ONESTREAM SOFTWARE LLC (“ONESTREAM”) HAS CREATED THIS STANDARD SAAS AGREEMENT (“AGREEMENT”) IN ORDER TO FACILITATE TRANSACTIONS BETWEEN PUBLISHER AND CUSTOMER ON ONESTREAM’S SOLUTION EXCHANGE. THIS AGREEMENT BETWEEN CUSTOMER AND PUBLISHER GOVERNS CUSTOMER’S USE OF PUBLISHER’S OFFERINGS (THE “SERVICE(S)”) WHICH ARE ACCESSED THROUGH THE ONESTREAM PLATFORM. BOTH PARTIES ACKNOWLEDGE THAT ONESTREAM IS NOT A PARTY TO THIS AGREEMENT, NOR IN ANY WAY RESPONSIBLE FOR THE PARTIES’ ACTIONS OR OBLIGATIONS UNDER THIS AGREEMENT. ONESTREAM’S RELATIONSHIP WITH CUSTOMER AND PUBLISHER IS SOLELY GOVERNED BY ONESTREAM’S RESPECTIVE AGREEMENTS WITH THOSE PARTIES. THEREFORE, NO RIGHT IS GRANTED TO THE CUSTOMER UNDER THIS AGREEMENT TO USE OR ACCESS THE ONESTREAM PLATFORM OR ONESTREAM SERVICES AS ACCESS TO THE ONESTREAM PLATFORM AND SERVICES MUST BE SEPARATELY CONTRACTED FROM ONESTREAM DIRECTLY. ONESTREAM OTHERWISE DISCLAIMS ALL LIABILITY RESULTING FROM THIS AGREEMENT.
This “Agreement” consists of this Standard SaaS Agreement, including the Documentation, together with all Order Forms.
By signing the Order Form, the Customer acknowledges they have reviewed and agree to be bound by the terms of the Standard SaaS Agreement, as it may be updated from time to time. In the event of any inconsistency or conflict between the Order Form and the Standard SaaS Agreement, the terms of this Order Form shall control.
(a) Publisher will, during the Applicable Term, make available to Customer and Permitted Entities the Service(s) solely for the internal business operations of Customer and any Permitted Entities.
(b) Customer may, during the Applicable Term, make available the Service(s) to Authorized Users solely for the internal business operations of Customer and the Permitted Entities.
(c) Customer will be liable to Publisher for all acts or omissions of any Permitted Entity and/or Authorized User that would, if committed or omitted by Customer, be a breach of this Agreement.
Publisher will provide to Customer Support Services during the Applicable Term in accordance with Exhibit A (Support Schedule) attached to this Agreement.
(a) The Applicable Term shall commence as specified on each Order Form and continue for the period as specified therein.
(b) If Publisher or Customer has not, by the date that is 60 days prior to the end of the then-current Applicable Term, given notice to the other party that it intends to not renew the Service(s), the Service(s) set out in the applicable Order Form will automatically renew for an additional one year. Publisher may increase the price during any renewal term by up to the increase in CPI (US Consumer Price Index All Items Urban Consumers) as published by the US Department of Labor for the most recent 12 month period above the pricing effective at the end of the Applicable Term prior to the renewal period.
(a) Publisher shall invoice for Service fees annually in advance at the beginning of the Applicable Term, unless otherwise provided in an Order Form.
(b) All amounts under this Agreement that are not subject to a good faith dispute of which Customer has given Publisher written notice are due within 30 days after the date of the invoice. If Customer fails to timely pay any amount as required by this Agreement, Customer will pay Publisher late fees at the lower of 1% per month or the highest rate permitted by law.
(c) All amounts shall be billed in the currency stated in the Order Form executed by the parties, and if no currency is stated then in United States Dollars.
(d) Customer will pay all sales, use, VAT, GST, or other comparable taxes associated with the Service, Professional Services, or other goods, or services provided pursuant to this Agreement but excluding taxes on Publisher’s income (“Taxes”). Publisher will, according to state or other applicable law, invoice and remit Taxes to the applicable taxing authority on Customer’s behalf.
