Privacy Shield

PROGRESS SOFTWARE CORPORATION Notice of Certification Under the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework

Effective as of August 14, 2019

Progress Software Corporation, together with all of its subsidiaries and affiliates, including without limitation Progress Software EAD, Kinvey LLC, DataRPM LLC (“Progress”, “we”, “us”, “our” or the “Company”), complies with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data provided to Progress by its customers and business partners where such data are transferred from the European Union and Switzerland to the United States. Progress has certified to the Department of Commerce that it adheres to the Privacy Shield Principles (the “Principles”). If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.

For purposes of enforcing compliance with the Privacy Shield, Progress is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Privacy Shield, see the US Department of Commerce’s Privacy Shield website located at: https://www.privacyshield.gov. To review Progress’ representation on the Privacy Shield list, see the USDepartment of Commerce’s Privacy Shield self-certification list located at: www.privacyshield.gov/list.

Progress’ participation in the Privacy Shield applies to personal data provided by Progress’ employees, business partners and customers where such personal data is received from the European Union and Switzerland. Progress will comply with the Principles in respect of such personal data. You can find more information about the Principles at https://www.privacyshield.gov/EU-US-Framework.

Progress’ Privacy Policy (the “Privacy Policy”) describes the categories of personal data that we may receive in the US from its business, partners, customers and users of Progress websites, the purposes for which we use such personal data and the rights data subjects have in relation to our collection, use, processing and transfer of their personal data. Progress has also separately provided to its EU citizen employees an Employee Privacy Notice outlining same (the “Employee Privacy Notice”). Progress will only process EU personal data in ways that are compatible with the purpose for which we collected it, or for purposes the individual later authorizes, as articulated in the Privacy Policy and Employee Privacy Notice.

Progress may share personal data with third parties under certain circumstances described in our Privacy Policy. Progress’s obligations under Privacy Shield extend to third parties acting as agents who help us run our business and provide your services, and Progress remains liable should a third party acting as our agent process personal data subject to this policy in a manner inconsistent the with this policy, except where Progress is not responsible for the event giving rise to the damage. We may also disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Data subjects have a right to access, limit use of, and limit disclosure of their personal data. Some of the ways you can do so are listed in the Privacy Policy. If you seek to access, correct, delete, or limit use or disclosure of your personal data, you are also welcome to contact us using the information below. Where Progress receives such a request and processes your information on behalf of an Progress customer, Progress may refer your request to that customer.

Consistent with the Privacy Shield Principles, Progress may transfer personal information to third parties, including transfers from one country to another. We will only disclose an individual’s non-public personal information to third parties either (a) to a third party providing services to Progress, or to the individual, in connection with the operation of our business, and as consistent with the purpose for which the personal information was collected, (b) with the data subject’s permission, (c) where required to meet a legal obligation, or (d) where reasonably necessary for compliance, regulatory or other legal purposes. Progress maintains written contracts with applicable third-parties to ensure that they provide at least the same level of privacy protection and security as required by the Privacy Shield Principles. To the extent provided by the Principles, Progress remains responsible and liable under the Privacy Shield Principles if a third-party that it engages to process personal information on its behalf does so in a manner inconsistent with the Privacy Shield Principles, unless Progress proves that it is not responsible for the matter giving rise to the damage.

Progress commits to cooperate with any applicable EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) and to comply with the advice given by such authorities with regard to human resources data transferred from the EU and Switzerland in the context of the employment relationship.

Progress will respond to any inquiries or complaints within forty-five (45) days.

In compliance with the Privacy Shield Principles, Progress commits to resolve complaints about our collection or use of your personal information. EU and Swiss individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Progress at Privacy@Progress.com. Emails to this address are received and reviewed by Progress’ Data Protection Officer.

Progress has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact or visit https://www.jamsadr.com/eu-us-privacy-shield for more information or to file a complaint. The services of JAMS are provided at no cost to you.

If your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel.

This Notice may be amended consistent with the requirements of the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. When we update this Notice, we will also revise the "Last Updated" date at the top of this document.