Developer Data Protection Addendum

This Developer Data Protection Addendum (“DPA”) is incorporated by reference into, and forms part of, Reddit’s Developer Terms.

1. Scope and Definitions

1.1 Scope

This DPA applies to the extent that you receive, access, or process any Reddit Personal Data (defined below) through Reddit’s Developer Services pursuant to the Developer Terms.

1.2 Definitions

• “Applicable Data Protection Laws” means the privacy and data protection laws, regulations, and decisions applicable to a party to the Developer Terms, including, for example, the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq., European Union Regulation 2016/679 (“EU GDPR”), EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), the Swiss Federal Data Protection Act (“Swiss FDPA”), the Brazilian General Data Protection Law of 2018, Brazil Federal Law 13.709/2018, and Lei Geral de Proteção de Dados (“Brazil GDPR”), in each case, as the laws and regulations may be amended, superseded, or replaced from time to time.
• “Reddit Personal Data” means any personal data or personal information that you receive, access, or process through Reddit’s Developer Services.
• “Reddit GDPR Personal Data” means any Reddit Personal Data that is protected by EU GDPR, UK GDPR, Swiss FDPA, or Brazil GDPR.

Certain terms used in this DPA (e.g., Reddit’s Developer Services) are defined in the Developer Terms. Other terms are not defined in the Developer Terms (e.g., “personal information”, “personal data”, “controller”, “processing”, “processor”, and their respective derivative terms) but have the meanings provided in Applicable Data Protection Laws.

2. Roles and Restrictions

2.1 Roles

As parties to this DPA, both you and Reddit are each an independent controller of Reddit Personal Data under Applicable Data Protection Laws. As a result, both you and Reddit must independently and individually: (a) determine the purposes and means of your processing of Reddit Personal Data; and (b) comply with applicable obligations under Applicable Data Protection Laws.

2.2 Restrictions

You may only use Reddit Personal Data in accordance with the Developer Terms, including all use limitations and restrictions on Reddit Services and Data. Nothing in this DPA modifies or amends any restrictions applicable to your rights or Reddit’s rights to use or otherwise process Reddit Personal Data under the Developer Terms, and you will process Reddit Personal Data solely and exclusively for the purposes specified in the Developer Terms.

3. Reddit Personal Data Protection

In addition to the data protection, privacy, and security measures in the Developer Terms, you agree to:

• implement appropriate technical and organizational security measures to protect Reddit Personal Data against accidental or unlawful destruction, loss, or alteration, and against unauthorized disclosure or access (a “Security Incident”), and ensure a level of security appropriate to the risks presented by the processing of Reddit Personal Data and the nature of such Reddit Personal Data;
• maintain these security measures throughout the duration of your processing of Reddit Personal Data as specified in the Developer Terms. or until you cease to process Reddit Personal Data (whichever is later);
• treat Reddit Personal Data with strict confidence and take all reasonable steps to ensure that any persons you employ or engage at your place(s) of business who will process Reddit Personal Data comply with this DPA and are under a duty of confidentiality with respect to Reddit Personal Data no less restrictive than the duties set forth in this DPA;
• not transfer Reddit Personal Data to third parties except under written contracts that guarantee at least a level of data protection and information security as provided for in this DPA, and you will remain fully liable to Reddit for any third party’s failure to so comply; and
• delete and securely erase all Reddit Personal Data (including any derivatives of it) through automated means (e.g., recalling APIs or using deletion endpoints made available by Reddit) and as otherwise requested by Reddit (or Users with regard to their User Content) within 10 days of the request, and in no event longer than the retention period required by Applicable Data Protection Laws.

4. Notice and Cooperation

You agree to promptly give written notice to and fully cooperate with Reddit regarding:

• the occurrence of any Security Incident that impacts Reddit Personal Data or that is likely to affect any Users or App Users; and
• any complaint, inquiry, or request from an individual, government or regulatory agency, or other third party regarding Reddit Personal Data, unless such notice is prohibited by Applicable Data Protection Laws.

If either happens, you agree not to notify or respond to any individual, government or regulatory agency, or other third party, unless Reddit agrees in writing that you may do so, except where and to the extent required by Applicable Data Protection Laws.

You also agree and acknowledge that if Reddit receives a request from an individual, government or regulatory agency, or other third party, Reddit may share the terms of this DPA, the Developer Terms, our other terms and policies, and any other information you provide us to demonstrate compliance with this DPA or Applicable Data Protection Laws.

5. Reddit Personal Data Transfers

5.1 Non-Reddit GDPR Personal Data Transfers

If you intend to make a cross-border transfer of Reddit Personal Data that is not Reddit GDPR Personal Data and Applicable Data Protection Laws require certain measures to be implemented prior to such transfer, then you agree to implement the measures necessary to comply with Applicable Data Protection Laws.