(e) Customer will make all payments without reduction for any withholding taxes applicable under applicable laws. Where withholding tax could apply, Customer shall provide to Publisher such evidence as Publisher reasonably requests to establish that such Taxes have been paid.
(f) With respect to any tax matter which is not explicitly covered by this Section, Customer and Publisher will assist each other in good faith.
(g) No Customer requirement for purchase order numbers or other clerical or similar requirements will delay or reduce any Customer obligation under this Agreement.
(a) Either party may terminate the applicable Order Form upon notice to the other party if:
(i) The other party materially breaches this Agreement and fails to cure such material breach within 30 days (10 days for payment obligations) after the aggrieved party gives written notice of such breach (it being understood that, if the breach cannot be cured, no cure period will apply); or
(ii) The other party becomes unable generally to pay its debts as they become due, ceases to do business in the ordinary course, or dissolves, winds up, or its governing body approves such dissolution or winding up.
(b) Termination is not an exclusive remedy.
(c) Upon expiration or termination for any reason of the Agreement or the applicable Order Form:
(i) All of Customer’s rights and use of the Service will immediately cease; and
(ii) Publisher will, at Customer’s request made at any time prior to the 30th calendar day after the effective date of termination, provide to Customer, in industry-standard electronic form, a copy of such Customer Data as Publisher then holds using the Services.
(d) If Customer terminates this Agreement under Section 8(a), Publisher will refund to Customer any prepaid fees that Customer has by then paid but that Publisher has not earned, whether by performance or passage of time.
(e) The provisions of Sections 1, 7, and 9-15 will survive termination of this Agreement.
(a) Publisher warrants that, during the Applicable Term, the Service will conform in all material respects to Publisher’s then- current Documentation.
(b) The warranty in this Section will not apply to the extent that: (i) the Service is not used in accordance with this Agreement or the Documentation; (ii) the Service or any part thereof has been modified other than by Publisher or with Publisher’s written approval; or (iii) Customer fails to accept an Update proffered by Publisher that would cause the Service to conform to the warranty.
(c) TO THE MAXIMUM EXTENT PERMITTED BY LAW, PUBLISHER’S SOLE AND EXCLUSIVE LIABILITY FOR ANY BREACH OF THE WARRANTY) SHALL BE LIMITED TO REPAIR OR REPLACEMENT OF THE SERVICE, UNLESS, IN PUBLISHER’S OPINION, SUCH REPAIR OR REPLACEMENT WOULD BE INADEQUATE OR IMPRACTICAL, IN WHICH CASE PUBLISHER WILL REFUND ANY PREPAID FEE THAT CUSTOMER HAS PAID BUT THAT PUBLISHER HAS NOT EARNED. CUSTOMER WILL THEREUPON CEASE ALL USE OF THE SERVICE AND THE APPLICABLE ORDER FORM WILL TERMINATE.
(d) TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXCEPT AS OTHERWISE EXPRESSLY PROVIDED IN THIS AGREEMENT:
(e) i) PUBLISHER DISCLAIMS ANY AND ALL IMPLIED WARRANTIES; ii) PUBLISHER DOES NOT WARRANT THAT THE OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE; iii) PUBLISHER MAKES NO WARRANTY AGAINST INTERFERENCE WITH
(f) ENJOYMENT, INFRINGEMENT, MERCHANTABILITY, ACCURACY, OR FITNESS FOR PURPOSE. PUBLISHER MAKES NO REPRESENTATIONS, WARRANTIES, OR GUARANTEES OF ANY KIND, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, ORAL OR WRITTEN, WITH RESPECT TO THE PERFORMANCE OR SECURITY OF ANY PUBLIC NETWORK.
