Software and Service Specific Requirements for Fivetran Products

Effective 6/1/26

These Software and Service Specific Requirements for Fivetran Products (these "Requirements") apply to clients that have purchased or been granted access to Fivetran Products (as defined below) under an Order Form (“Client” or “Customer”). These Requirements supplement the terms of (a) the dbt Labs Terms of Service or other agreement for Client’s use of the dbt Labs Services (the "Terms") entered into between dbt Labs, LLC, as successor to dbt Labs, Inc. ("dbt Labs") and Client; and (b) the dbt Labs Data Processing Addendum or similar agreement for dbt Labs’ processing of Personal Data on behalf of Client in connection with Client’s use of dbt Labs Services and Fivetran Products (the "DPA", and together with the Terms, the "Agreement") entered into between dbt Labs and Client. Capitalized terms used but not defined herein will have the meanings given to them in the Agreement (or, if not defined in the Agreement, in the dbt Labs Terms of Service located at https://www.getdbt.com/terms-of-service or the dbt Labs Data Processing Addendum located at https://www.getdbt.com/cloud/dpa, or such successor URLs as may be designated by dbt Labs).

1. DEFINITIONS

Notwithstanding anything to the contrary in the Agreement, for purposes of Client’s use of the Fivetran Products, the following definitions apply:

• "Customer Data" or “Data” means any data that Client or its Authorized Users upload to or transmit through a Fivetran Product.
• "Documentation" means Fivetran’s usage documentation for the applicable Fivetran Product made available on Fivetran’s website.
• "Fivetran" means Fivetran Inc., a Delaware corporation.
• "Fivetran Product" means (a) a SaaS-based data integration product ("SaaS Product"), (b) a downloadable data integration software component or product installed on premise or in Client’s private cloud environment ("On-Prem Software"), or (c) any combination or hybrid thereof, in each case provided by Fivetran.
• “Personal Data” means the personal data described in Annex I as attached to these Requirements.
• “Software and Service Specific Requirements” means the requirements for certain of the Fivetran Products and Professional Services located at https://www.fivetran.com/legal/service-specific-requirements, solely to the extent Client uses such Fivetran Products or Professional Services.
• "Source and Target Systems" means with respect to On-Prem Software, the permitted type and number of computer hardware systems, storage platforms and computer frameworks from which Client may use such On-Prem Software, as identified in the applicable Order Form.
• “System Data” means data, information or outputs derived by dbt Labs from the use of a Fivetran Product, including logs, statistics, or reports regarding the performance, availability, usage, integrity or security of the Fivetran Product (e.g., a user’s path through the Fivetran Product, login frequency, query logs, etc.). For the avoidance of doubt, System Data does not include Customer Data and does not relieve dbt Labs from otherwise complying with its confidentiality obligations under the Agreement with respect to Customer Data.
• “Third Party Platform” means any product, add-on or platform not provided by dbt Labs that Client uses with the Fivetran Product.

2. PROVISION OF FIVETRAN PRODUCTS

2.1 Scope. Except as modified herein, the Agreement governs Client’s use of the Fivetran Products and every reference to the Services therein will be deemed to also refer to the Fivetran Products so that the rights and obligations therein continue to apply. Fivetran, the parent company of dbt Labs, may provide the Fivetran Products, or a portion thereof, to Client in accordance with the Agreement, these Requirements and any applicable Order Form. dbt Labs will (a) be responsible for the portions of the Fivetran Products provided by Fivetran; and (b) not be relieved of its obligations under the Agreement, these Requirements or the applicable Order Form if Fivetran provides the Fivetran Products or a portion thereof. Notwithstanding anything in the Agreement or these Requirements to the contrary, Customer may execute one or more Order Forms directly with Fivetran for the Fivetran Products and (a) each such Order Form shall be governed by the terms and conditions of the Agreement, as modified and supplemented by these Requirements; and (b) dbt Labs shall be an express third party beneficiary of such Order Form, with the right to enforce the terms thereof as if dbt Labs were a party thereto.

2.2 On-Prem Software License. With respect to any Order Form that includes On-Prem Software, subject to the terms of the Agreement and these Requirements, dbt Labs grants to Client a limited, non-exclusive, non-transferable (except as part of a permitted assignment of the Agreement under Section 13.2 (Assignment) of the Terms), non-sublicensable, royalty-free, worldwide license during the subscription term of such Order Form to install, integrate and use for its own internal business purposes such On-Prem Software on the Source and Target Systems.

3. PRIVACY AND SECURITY

3.1 Security. Notwithstanding anything to the contrary in the Agreement, any security provisions and any security exhibits in the Agreement related to the dbt Labs Services will not apply to the Fivetran Products. Instead, dbt Labs will procure that Fivetran maintains administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Customer Data submitted to the Fivetran Products in accordance with the Fivetran security policy located at https://fivetran.com/docs/security (the "Fivetran Security Policy") posted as of the Effective Date (as the Fivetran Security Policy may be updated by Fivetran in a manner that does not materially decrease the applicable protections for the Fivetran Products during the term of the applicable Order Form).

