Common use of ADDITIONAL TERMS FOR EU PERSONAL DATA Clause in Contracts

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the 9.2 This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMee’s Affiliates may be retained as Subprocessors; and (b) ZeeMee and ZeeMee’s Affiliates respectively may engage third-party Subprocessors in connection with the provision of the Services. Data Importer shall make available to College a current list of Subprocessors for the respective Services with the identities of those Subprocessors in accordance with Section 5.5 of this DPA, further detailing ZeeMee’s provision of the Subprocessor List. 9.4 The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMee) information regarding ZeeMee Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee makes them generally available to its customers. College may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-compliance discovered during the course of an audit. 9.6 The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3, the Standard Contractual Clauses shall prevail. If this document has been

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 Attachment 1 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee CA in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in thethe Agreement) of Customer established within the European Economic Area (EEA) and Switzerland that have purchased Services on the basis of an order under the Agreement. For the purpose of the Standard Contractual Clauses and this Section 9, the Customer and its Affiliates shall be deemed to be “Data Exporters”. 9.2 This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College Customer (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMeeCA’s Affiliates may be retained as Subprocessors; and (b) ZeeMee CA and ZeeMeeCA’s Affiliates respectively may engage third-party Subprocessors in connection with the provision of the Services. Data Importer shall make available to College Customer a current list of Subprocessors for the respective Services with the identities of those Subprocessors in accordance with Section 5.5 of this DPA, further detailing ZeeMeeCA’s provision of the Subprocessor List. 9.4 The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMeeCA) information regarding ZeeMee CA Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee CA makes them generally available to its customers. College Customer may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College Customer shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee CA Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-non- compliance discovered during the course of an audit. 9.6 The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3Attachment 1, the Standard Contractual Clauses shall prevail. If this document has beenbeen electronically signed by either party such signature will have the same legal affect as a hand written signature.

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 Attachment 1 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee ASCI in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in thethe Agreement) of Cus- tomer established within the European Economic Area (EEA) and Switzerland that have purchased Services on the basis of an order under the Agreement. For the purpose of the Standard Contractual Clauses and this Section 9, the Customer and its Affiliates shall be deemed to be “Data Exporters”. 9.2 This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer Im- xxxxxx for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions instruc- tions provided by College Customer (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMee’s Affiliates may be retained as Subprocessors; and (b) ZeeMee and ZeeMee’s Affiliates respectively ASCI may engage third-party Subprocessors in connection with the provision of the Services. Data Importer shall make available to College Customer a current list of Subprocessors for the respective Services with the identities of those Subprocessors in accordance with Section 5.5 of this DPA, further detailing ZeeMeeASCI’s provision of the Subprocessor List. 9.4 The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j5( j) of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the AgreementAgree- ment, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMeeASCI) information regarding ZeeMee GroupASCI’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee ASCI makes them generally available to its customers. College Customer may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College Customer shall reimburse re- imburse Data Importer for any time expended for any such on-site audit at the ZeeMee GroupASCI’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-compliance noncompliance discovered during the course of an audit. 9.6 The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3Attachment 1, the Standard Contractual Clauses shall prevail. If this document has beenbeen electronically signed by either party such signature will have the same legal affect as a hand-written signature.

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the 9.2 This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMee’s Affiliates may be retained as Subprocessors; and (b) ZeeMee and ZeeMee’s Affiliates respectively may engage third-party Subprocessors in connection with the provision of the Services. Data Importer shall make available to College a current list of Subprocessors for the respective Services with the identities of those Subprocessors in accordance with Section 5.5 of this DPA, further detailing ZeeMee’s provision of the Subprocessor List. 9.4 The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMee) information regarding ZeeMee Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee makes them generally available to its customers. College may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-compliance discovered during the course of an audit. 9.6 The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3, the Standard Contractual Clauses shall prevail. If this document has been

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 . The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the 9.2 the Agreement) of Customer established within the European Economic Area (EEA) and Switzerland that have purchased Services on the basis of an order under the Agreement. For the purpose of the Standard Contractual Clauses and this Section 9, the Customer and its Affiliates shall be deemed to be “Data Exporters”. This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College Customer (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 . Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMeeKaduu AG’s Affiliates may be retained as SubprocessorsSub processors; and (b) ZeeMee Kaduu AG and ZeeMeeKaduu AG’s Affiliates respectively may engage third-party Subprocessors Sub processors in connection with the provision of the Services. Data Importer shall make available to College Customer a current list of Subprocessors Sub processors for the respective Services with the identities of those Subprocessors Sub processors in accordance with Section 5.5 5 of this DPA, further detailing ZeeMee’s provision of the Subprocessor List. 9.4 . The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) 5 of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 . The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMeeKaduu AG) information regarding ZeeMee Kaduu AG Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee Kaduu AG makes them generally available to its customers. College Customer may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College Customer shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee Kaduu AG Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account considering the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-compliance noncompliance discovered during the course of an audit. 9.6 . The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3, the Standard Contractual Clauses shall prevail. If this document has been