(a) Publisher will indemnify, defend, and hold harmless Customer and each Permitted Entity from any claim by a third party that the Service infringes upon that third party’s patent, copyright or trademark, or misappropriates that third party’s trade secret, provided that: (i) Customer gives to Publisher prompt notice of the claim; and (ii) Customer and each Permitted Entity give to Publisher sole control of the defense and/or settlement of the claim and reasonable assistance in conducting such defense and/or settlement. Publisher will reimburse all reasonable out-of-pocket expenses incurred by Customer in providing such assistance.
(b) Publisher’s obligations under this Section will be reduced to the extent that the claim arises out of, or relates to: (i) goods, services, or software not supplied by Publisher under this Agreement; (ii) use of the Service in a manner not expressly authorized by this Agreement; (iii) customizations, modifications, alterations of or changes to the Service not approved in writing by Publisher; (iv) combination of the Service with other goods, services, processes, or software where the alleged infringement would not exist but for such combination; (v) Service that is not the most current release and version if infringement would be avoided by use of the most current release or version; or (vi) Customer’s continuation of the allegedly infringing activity after being notified thereof.
(c) If the Service infringes upon a third party’s proprietary right or if Publisher reasonably believes that the same is likely to occur, Publisher may, at its option (in addition to, and not in lieu of, Publisher’s obligations under Section 10(a)), (i) procure for Customer the right to continue use of the Service; (ii) provide a modification to the Service so that its use becomes non-infringing;
(d) (iii) replace the Service with software that is substantially similar in functionality and performance; or (iv) if options (i) – (iii) are not commercially reasonable, then refund to Customer such Service or other fees as Customer has by then paid but that Publisher has not earned by performance or the passage of time, whereupon Customer will cease using the Service and destroy or return the Service to Publisher and this Agreement will terminate.
(e) This Section states Publisher’s sole obligation, and Customer’s exclusive remedy, for any third party claim of infringement, violation, or misappropriation of intellectual property or other proprietary rights.
(a) “Confidential Information” of a party means any information belonging to, or held by, the party, that is: i) designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure; and ii) the subject of commercially reasonable efforts by the party under the circumstances to keep it from becoming generally known to the public.
(b) Each party, as a receiving party, will do the following things with regard to the Confidential Information of the other party:
(i) Not disclose the Confidential Information to any third party other than the receiving party’s employees, agents, contractors, and/or professionals as permitted under this Agreement.
(ii) Use, and permit the use of, the Confidential Information only for the purpose of performing its obligations, or enjoying its rights, under this Agreement (the “Purpose”).
(iii) Disclose the Confidential Information only to such of the receiving party’s employees, agents, contractors, and professionals as have a bona fide need to possess or know the Confidential Information in the course of accomplishing, or advising the disclosing party with regard to, the Purpose. (iv) Cause each employee, agent, contractor, or professional to whom the receiving party discloses the Confidential Information to be bound by an obligation of confidentiality that is at least as rigorous as the obligations contained in this Agreement.
(v) Return or destroy all written or other tangible copies of Confidential Information in the receiving party’s possession or direct or indirect control, including all extracts and copies thereof, within a reasonable time after, and in accordance with, the disclosing party’s request.
(c) Nothing in this Section will prevent the receiving party from disclosing or using the Confidential Information of the disclosing party to the extent that:
(i) It is or becomes known to the public without breach by the receiving party of its confidentiality obligations;
(ii) It is received from a third party that is not under an obligation of confidentiality;
(iii) It is independently developed by the receiving party without use of the disclosing party’s Confidential Information; or
(iv) It is required by law to be disclosed, provided that the receiving party, to the extent not prohibited by law:
(v) Provides to the disclosing party as much notice as is practicable of such requirement;
(vi) Provides to the disclosing party, at the disclosing party’s request and expense, such reasonable assistance in seeking confidential treatment; and
(vii) Discloses only such Confidential Information as the receiving party, upon advice of its counsel, believes is required to be disclosed.
