personal data or Customer end users' personal data and does not share such end users' information with third parties for compensation or for those third parties' own business interests.

1.1 Customer Content. LiveKit will process Customer Content as a processor in accordance with Customer's instructions as set forth in Section 5 (Customer Instructions) of this Addendum.

1.2 Customer Account Data. LiveKit will process Customer Account Data as a controller for the purposes set forth in Section 2.2 (LiveKit as a Controller of Customer Account Data) of this Addendum.

1.3 Customer Usage Data. LiveKit will process Customer Usage Data as a controller for the purposes set forth in Section 2.3 (LiveKit as a Controller of Customer Usage Data) of this Addendum.

2. Processing Activities.

2.1 Customer Content. Personal data contained in Customer Content will be subject to the following basic processing activities:

(a) the provision of programmable communication products and services, primarily offered in the form of application programming interfaces (APIs), to Customer, including transmittal to or from Customer's software applications or services and designated third parties as directed by Customer by way of communications networks operated by LiveKit or its Affiliates; and

(b) the storage of personal data on LiveKit's network or within the Services.

2.2 Customer Account Data. Personal data contained in Customer Account Data will be subject to the processing activities of providing the Services.

2.3 Customer Usage Data. Personal data contained in Customer Usage Data will be subject to the processing activities of providing the Services, including the generation of analytics and telemetry reports. These reports may be used to help improve the Services and provide additional insights to Customer.

3. Duration of the Processing. The period for which personal data will be retained and the criteria used to determine that period is as follows:

3.1 Customer Content. Prior to the termination of the Agreement, (x) LiveKit will process stored Customer Content for the Permitted Purposes until Customer elects to delete such Customer Content via the Services and (y) Customer agrees that it is solely responsible for deleting Customer Content via the Services. LiveKit will (i) provide Customer thirty (30) days after the termination effective date to obtain a copy of any stored Customer Content via the Services; (ii) automatically delete any stored Customer Content thirty (30) days after the termination effective date; and (iii) automatically delete any stored Customer Content on LiveKit's back-up systems sixty (60) days after the termination effective date. Any Customer Content archived on LiveKit's back-up systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation.

3.2 Customer Account Data. LiveKit will process Customer Account Data as long as required (a) to provide the Services to Customer; (b) for LiveKit's legitimate business needs; or (c) by applicable law or regulation. Customer Account Data will be stored in accordance with the LiveKit Privacy Policy.

3.3 Customer Usage Data. Upon termination of the Agreement, LiveKit may retain, use, and disclose Customer Usage Data for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1, subject to the confidentiality obligations set forth in the Agreement. LiveKit will anonymize or delete Customer Usage Data when LiveKit no longer requires it for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1.

4. Categories of Data Subjects.

4.1 Customer Content. Customer's end users.

4.2 Customer Account Data. Customer's employees and individuals authorized by Customer to access Customer's LiveKit account.

4.3 Customer Usage Data. Customer's end users.

5. Categories of Personal Data. LiveKit processes personal data contained in Customer Account Data, Customer Content, and Customer Usage Data.

6. Sensitive Data or Special Categories of Data.

6.1 Customer Content. Sensitive Data may, from time to time, be processed via the Services where Customer or its end users choose to include Sensitive Data within the communications that are transmitted using the Services. Customer is responsible for ensuring that suitable safeguards are in place prior to transmitting or processing, or prior to permitting Customer's end users to transmit or process, any Sensitive Data via the Services.

6.2 Customer Account Data and Customer Usage Data.

(a) Customer Account Data does not contain Sensitive Data.

(b) Customer Usage Data does not contain Sensitive Data.

---

SCHEDULE 2

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Where applicable, this Schedule 2 will serve as Annex II to the EU Standard Contractual Clauses and Appendix 2 of the UK SCCs. The following table provides more information regarding the technical and organizational security measures set forth below.

---

SCHEDULE 3

CROSS BORDER DATA TRANSFER MECHANISMS

1. Definitions

• “EEA” means the European Economic Area
• “EU Standard Contractual Clauses” means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.
• “UK International Data Transfer Agreement” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022.

2. Cross Border Data Transfer Mechanisms.

2.1 Customer Data Transfers. The parties agree that LiveKit may transfer Customer Data processed under this Addendum outside the EEA, the UK, or Switzerland as necessary to provide the Services. Customer acknowledges that LiveKit's primary processing operations take place in the United States, and that the transfer of Customer Data to the United States is necessary for the provision of the Services to Customer. If LiveKit transfers Customer Data protected under this Addendum to a jurisdiction for which the European Commission has not issued an adequacy decision, LiveKit will ensure that appropriate safeguards have been implemented for the transfer of Customer Data in accordance with Applicable Data Protection Law.

