DORA Addendum
GREENHOUSE SOFTWARE, INC.
Last Updated: February 1, 2026
This DORA Addendum (“DORA Addendum”) supplements the MSA, available at MSA, and is hereby incorporated by reference into the Agreement between Greenhouse and Customer in the event Customer is subject to DORA.
The Parties agree as follows:
1. DEFINITIONS AND INTERPRETATION
(a) “DORA” means the Digital Operational Resilience Regulation 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011.
(b) “ICT-related Incident” means a single event or a series of linked events unplanned by Customer that compromises the security of the network and information systems, and has an adverse impact on the availability, authenticity, integrity, or confidentiality of data, or on the services provided by Customer.
(c) Capitalised terms not defined herein will have the meanings set out in the Agreement or under DORA.
(d) Except as modified in this Addendum, the terms of the Agreement shall apply with full force and effect. To the extent applicable, this Addendum prevails over any conflicting term of the Agreement, but does not otherwise modify the Agreement.
2. SCOPE OF SERVICES AND SERVICE LEVEL DESCRIPTIONS
(a) Greenhouse will deliver the services outlined in the Agreement (the “Services”) and in accordance with the service levels specified in the Agreement. Any service level issues will be addressed in accordance with the Agreement.
(b) The Parties record their mutual understanding that the Services are not used by Customer to support critical or important functions as defined under DORA. Customer will notify Greenhouse of any material changes to its intended use of the Services.
3. SUBCONTRACTING
(a) The Parties agree that Greenhouse may subcontract the Services to a third party subject to the following conditions:
(i) Greenhouse will maintain oversight and control of its subcontractors and carry out reasonable due diligence and monitoring over the subcontractor’s performance of the Services. Greenhouse will remain responsible for the performance of the Services towards Customer in accordance with the terms and liability provisions of the Agreement;
(ii) Greenhouse will, upon request, provide information to Customer about the monitoring and reporting obligations of its subcontractors. Such information may be redacted to protect any commercially sensitive data, and limited to what is strictly necessary to address Customer’s request. Customer will treat such information as confidential and use it solely for the purpose for which it was provided; and
(iii) If Customer demonstrates that a subcontractor's failure to perform their obligations threatens the performance of the Services, Customer may require Greenhouse to replace the subcontractor, subject to reasonable notice.
4. SERVICE LOCATIONS
The Services will be provided, and data will be processed, in the following regions: EMEA, APAC, and the Americas. Any changes to these locations will be communicated to Customer in advance. Configuration of locations by Customer will be considered notified to Customer. Continued use of the Services after a notification by Greenhouse will constitute Customer’s acceptance of the changes.
5. DATA SECURITY AND DATA PROTECTION OBLIGATIONS
Greenhouse will take appropriate steps to maintain the availability, authenticity, integrity, and confidentiality of data processed under the Agreement. Notwithstanding the terms of this Addendum, Personal Data will be processed in accordance with any Data Processing Addendum entered into between the Parties (“DPA”).
6. DATA ACCESS AND CONTINUITY
(a) Customer acknowledges that they have full access to the data that Greenhouse processes on their behalf. In the event of insolvency, resolution, or discontinuation of the business operations of Greenhouse, or in the event of the termination of the Agreement, Greenhouse will take appropriate steps to ensure access to, recovery of, and return of all Personal and non-Personal Data processed for Customer, subject to Greenhouse’s standard thirty (30) day backup retention policy.
(b) If Customer requests the return of data, Greenhouse will make the data available to Customer for retrieval by Customer for ninety (90) days from the date of the termination or expiration of the Agreement. Notwithstanding the terms of this Addendum, Personal Data will be processed, returned, or deleted upon termination in accordance with the terms of the Agreement and the DPA.
7. INCIDENT ASSISTANCE
In the event of an ICT-related Incident affecting the Services provided to Customer, Greenhouse will make commercially reasonable efforts to assist Customer in resolving the issue. Greenhouse reserves the right to charge Customer reasonable fees for such assistance.
8. COOPERATION WITH AUTHORITIES
(a) Greenhouse will reasonably cooperate with the competent financial supervisory authorities and resolution authorities of Customer, as required by applicable law and, only to the extent directly related to the Services and as necessary to address issues relating to Customer’s compliance with its obligations under DORA. Such cooperation will not place an undue burden on Greenhouse or require the disclosure of proprietary or confidential information of Greenhouse.
(b) Greenhouse reserves the right to charge Customer reasonable fees for such assistance.
9. ICT SECURITY AWARENESS TRAINING
(a) At Customer’s request, and to the extent reasonably necessary, Greenhouse may, at its own discretion, make relevant personnel available to participate in Customer’s ICT security awareness and digital operational resilience training. Such participation will be limited to once per calendar year, shall not be unduly burdensome, and must be scheduled with thirty (30) business days’ notice to avoid any disruption to Greenhouse’s business operations.
(b) Participation is subject to the following conditions: (i) training must be directly relevant to the Services, (ii) all costs will be borne by Customer, (iii) participation will not involve the disclosure of proprietary or confidential information of Greenhouse, and (iv) participation will not create any obligations beyond those already set out in the Agreement.
10. TERMINATION
(a) Customer may terminate the Services in the following circumstances:
(i) If Greenhouse is in significant breach of applicable laws, regulations, or its material commitments under this Addendum and fails to correct the breach within thirty (30) business days;
(ii) If circumstances are identified that materially affect Greenhouse’s ability to perform its commitments under this Addendum, including material changes that prevent Greenhouse from executing the Agreement;
(iii) If demonstrated material weaknesses are identified in Greenhouse’s compliance with its security obligations; or
(iv) If such termination is required pursuant to the express instructions from the Customer’s competent financial supervisory authority.
(b) Customer will notify Greenhouse immediately of any concerns that could lead to termination in accordance with Section 10(a). Greenhouse will be granted a reasonable period of at least thirty (30) business days to address and respond to these concerns before Customer may exercise its right to terminate the Agreement.
(c) The minimum notice period for termination will be ninety (90) business days unless otherwise specified by regulatory requirements or in the Agreement.
(d) In the event of termination for any reason, Customer will remain liable for and will promptly pay any outstanding fees due to Greenhouse for Services rendered prior to the effective date of termination. Greenhouse will issue a final invoice for such fees, which shall be payable in accordance with the terms specified in the Agreement.
(e) Upon termination, neither Party shall be liable for indirect, consequential, incidental, or punitive damages, including loss of profits or goodwill, in accordance with the terms set out in the Agreement.
11. GOVERNING LAW
(a) This Addendum and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) will be governed by and construed in accordance with the laws as agreed to in the Agreement.
(b) The Parties irrevocably agree that the courts as agreed to in the Agreement will have exclusive jurisdiction to settle any dispute or claim that arises out of, or in connection with, this Addendum.