(viii) If the receiving party discloses Confidential Information or is likely to use or disclose Confidential Information in breach of the receiving party’s obligations under this Agreement, the disclosing party will be entitled to seek equitable relief, including injunctive relief and specific performance. The rights in this paragraph are in addition to any other rights of the disclosing party under this Agreement, at law, or in equity.
(d) These confidentiality obligations will continue for the longer of:
(i) Five (5) years after expiration or termination of this Agreement; or
(ii) The time during which the Confidential Information remains a trade secret (as that term is defined in the Uniform Trade Secrets Act) of the disclosing party.
(e) The provisions of this Section replace and supersede any confidentiality agreement or nondisclosure agreement between the parties that existed prior to, or on, the Effective Date.
(a) Publisher shall own all rights, title and interest, and all copyrights, patents, trademarks, or other intellectual property or other proprietary rights in the Service(s) and all derivatives, improvements, enhancements or modifications thereto. Publisher reserves all rights not expressly granted in this Agreement.
(b) Customer shall own all rights, title and interest in, and all copyrights, patents, trademarks, or other intellectual property or proprietary rights in, Customer Data.
(a) To the maximum extent permitted by law, except in the case of Publisher’s gross negligence, willful misconduct, fraud, obligation under Section 10 (Intellectual Property Indemnity), or breach of an obligation under Section 11 (Confidentiality), regardless of the basis of recovery claimed, whether under contract tort, negligence, strict liability, or other theory:
(i) PUBLISHER’S AGGREGATE LIABILITY UNDER THIS AGREEMENT WILL BE LIMITED TO THE AMOUNT OF FEES PAID BY CUSTOMER FOR THE LAST 12 MONTHS OF THE SERVICE; and
(ii) PUBLISHER WILL NOT BE LIABLE FOR LOSS OF PROFITS, OR SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES.
(iii) ONESTREAM WILL HAVE NO LIABILITY, WHETHER IN CONTRACT, IN TORT OR OTHERWISE UNDER THIS AGREEMENT OR IN RELATION TO THE SERVICE(S).
(b) The limitations in this Section apply notwithstanding that Publisher knows, or has reason to know, of the possibility of any particular kind of damages or that such limitations cause a remedy to fail of its essential purpose.
(a) Both parties agree to comply with all applicable laws in connection with its obligations under this Agreement.
(b) Privacy:
(i) All transfers of Customer Data out of the European Union, European Economic Area, or Switzerland will be governed by the Standard Contractual Clauses as approved by the EU Commission Decision of 4 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council or any further version approved by EU Commission Decision.
(ii) In the event that personal data is processed by Publisher on Customer’s behalf in connection with the Services, then the terms of Exhibit B (Data Processing Addendum) attached to this Agreement will govern such Processing.
(iii) Upon request, Publisher will provide Customer with Publisher’s then current Publisher Privacy Policy.
(a) Each party will, and will cause its employees, directors, and officers (and, in the case of Customer, its Permitted Entities and Authorized Users) to comply with all applicable laws relating to anti-bribery and anti-corruption including, but not limited to, the
(b) U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010 (each an “Anti-Bribery Law”). Each party will not, and will cause its Permitted Entities, employees, directors, and officers to not, accept bribes or kickbacks in any form.
(c) Import/Export.
(i) Each Service is subject to U.S. and international laws, restrictions, and regulations that may govern the import, export, and use of the Service (“Export Laws”). Each party agrees to comply with Export Laws that apply to such party’s use or provision of the Service.
(ii) Customer represents and warrants that neither it nor any Permitted Entity or Authorized User is (A) an entity barred by the applicable Export Laws from participating in export activities (each a “Barred Entity”) or (B) owned or controlled by a Barred Entity. A Barred Entity includes, but is not limited to, an entity located in any country subject to an embargo or other sanctions by the U.S. Government (“Embargoed Country”), which currently includes Cuba, Iran, North Korea, Russia, Syria, and Covered Regions of Ukraine (Crimea, Donetsk and Luhansk), or an entity designated on a “Denied Party List” maintained by the U.S. Government, including, but not limited to the U.S. Treasury Department’s Specially Designated National’s List administered by the Office of Foreign Assets Control and the U.S. Commerce Department’s Entity List administered by the Bureau of Industry and Security.