3.2 Privacy. For purposes of these Requirements, notwithstanding anything to the contrary in the Agreement and solely with respect to the Processing of Personal Data in connection with the Fivetran Products, the DPA is modified as follows:

(a) dbt Labs will process Personal Data for the following purposes: (i) as described in Schedule 1 of these Requirements, which hereby replaces Schedule 1 of the DPA (Details of the Processing and Transfer of Subscriber Personal Data); (ii) in accordance with the documented reasonable instructions of Client (which instructions, where Client is a processor, will reflect the instructions of its controller) that are consistent with the terms of the Agreement, these Requirements, applicable Order Forms, and Data Protection Laws; and (iii) to comply with dbt Labs’ legal obligations.

(b) Schedule 2 of the DPA (Technical and Organisational Security Measures) is modified as set forth in Schedule 2 of these Requirements;

(c) Schedule 3 of the DPA (Authorised Subprocessors) is modified as set forth in Schedule 3 of these Requirements.

(d) “Security Incident” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access to Personal Data that is in violation of dbt Labs’ security obligations under the Terms by dbt Labs or its agents of which dbt Labs becomes aware. Security Incident will not include an unsuccessful security incident, which is one that results in no unauthorized access to Personal Data or to any dbt Labs equipment or facilities storing the Personal Data, and could include (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents

(e) Transfer Mechanisms. To the extent Client’s use of Fivetran Products requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction to dbt Labs located outside of that jurisdiction (“Transfer Mechanism”), the transfer of Personal Data will be subject to a single Transfer Mechanism, as applicable, and in accordance with the following order of precedence: (i) the EU-US Data Privacy Framework (“DPF”), the UK extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework self-certification program operated by the US Department of Commerce as applicable; (ii) Standard Contractual Clauses as set forth in the DPA; and, if neither (i) nor (ii) is applicable, then (iii) such other applicable Transfer Mechanisms permitted under Data Protection Laws.

(f) dbt Labs shall ensure that any contract with its subprocessors including terms at least as protective as the ones contained in the Agreement.

(g) Where required by the U.S. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Client agrees not to upload to any SaaS Product any personal health information ("PHI Data") unless a Business Associate Agreement ("BAA") has been duly executed. Unless a BAA is in place, neither dbt Labs nor Fivetran will have liability under the Agreement for PHI Data, notwithstanding anything in the Agreement, or pursuant to HIPAA or any other applicable law.

(h) Notwithstanding anything to the contrary in this Agreement, dbt Labs may collect System Data and use such data internally to develop, improve, support, and operate Fivetran Products. dbt Labs’ use of System Data will comply with Data Protection Laws. dbt Labs owns all right, title, and interest in System Data. dbt Labs may not share any System Data that includes Personal Data with a third party except to the extent the System Data is aggregated and anonymized such that Client and Client’s users cannot be identified.

4. SUPPORT POLICY AND SLA

Notwithstanding anything to the contrary in the Agreement, technical support for the Fivetran Products will not be subject to dbt Labs’ support. Instead, technical support for the Fivetran Products are governed by the Fivetran Support Policy located at https://www.fivetran.com/legal/support-policy. In addition, use of the Fivetran Products is not subject to any service level agreement or SLA in the Agreement, and such use will instead be governed by the Fivetran SLA at https://www.fivetran.com/legal/sla.

5. SERVICE CONSUMPTION TABLE

Notwithstanding anything to the contrary in the Agreement or an Order Form, any provisions related to Fees, including as it related to Units, in the Agreement or an existing Order Form will not apply to the Fivetran Products. Instead, the Fivetran Service Consumption Table located at https://www.fivetran.com/legal/service-consumption-table (the "Service Consumption Table") will apply to the Fivetran Products unless otherwise set forth in the applicable Order Form. If Client’s use of a Fivetran Product exceeds the usage or capacity set forth on the applicable Order Form, or otherwise requires the payment of additional Fees (per the terms of the Agreement, these Requirements, or the Order Form), dbt Labs will invoice Client in arrears for such additional usage or capacity and Client agrees to pay the additional Fees in the manner provided herein. Billing communications will be addressed to ar@fivetran.com.

6. RESTRICTIONS AND REQUIREMENTS

Client will use the Fivetran Products in accordance with the Fivetran Acceptable Use Policy located at https://www.fivetran.com/legal/acceptable-use-policy and the Software and Service Specific Requirements.

7. TRADE LAWS

Client agrees to comply with, and shall not permit Authorized Users or any third parties to access or use the Fivetran Products in violation of international export controls and economic and trade sanctions laws and regulations (collectively, “Trade Laws”). Without limiting the foregoing, Client represents that it (a) will not access the Services from a country or territory that is itself the subject or target of trade or economic sanctions (a “Sanctioned Country”).

