Common use of Authorized Sub-processors Clause in Contracts

Authorized Sub-processors. Technical measures Organizational measures ☒ Certified, documented security measures of (hosting) service providers ☒ Due care in the selection of ATOSS sub processors ☒ Submission and verification of evidence of control measures and GDPR compliance of (hosting) service providers (e.g. audit reports, certificates) ☒ Conclusion of a data processing agreement ☒ Documentation of instructions ☒ Obligation of ATOSS sub processors to confidentiality and data secrecy ☒ Conclusion of EU standard contractual clauses or other guarantees under Art. 46 GDPR (if required) ☒ Regular audits of sub processors with regard to data protection and information security ☒ Obligation of sub processors that a transfer impact assessment has been carried out regarding the further sub processors in the event of third country transfers and that the result of this assessment is positive / GDPR-compliant. *** DPA - Exhibit III - List of authorized sub processors - ATOSS has the CUSTOMER's general authorization for the engagement of sub processors as listed in this DPA-Exhibit III. ATOSS may select and switch between the sub processors listed in this DPA-Exhibit III and thus are already authorized by the CUSTOMER at any time during the period of processing of personal data at its own discretion. ATOSS reserves the right not to use each of the sub processors listed below for the processing of personal data. Further information on data storage and data processing can be found on our website at xxxxx://xxxxxxxxx.xxxxx.xxx/en-gb/data-residency . Company Registered adress Description of activity Remark ATOSS companies ATOSS Software AG (Germany) Rosenheimer Str. 141h 81671 Munich Germany Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS CSD Software GmbH Xxxxxxxx Xxx. 00 00000 Xxxx Xxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software Ges.m.b.H. Ungargasse 64-66 Stiege 3 Top 503 1030 Vienna Austria Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software AG (Schweiz) Schärenmoosstr. 77 8052 Zürich Switzerland Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) SC ATOSS Software SRL Calea Torontalului 69 Timisoara 300668 Romania Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) Sub processors who provide ancillary services to support the provisioning of professional services Accenture N.V/XX Xxx Xxxxxx/Picardstraat 11 Boîte/Bus 100 1000 Brussel The Netherlands Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) AIKAVA GmbH Xxxxxxxx. 00 00000 Xxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) Company Registered adress Description of activity Remark

Authorized Sub-processors. Technical measures Organizational measures ☒ Certified, documented security measures of (hosting) service providers ☒ Due care in the selection of ATOSS sub processors ☒ Submission and verification of evidence of control measures and GDPR compliance of (hosting) service providers (e.g. audit reports, certificates) ☒ Conclusion of a data processing agreement ☒ Documentation of instructions ☒ Obligation of ATOSS sub processors to confidentiality and data secrecy ☒ Conclusion of EU standard contractual clauses or other guarantees under Art. 46 GDPR (if required) ☒ Regular audits of sub processors with regard to data protection and information security ☒ Obligation of sub processors that a transfer impact assessment has been carried out regarding the further sub processors in the event of third country transfers and that the result of this assessment is positive / GDPR-compliant. *** DPA - Exhibit III - List of authorized sub processors - ATOSS has the CUSTOMER's general authorization for the engagement of sub processors as listed in this DPA-Exhibit III. ATOSS may select and switch between the sub processors listed in this DPA-Exhibit III and thus are already authorized by the CUSTOMER at any time during the period of processing of personal data at its own discretion. ATOSS reserves the right not to use each of the sub processors listed below for the processing of personal data. Further information on data storage and data processing can be found on our website at xxxxx://xxxxxxxxx.xxxxx.xxx/en-gb/data-residency . Company Registered adress Description of activity Remark ATOSS companies ATOSS Software AG (Germany) Rosenheimer Str. 141h 81671 Munich Germany Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS CSD Software GmbH Xxxxxxxx Xxx. 00 00000 Xxxx Xxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software Ges.m.b.H. Ungargasse 64-66 Stiege 3 Top 503 1030 Vienna Austria Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software AG (Schweiz) SchärenmoosstrXxxxxxxxxx. 77 8052 Zürich Switzerland 0 0000 Xxxxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) SC ATOSS Software SRL Calea Torontalului 69 Timisoara 300668 Romania Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) Sub processors who provide ancillary services to support the provisioning of professional services Accenture N.V/XX SA Xxx Xxxxxx/Picardstraat 11 Boîte/Bus 100 1000 Brussel The Netherlands Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) AIKAVA GmbH Xxxxxxxx. 00 00000 Xxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) Company Registered adress Description of activity Remark