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 Attachment 1 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee CA in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in thethe Agreement) of Customer established within the European Economic Area (EEA) and Switzerland that have purchased Services on the basis of an order under the Agreement. For the purpose of the Standard Contractual Clauses and this Section 9, the Customer and its Affiliates shall be deemed to be “Data Exporters”. 9.2 This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College Customer (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMeeCA’s Affiliates may be retained as Subprocessors; and (b) ZeeMee CA and ZeeMeeCA’s Affiliates respectively may engage third-party Subprocessors in connection with the provision of the Services. Data Importer shall make available to College Customer a current list of Subprocessors for the respective Services with the identities of those Subprocessors in accordance with Section 5.5 of this DPA, further detailing ZeeMeeCA’s provision of the Subprocessor List. 9.4 The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter., 9.5 The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMeeCA) information regarding ZeeMee CA Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee CA makes them generally available to its customers. College Customer may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College Customer shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee CA Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-non- compliance discovered during the course of an audit. 9.6 The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request.be 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3Attachment 1, the Standard Contractual Clauses shall prevail. If this document has beenbeen electronically signed by either party such signature will have the same legal affect as a hand written signature.

ADDITIONAL TERMS FOR EU PERSONAL DATA. 9.1 The Standard Contractual Clauses in Annex 3 and the additional terms in this Section 9 will apply to the Processing of Personal Data by ZeeMee in the course of providing the Services. 9.1.1 The Standard Contractual Clauses apply only to Personal Data that is transferred from the European Economic Area (EEA) or Switzerland to outside the EEA or Switzerland, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data (as described pursuant to applicable Data Protection Law, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors. 9.1.2 . The Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the 9.2 the Agreement) of Customer established within the European Economic Area (EEA) and Switzerland that have purchased Services on the basis of an order under the Agreement. For the purpose of the Standard Contractual Clauses and this Section 9, the Customer and its Affiliates shall be deemed to be “Data Exporters”. This DPA and the Agreement are Data Exporter’s complete and final instructions to Data Importer for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For the purposes of Clause 5(a) of the Standard Contractual Clauses, the following is deemed an instruction by the Data Exporter to Process Personal Data: (a) in accordance with the Agreement and applicable orders thereunder; and (b) in compliance with other reasonable instructions provided by College Customer (e.g., via a support ticket) where such instructions are consistent with the terms of the Agreement. 9.3 . Pursuant to Clause 5(h) of the Standard Contractual Clauses, the Data Exporter acknowledges and expressly agrees that ZeeMeeLucy Security AG’s Affiliates may be retained as SubprocessorsSub processors; and (b) ZeeMee Lucy Security AG and ZeeMeeLucy Security AG’s Affiliates respectively may engage third-party Subprocessors Sub processors in connection with the provision of the Services. Data Importer shall make available to College Customer a current list of Subprocessors Sub processors for the respective Services with the identities of those Subprocessors Sub processors in accordance with Section 5.5 5 of this DPA, further detailing ZeeMee’s provision of the Subprocessor List. 9.4 . The parties agree that the copies of the Sub-processor agreements that must be sent by the Data Importer to the Data Exporter pursuant to Clause 5(j) 5 of the Standard Contractual Clauses may have all commercial information, or provisions unrelated to the Standard Contractual Clauses or their equivalent, removed by the Data Importer beforehand; and that such copies will be provided by Data Importer only upon reasonable request by Data Exporter. 9.5 . The parties agree that the audits described in Clause 5(f), Clause 11 and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Data Exporter’s request, and subject to the confidentiality obligations set forth in the Agreement, Data Importer shall, within a reasonable period following such request, make available to Data Exporter (or Data Exporter’s independent, third-party auditor that is not a competitor of ZeeMeeLucy Security AG) information regarding ZeeMee Lucy Security AG Group’s compliance with the obligations set out in this DPA in the form of the third- party certifications and audits it carries out as described in the Agreement and/or the Security Practices Document to the extent ZeeMee Lucy Security AG makes them generally available to its customers. College Customer may contact Data Importer in accordance with the “Notices” Section of the Agreement to request an on-site audit of the procedures relevant to the protection of Personal Data. College Customer shall reimburse Data Importer for any time expended for any such on-site audit at the ZeeMee Lucy Security AG Group’s then-current professional services rates, which shall be made available to Data Exporter upon request. Before the commencement of any such on-site audit, Data Exporter and Data Importer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Data Exporter shall be responsible. All reimbursement rates shall be reasonable, taking into account considering the resources expended by Data Importer. Data Exporter shall promptly notify Data Importer with information regarding any non-compliance noncompliance discovered during the course of an audit. 9.6 . The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) shall be provided by the Data Importer to the Data Exporter only upon Data Exporter’s request. 9.7 In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Annex 3, the Standard Contractual Clauses shall prevail. If this document has been