5.2 Reddit GDPR Personal Data Transfers

If you intend to make a cross-border transfer of Reddit Personal Data that is Reddit GDPR Personal Data by transferring or processing Reddit GDPR Personal Data outside of the European Economic Area (“EEA”), Switzerland, or United Kingdom in a jurisdiction that is not subject to an adequacy determination by the European Commission or the UK or Swiss authorities (as applicable), then the Standard Contractual Clauses (“SCCs”) annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 are automatically incorporated by reference and form an integral part of the Developer Terms through this DPA.

EEA Transfers – To the extent that Reddit GDPR Personal Data is subject to the EU GDPR, the SCCs apply as follows:

• the ‘data exporter’ is Reddit, and the ‘data importer’ is you;
• the Module One terms apply;
• in Clause 7, the optional docking clause applies;
• in Clause 11, the optional language does not apply;
• in Clause 17, Option 1 applies, and the SCCs are governed by Irish law;
• in Clause 18(b), disputes will be resolved before the courts of Ireland;
• in Annex I.A, the details of the parties are set out in the Developer Terms;
• in Annex I.B:
  • Users of our Services are the categories of data subjects whose personal data is transferred;
  • personal data included in Reddit Data and Services (e.g., personal data within User Content) provided to you in accordance with the Developer Terms are the categories of personal data transferred;
  • to the extent that any sensitive data may be transferred, this will be sensitive data that the relevant data subject has chosen to make publicly available;
  • the frequency of the transfer is continuous during the term of the Developer Terms;
  • making Reddit Data and Services available to you in accordance with the Developer Terms (including all use limitations and restrictions) is the nature of the processing;
  • the purpose of the data transfer and further processing is limited to you processing Reddit Personal Data for permitted uses under the Developer Terms; and
  • Reddit Personal Data may be retained for as long as necessary for you to achieve the permitted uses under the Developer Terms and in accordance with Applicable Data Protection Laws is the period for which personal data will be retained;

  Swiss Transfers – To the extent the Reddit GDPR Personal Data is subject to the Swiss FDPA, the SCCs above for EEA transfers apply with the following modifications:

  • references to ‘Regulation (EU) 2016/679’ are interpreted as references to the Swiss FDPA;
  • references to specific articles of ‘Regulation (EU) 2016/679’ are replaced with the equivalent article or section of the Swiss FDPA;
  • references to ‘EU’, ‘Union’ and ‘Member State’ are replaced with ‘Switzerland’;
  • Clause 13(a) and Part C of Annex 2 is not used, and the ‘competent supervisory authority’ is the Swiss Federal Data Protection Information Commissioner (“Swiss FDPIC”) or, if the transfer is subject to both the Swiss FDPA and the EU GDPR, the Swiss FDPIC (insofar as the transfer is governed by the Swiss FDPA) or the Irish DPC (insofar as the transfer is governed by the EU GDPR);
  • references to the ‘competent supervisory authority’ and ‘competent courts’ are replaced with the ‘Swiss FDPIC’ and ‘applicable courts of Switzerland’;
  • in Clause 17, the SCCs are governed by the laws of Switzerland;
  • in Clause 18(b), disputes will be resolved before the competent Swiss courts; and
  • the SCCs also protect the data of legal entities.

  UK Transfers – To the extent the Reddit GDPR Personal Data is subject to the UK GDPR, the SCCs apply as amended by Part 2 of the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 (“UK Addendum”), and Part 1 of the UK Addendum is deemed completed as follows:

  • in Table 1, the details of the parties are set out in the Developer Terms;
  • in Table 2, the selected modules and clauses are set out in EEA Transfers above;
  • in Table 3, the appendix information is set out in the Developer Terms; and
  • in Table 4, the ‘Exporter’ is elected.

  Alternative Transfer Mechanism – If Reddit adopts an alternative data transfer mechanism to the mechanisms described in this DPA, including any new version of or successor to the SCCs or the Privacy Shield (“Alternative Transfer Mechanism”), then such Alternative Transfer Mechanism will apply automatically instead of the mechanisms described in this DPA, and you will fully cooperate with Reddit to accept or sign an amendment to this DPA or take such other action as may be necessary to give legal effect to such Alternative Transfer Mechanism.

  Further, to the extent that you and/or Reddit have adopted and certified compliance with such Alternative Transfer Mechanism, you represent and warrant that you will comply with all legal principles and terms of such Alternative Transfer Mechanism.

  In addition, in the event that a court of competent jurisdiction or supervisory authority orders (for whatever reason) that the measures described in this DPA cannot be relied on to lawfully transfer Reddit Personal Data cross-border, then you shall fully cooperate with Reddit to take such action as may be necessary to remedy such non-compliance.
  

  6. Miscellaneous

  6.1 Order of Control

  In the event of a conflict between the terms of this DPA, the SCCs, and the Developer Terms, the terms will apply in the following order of precedence: SCCs, this DPA, and the Developer Terms. Except as modified by this DPA, all terms and conditions of the Developer Terms between you and Reddit will remain in full force and effect.

  6.2 Survival

  The obligations under this DPA survive so long as you process Reddit Personal Data, irrespective of whether the Developer Terms have terminated or expired.