(iii) Customer will not export, re-export, transfer, or otherwise use the export-controlled products in any Embargoed Country or allow any of its employees and affiliates to access any Service from any Embargoed Country.
(iv) Customer will not export, re-export, or transfer, either directly or indirectly, any Service to a Barred Entity or allow a Barred Entity to access any Service.
(v) Customer will not use any Service for any purpose prohibited by Export Laws, including, but not limited to, the design, development, or production of nuclear, chemical, or biological weapons, or rocket systems, space launch vehicles, sounding rockets, or unmanned air vehicle systems.
(vi) Without limiting Customer’s payment obligations, Customer shall not make any payments to Publisher using a sanctioned financial institution.
(a) The Agreement shall be governed by and construed under the laws of the State of New York without regard for the conflict of law provisions thereof.
(b) Any action arising out of, or related to, this Agreement may be brought only in the New York state courts and the Federal courts located in the Borough of Manhattan, the City of New York.
(c) Any notice required or permitted to be given under this Agreement must be in writing and will be effective (i) upon personal delivery; (ii) if given by courier or mail service, at the time that the notice is delivered (or an attempt is made to deliver the notice, regardless of whether refused) to the receiver’s premises; or (iii) if by e-mail, when sent, provided that sender receives no indication within four hours after sending that the e-mail message failed to reach the receiver. The addresses for notice are those in the preamble to this Agreement. Either party may change its notice address by providing notice to the other party.
(d) Publisher may collect, use, and disclose quantitative data derived from the use of the Service for product development, performance, management, and improvement purposes, provided that any such data is aggregated upon collection and then anonymized, and therefore not identifiable as about Customer, or containing Customer Data or Confidential Information.
(e) Neither party may assign any right or obligation under this Agreement. Notwithstanding the foregoing, either party may assign all, but not less than all, of its rights and obligations under this Agreement (i) to any affiliate of the party or (ii) in connection with a public offering or with the sale, acquisition, or merger of all or substantially all of the party’s business, assets, or equity.
(f) If a provision of the Agreement or portion thereof is unenforceable under applicable law, it shall be omitted from the Agreement without invalidating the remainder of such provision or the Agreement. The waiver of any breach of this Agreement shall not constitute a waiver of any other or subsequent breach.
(g) Neither party will be in breach of this Agreement to the extent that its performance is prevented or delayed by a force majeure event.
(h) The Agreement represents the entire agreement between the parties with respect to the subject matter of this Agreement and expressly supersedes any prior representations, warranties, and/or agreements with respect to the subject matter of this Agreement. This Agreement may be amended, and any right under this Agreement may be waived, only in a writing signed by the parties. No additional or conflicting term in a purchase order or procurement system will have any effect and Publisher may accept and process such forms as an administrative convenience without being deemed to have accepted any additional or different term.
(Incorporated by reference in Section 5 above.)1. Overview
Publisher provides two levels of support for the InfinitySPM Service:
- Basic Support – included with all subscriptions unless otherwise specified.
- Premium Support – available as an optional upgrade subject to additional fees in the applicable Order Form.
Support covers only the InfinitySPM application operating within the OneStream Platform. Platform hosting, uptime, backups, and related infrastructure are the responsibility of
OneStream Software LLC under its own agreements.
2. Definitions
- Help Desk Support – Publisher’s function that receives and manages Customer inquiries or incident reports.
- Subscriber Contact – Customer’s designated individual(s) authorized to communicate with Publisher regarding support matters.
- Severity Levels – classification of incident impact, defined in Section 3.2.
3. Basic Support
3.1 Availability
Help Desk Support is available
Monday–Friday, 9:00 a.m.–8:00 p.m. Eastern Time, excluding U.S. federal holidays.