8. PRE-COMMERCIAL OFFERINGS

Any Fivetran Product or feature offered on a trial basis will be deemed a "Beta Feature" for all purposes of Section 13.10 (Beta Features Terms) of the Terms.

9. LIMITATION OF LIABILITY AND INDEMNIFICATION

NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THE AGREEMENT, THE AGGREGATE, CUMULATIVE LIABILITY OF DBT LABS (INCLUDING ITS AFFILIATES AND THEIR DIRECTORS, OFFICERS, EMPLOYEES, REPRESENTATIVES, AGENTS AND SUPPLIERS) FOR OBLIGATIONS AND CLAIMS RELATED TO CUSTOMER DATA, WILL NOT EXCEED TWO TIMES (2X) THE AMOUNTS PAID OR PAYABLE BY CLIENT UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO THE CLAIM (“SPECIAL CAP”).

NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THE AGREEMENT, CLIENT WILL INDEMNIFY AND DEFEND DBT LABS AND ITS AFFILIATES AND THEIR RESPECTIVE OFFICERS, DIRECTORS AND EMPLOYEES (COLLECTIVELY, “DBT LABS INDEMNIFIED PARTIES”) FROM AND AGAINST ANY DAMAGES AND COSTS FINALLY AWARDED AGAINST THE DBT LABS INDEMNIFIED PARTIES OR AGREED TO IN SETTLEMENT BY CLIENT (INCLUDING REASONABLE ATTORNEYS’ FEES) IN CONNECTION WITH ANY CLAIMS ARISING FROM OR RELATED TO CUSTOMER DATA OR THEIR USE WITH THE FIVETRAN PRODUCTS, AS APPLICABLE, PROVIDED DBT LABS’ USE OF THE CUSTOMER DATA IS IN ACCORDANCE WITH THE AGREEMENT. SUCH INDEMNITY IS NOT SUBJECT TO THE LIMITATION OF LIABILITY SET FORTH IN THE AGREEMENT.

10. EFFECTIVE DATE AND UPDATES TO THESE REQUIREMENTS

These Requirements take effect immediately upon Client’s use of the Fivetran Products. dbt Labs may update these Requirements from time to time. Any updates will become effective for Client upon renewal or entry into a new Order Form enabling the Fivetran Products after any updates go into effect.

11. MISCELLANEOUS

Except as otherwise set forth in these Requirements, the terms of the Agreement, including, without limitation, any disclaimers, limitations of liability and governing law provisions set forth therein, will apply to Client’s use of the Fivetran Products.

Schedule 1 to the DPA

Annex I to the DPA — Data Processing Description (applicable to Fivetran Products only)

This Annex I forms part of the DPA and describes the processing that the processor will perform on behalf of the controller.

A. LIST OF PARTIES

Controller(s) / Data exporter(s):

[Identity and contact details of the controller(s) / data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

Processor(s) / Data importer(s):

[Identity and contact details of the processor(s) / data importer(s), including any contact person with responsibility for data protection]

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Schedule 2 to the DPA

Annex II to the DPA — Technical and Organisational Security Measures (applicable to Fivetran Products only)

Description of the technical and organisational measures implemented by the processor(s) / data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

For transfers to (sub-) processors, the specific technical and organisational measures to be taken by the (sub-) processor:

Contractual language

Fivetran ensures that its sub-processors are subject to substantially similar terms that provide equivalent data protection.

Due Diligence

Fivetran conducts due diligence on third parties, including necessary privacy and security reviews, such as privacy threshold and privacy impact assessments. Fivetran will:

• Take reasonable steps and conduct due diligence to select and retain sub-processors capable of maintaining the privacy, confidentiality, security, integrity and availability of Personal Data consistent with Fivetran’s contractual and other legal obligations;

• Contractually require sub-processors to maintain adequate safeguards for Personal Data sufficient to allow Fivetran to meet its contractual and legal requirements; and

• Assess and monitor sub-processors to confirm their compliance with the applicable privacy and information security requirements.

Schedule 3 to the DPA

Annex III to the DPA — List of Subprocessors (applicable to Fivetran Products only)

The current list of sub-processors authorised to process Personal Data in connection with the Fivetran Products is maintained at https://fivetran.com/docs/security-and-privacy/privacy#subprocessormanagement (or such successor URL as may be designated by Fivetran). Fivetran provides notice for any additions to such list. Client may request a preferred email contact to receive notifications of changes by sending the contact to privacy@fivetran.com.

Client agrees that Client’s configuration of access to a Fivetran Product (including selection of region or hosting environment) constitutes Client’s consent to Fivetran’s and dbt Labs’ use of the corresponding sub-processors for the Fivetran Products. This paragraph does not apply to changes made solely at the request of Fivetran or dbt Labs in the absence of Client’s instructions, direction or request.