2.2 Order of Precedence. In the event the Services are covered by more than one Transfer Mechanism, the transfer of personal data will be subject to a single Transfer Mechanism in accordance with the following order of precedence: (a) the EU Standard Contractual Clauses as set forth in Section 2.3 (EU Standard Contractual Clauses) of this Schedule 3; (b) the UK International Data Transfer Agreement as set forth in Section 2.4 (UK International Data Transfer Agreement) of this Schedule 3; and, if neither (a) nor (b) is applicable, then (c) other applicable data Transfer Mechanisms permitted under Applicable Data Protection Law.

2.3 EU Standard Contractual Clauses. The parties agree that the EU Standard Contractual Clauses will apply to personal data that is transferred via the Services from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data. For data transfers from the EEA that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:

(a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where (i) LiveKit is processing Customer Account Data and (ii) Customer is a controller of Customer Usage Data and LiveKit is processing Customer Usage Data;

(b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a controller of Customer Content and LiveKit is processing Customer Content;

(c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a processor of Customer Content and LiveKit is processing Customer Content on behalf of Customer as a sub-processor;

(d) For each Module, where applicable:

(i) in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply;

(ii) in Clause 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of sub-processor changes will be as set forth in Section 7.2 (Current Sub-processors and Notification of Sub-processor Changes) of this Addendum;

(iii) in Clause 11 of the EU Standard Contractual Clauses, the optional language will not apply;

(iv) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by Irish law;

(v) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;

(vi) in Annex I, Part A of the EU Standard Contractual Clauses:

Data Exporter: Name: Customer Contact details: The email address(es) designated by Customer in Customer's account. Data Exporter Role: The Data Exporter's role is set forth in Section 2 (Relationship of the Parties) of this Addendum. Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these EU Standard Contractual Clauses incorporated herein, including their Annexes, as of the effective date of the Agreement.

Data Importer: Name: LiveKit Incorporated Contact details: LiveKit Privacy Team - [email protected] Data Importer Role: The Data Importer's role is set forth in Section 2 (Relationship of the Parties) of this Addendum. Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these EU Standard Contractual Clauses, incorporated herein, including their Annexes, as of the effective date of the Agreement;

(vii) in Annex I, Part B of the EU Standard Contractual Clauses:

The categories of data subjects are set forth in Section 4 of Schedule 1 (Details of Processing) of this Addendum.

The Sensitive Data transferred is set forth in Section 6 of Schedule 1 (Details of Processing) of this Addendum.

The frequency of the transfer is a continuous basis for the duration of the Agreement.

The nature of the processing is set forth in Section 1 of Schedule 1 (Details of Processing) of this Addendum.

The purpose of the processing is set forth in Section 1 of Schedule 1 (Details of Processing) of this Addendum.

The period for which the personal data will be retained is set forth in Section 3 of Schedule 1 (Details of Processing) of this Addendum.

For transfers to sub-processors, LiveKit will maintain a list of authorized sub-processors set forth at https://livekit.io/legal/sub-processors;

(viii) in Annex I, Part C of the EU Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority; and

(ix) Schedule 2 (Technical and Organizational Security Measures) of this Addendum serves as Annex II of the EU Standard Contractual Clauses.

2.4 UK International Data Transfer Agreement. The parties agree that the UK International Data Transfer Agreement will apply to personal data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to any country or recipient outside of the United Kingdom that is not recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal data. For data transfers from the United Kingdom that are subject to the UK International Data Transfer Agreement, the UK International Data Transfer Agreement will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:

(a) In Table 1 of the UK International Data Transfer Agreement, the parties' details and key contact information is located in Section 2.3 (e)(vi) of this Schedule 3.

(b) In Table 2 of the UK International Data Transfer Agreement, information about the version of the Approved EU SCCs, modules and selected clauses which this UK International Data Transfer Agreement is appended to is located in Section 2.3 (EU Standard Contractual Clauses) of this Schedule 3.

(c) In Table 3 of the UK International Data Transfer Agreement:

1. The list of Parties is located in Section 2.3(e)(vi) of this Schedule 3.
2. The description of the transfer is set forth in Section 1 (Nature and Purpose of the Processing) of Schedule 1 (Details of the Processing).
3. Annex II is located in Schedule 2 (Technical and Organizational Security Measures)
4. The list of sub-processors is located at https://livekit.io/legal/sub-processors.

(d) In Table 4 of the UK International Data Transfer Agreement, both the Importer and the exporter may end the UK International Data Transfer Agreement in accordance with the terms of the UK International Data Transfer Agreement.

2.5 Conflict. To the extent there is any conflict or inconsistency between the EU Standard Contractual Clauses or UK International Data Transfer Agreement and any other terms in this Addendum, including Schedule 4 (Jurisdiction Specific Terms), the Agreement, or the LiveKit Privacy Policy, the provisions of the EU Standard Contractual Clauses or UK International Data Transfer Agreement, as applicable, will prevail.