Requests may be submitted by phone or email through Publisher’s support channel.
3.2 Incident Classification and Response Objectives
| Severity | Description | Initial Acknowledgment | Target Response / Workaround | Resolution Effort |
|---|
| A – Severe | Service substantially non-functional or inoperative | 1 hour | Continuous efforts to restore or work around | Highest priority |
| B – Medium | Material degradation of performance or functionality | 1 hour | Continuous efforts to resolve | High priority |
| C – Minor | Operation differs from Documentation without material impact | 2 business days | Scheduled with maintenance | Next update cycle |
3.3 Maintenance and Updates
Publisher may provide Updates or maintenance releases from time to time. Routine maintenance is scheduled outside business hours, with notice for downtime expected to exceed 30 minutes.
3.4 Customer Responsibilities
Customer shall provide sufficient information and access to reproduce and diagnose reported issues. Support obligations apply only when the Service is used per the Agreement and Documentation.
3.5 Escalation
If a Severity A issue is not progressing within expected timeframes, Customer may escalate to Publisher’s Support Manager or designated executive contact.
4. Premium Support
Customers purchasing
Premium Support receive all Basic Support features plus:
- 24 × 7 Availability – Help Desk access at any time, including weekends and holidays.
- Expedited Response – Priority handling for Severity A and B issues with a 15-minute acknowledgment target and continuous triage until resolution.
- Designated Technical Contact – Access to a named InfinitySPM Support Lead familiar with Customer’s configuration.
- Proactive Monitoring – Early detection and notification of data or process errors within the application where supported.
- Quarterly Health Review – Optional remote session to review configuration health, usage, and optimization recommendations.
- Enhanced Communication – Advance notice of product releases, maintenance windows, and OneStream Platform updates that may impact environments.
Premium Support terms and fees are specified in the applicable Order Form or SOW.
5. Platform Availability
Customer acknowledges that the Service operates on the OneStream Platform. All infrastructure-level operations—including hosting, uptime, performance monitoring, backups, disaster recovery, and security—are provided solely by OneStream Software LLC. Publisher is responsible only for the application-level functionality and support of the InfinitySPM solution within that environment.
6. Exclusions
Support Services do not include:
(i) issues caused by Customer’s systems, integrations, or third-party software;
(ii) issues attributable to the OneStream Platform or infrastructure; or
(iii) customizations or modifications not developed or approved in writing by Publisher.
Exhibit 2 – Data Processing Addendum (DPA)
(This Exhibit is incorporated into and forms part of the InfinitySPM Standard SaaS Agreement between Customer and Publisher.)
- Purpose and Scope
This Data Processing Addendum (“DPA”) forms part of the Agreement between Customer and Publisher. For purposes of this DPA, “Publisher” means the entity identified as Publisher in the Agreement and includes InfinitySPM (“Publisher (InfinitySPM)”).
This DPA governs the Processing of Customer Data by Publisher (InfinitySPM) in connection with Customer’s use of the Service.
Publisher (InfinitySPM) acts as Processor and Customer acts as Controller (or Processor where Customer processes on behalf of its own controller).
This DPA applies solely to Processing within the InfinitySPM application. Hosting, infrastructure security, availability, backup, disaster recovery, and platform-level operations are performed by OneStream under its separate agreement with Customer.
- Definitions
Capitalized terms not defined in this DPA have the meanings set out in the Agreement.
“Applicable Data Protection Law” means all applicable privacy, data protection, and security laws, including the EU GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and similar global laws.
“Personal Data” means any information relating to an identified or identifiable natural person contained within Customer Data.
“Processing” means any operation performed on Personal Data, including collection, storage, access, use, disclosure, or deletion.
“Subprocessor” means any third party engaged by Publisher (InfinitySPM) to Process Personal Data on Customer’s behalf.
“EU SCCs” means the Standard Contractual Clauses adopted by the European Commission on 4 June 2021.
“UK Addendum” means the UK Information Commissioner’s Office Addendum to the EU SCCs.
- Roles and Responsibilities
3.1 Customer Responsibilities
Customer shall:
- determine the purposes and means of Processing;
- ensure it has a lawful basis for Processing Personal Data;
- ensure the accuracy and legality of Customer Data;
- comply with all obligations of a Controller or Processor under Applicable Data Protection Law.
3.2 Publisher Responsibilities
Publisher (InfinitySPM) shall:
- Process Personal Data only on documented instructions from Customer;
- ensure personnel with access to Personal Data are under confidentiality obligations;
- maintain application-level security controls consistent with industry standards;
- not sell or share Personal Data nor retain, use, or disclose Personal Data except as permitted by the Agreement.
- Details of the Processing
Subject matter: Personal Data contained within Customer Data processed by the InfinitySPM application.
Duration: For the term of the Agreement and 30 days thereafter.
Purpose: To provide and support the Service.
Categories of Data Subjects: Employees, contractors, sales personnel, and other individuals whose data is supplied by Customer.
Types of Personal Data: Names, emails, roles, compensation and incentive data, performance data, territory data, and other fields defined by Customer.
- Security Measures
Publisher (InfinitySPM) shall implement technical and organizational measures to protect Personal Data, including:
- role-based access controls, MFA where supported;
- authentication and authorization safeguards;
- encryption of data in transit;
- activity logging;
- secure development practices;
- application-level incident management.
Customer acknowledges that OneStream maintains and controls platform-level security, including encryption at rest, physical security, infrastructure logging, network segmentation, backup, and disaster recovery.
- Subprocessors
6.1 Authorized Subprocessors
Customer authorizes Publisher (InfinitySPM) to use the Subprocessors identified in Annex A.
6.2 Subprocessor Obligations
Publisher (InfinitySPM) shall:
- ensure Subprocessors are bound by written agreements no less protective than this DPA;
- remain responsible for Subprocessors’ performance.
6.3 Subprocessor Changes
Publisher (InfinitySPM) will notify Customer at least 30 days in advance of adding or replacing a Subprocessor.
Customer may object on reasonable data protection grounds. If unresolved, Customer may terminate the affected Service.
- Data Subject Requests
Publisher (InfinitySPM) will assist Customer, to the extent technically feasible, in responding to Data Subject requests relating to Personal Data processed by Publisher.
Publisher will not respond to a Data Subject request directly unless required by law.
- Personal Data Breach Notification
Publisher (InfinitySPM) shall notify Customer without undue delay, and no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Data.
Publisher will provide Customer with sufficient detail to meet its breach reporting obligations.
- International Transfers
Where Personal Data is transferred outside the EEA/UK/Switzerland, Publisher (InfinitySPM) shall:
- rely on the EU SCCs (Module 2: Controller → Processor);
- rely on the UK Addendum for UK personal data transfers;
- implement supplementary measures as required under Applicable Data Protection Law.
Completed SCC details are provided in Annex B.
- Audit and Assistance
Upon Customer request, Publisher (InfinitySPM) shall:
- provide available documentation (including OneStream platform audit reports where permissible);
- provide responses to Customer’s reasonable security and privacy inquiries;
- permit application-level audits, subject to confidentiality and reasonable scheduling.
Infrastructure-level audits must be performed directly with OneStream.
- Return or Deletion of Customer Data
Within 30 days following termination or expiry of the Agreement, Customer may request a copy of Customer Data in an industry-standard electronic format.
After 30 days, Publisher (InfinitySPM) will delete Customer Data from the InfinitySPM application, subject to OneStream’s platform-level retention and backup policies.
- Liability
Liability under this DPA is subject to the limitation of liability in the Agreement, except where prohibited by Applicable Data Protection Law.
- Conflict
In case of conflict between this DPA and the Agreement, this DPA shall prevail with respect to Processing of Personal Data.
InfinitySPM will provide no less than 30 days’ notice of new Subprocessors.