---

SCHEDULE 4

JURISDICTION SPECIFIC TERMS

1. California:

1.1 The definition of “Applicable Data Protection Law” includes the California Consumer Privacy Act (CCPA).

1.2 The definition of “personal data” includes “Personal Information” as defined under Applicable Data Protection Law and, for clarity, includes any Personal Information contained within Customer Account Data, Customer Content, and Customer Usage Data.

1.3 The definition of “data subject” includes “Consumer” as defined under Applicable Data Protection Law. Any data subject rights, as set forth in Section 8 (Data Subject Rights) of this Addendum, apply to Consumer rights. In regards to data subject requests, LiveKit can only verify a request from Customer and not from Customer's end user or any third party.

1.4 The definition of “controller” includes “Business” as defined under Applicable Data Protection Law.

1.5 The definition of “processor” includes “Service Provider” as defined under Applicable Data Protection Law.

1.6 LiveKit will process, retain, use, and disclose personal data only as necessary to provide the Services under the Agreement, which constitutes a business purpose. LiveKit agrees not to (a) sell (as defined by the CCPA) Customer's personal data or Customer end users' personal data; (b) retain, use, or disclose Customer's personal data for any commercial purpose (as defined by the CCPA) other than providing the Services; or (c) retain, use, or disclose Customer's personal data outside of the scope of the Agreement. LiveKit understands its obligations under the Applicable Data Protection Law and will comply with them.

1.7 LiveKit certifies that its sub-processors, as set forth in Section 7 (Sub-processors) of this Addendum, are Service Providers under Applicable Data Protection Law, with whom LiveKit has entered into a written contract that includes terms substantially similar to this Addendum. LiveKit conducts appropriate due diligence on its sub-processors.

1.8 LiveKit will implement and maintain reasonable security procedures and practices appropriate to the nature of the personal data it processes as set forth in Section 11 (Security) of this Addendum.

2. European Economic Area (EEA):

2.1 The definition of “Applicable Data Protection Law” includes the General Data Protection Regulation (EU 2016/679) (“GDPR”).

2.2 When LiveKit engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the European Union has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the EU Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.

2.3 Notwithstanding anything to the contrary in this Addendum or in the Agreement (including, without limitation, either party's indemnification obligations), neither party will be responsible for any GDPR fines issued or levied under Article 83 of the GDPR against the other party by a regulatory authority or governmental body in connection with such other party's violation of the GDPR.

2.4 Customer acknowledges that LiveKit, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires LiveKit to notify impacted data subjects with whom LiveKit does not have a direct relationship (e.g., Customer's end users), LiveKit will notify Customer of this requirement. Customer will provide reasonable assistance to LiveKit to notify the impacted data subjects.

3. Switzerland:

3.1 The definition of “Applicable Data Protection Law” includes the Swiss Federal Act on Data Protection, as revised (FADP).

3.2 When LiveKit engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that Switzerland has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the EU Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.

3.3 To the extent that personal data transfers from Switzerland are subject to the EU Standard Contractual Clauses in accordance with Section 2.3 of Schedule 3 (Cross Border Data Transfer Mechanisms), the following amendments will apply to the EU Standard Contractual Clauses:

(a) references to "EU Member State" and "Member State' will be interpreted to include Switzerland, and

(b) insofar as the transfer or onward transfers are subject to the FADP:

(i) references to "Regulation (EU) 2016/679" are to be interpreted as references to the FADP;

(ii) the "competent supervisory authority" in Annex I, Part C will be the Swiss Federal Data Protection and Information Commissioner;

(iii) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by the laws of Switzerland; and

(iv) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Switzerland.

4. United Kingdom (UK):

4.1 References in this Addendum to GDPR will to that extent be deemed to be references to the corresponding laws of the United Kingdom (including the UK GDPR and Data Protection Act 2018).

4.2 When LiveKit engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the United Kingdom has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the UK International Data Transfer Agreement or pursuant to a Binding Corporate Rules approval granted by competent United Kingdom data protection authorities.

4.3 Notwithstanding anything to the contrary in this Addendum or in the Agreement (including, without limitation, either party's indemnification obligations), neither party will be responsible for any UK GDPR fines issued or levied under Article 83 of the UK GDPR against the other party by a regulatory authority or governmental body in connection with such other party's violation of the UK GDPR.

4.4 Customer acknowledges that LiveKit, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires LiveKit to notify impacted data subjects with whom LiveKit does not have a direct relationship (e.g., Customer's end users), LiveKit will notify Customer of this requirement. Customer will provide reasonable assistance to LiveKit to notify the impacted data subjects.