Authorized Sub-processors. Technical measures Organizational measures ☒ Certified, documented security measures of (hosting) service providers ☒ Due care in the selection of ATOSS sub processors ☒ Submission and verification of evidence of control measures and GDPR compliance of (hosting) service providers (e.g. audit reports, certificates) ☒ Conclusion of a data processing agreement ☒ Documentation of instructions ☒ Obligation of ATOSS sub processors to confidentiality and data secrecy ☒ Conclusion of EU standard contractual clauses or other guarantees under Art. 46 GDPR (if required) ☒ Regular audits of sub processors with regard to data protection and information security ☒ Obligation of sub processors that a transfer impact assessment has been carried out regarding the further sub processors in the event of third country transfers and that the result of this assessment is positive / GDPR-compliant. *** DPA - Exhibit III - List of authorized sub processors - ATOSS has the CUSTOMER's general authorization for the engagement of sub processors as listed in this DPA-Exhibit III. ATOSS may select and switch between the sub processors listed in this DPA-Exhibit III and thus are already authorized by the CUSTOMER at any time during the period of processing of personal data at its own discretion. ATOSS reserves the right not to use each of the sub processors listed below for the processing of personal data. Further information on data storage and data processing can be found on our website at xxxxx://xxxxxxxxx.xxxxx.xxx/en-gb/data-residency . Company Registered adress Description of activity Remark ATOSS companies ATOSS Software AG (Germany) Rosenheimer Str. 141h 81671 Munich Germany Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS CSD Software GmbH Xxxxxxxx Xxx. 00 00000 Xxxx Xxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software Ges.m.b.H. Ungargasse 64-66 Stiege 3 Top 503 1030 Vienna Austria Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software AG (Schweiz) Schärenmoosstr. 77 8052 Zürich Switzerland Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) SC ATOSS Software SRL Calea Torontalului 69 Timisoara 300668 Romania Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) Sub processors who provide ancillary services to support the provisioning of professional services Accenture N.V/XX Xxx Xxxxxx/Picardstraat 11 Boîte/Bus 100 1000 Brussel The Netherlands Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) AIKAVA GmbH Xxxxxxxx. 00 00000 Xxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) Company Registered adress Description of activity Remark)

Authorized Sub-processors. Technical measures Organizational measures ☒ Certified, documented security measures of (hosting) service providers ☒ Due care in the selection of ATOSS sub processors ☒ Submission and verification of evidence of control measures and GDPR compliance of (hosting) service providers (e.g. audit reports, certificates) ☒ Conclusion of a data processing agreement ☒ Documentation of instructions ☒ Obligation of ATOSS sub processors to confidentiality and data secrecy ☒ Conclusion of EU standard contractual clauses or other guarantees under Art. 46 GDPR (if required) ☒ Regular audits of sub processors with regard to data protection and information security ☒ Obligation of sub processors that a transfer impact assessment has been carried out regarding the further sub processors in the event of third country transfers and that the result of this assessment is positive / GDPR-compliant. *** DPA - Exhibit III - List of authorized sub processors - ATOSS has the CUSTOMER's general authorization for the engagement of sub processors as listed in this DPA-Exhibit III. ATOSS may select and switch between the sub processors listed in this DPA-Exhibit III and thus are already authorized by the CUSTOMER at any time during the period of processing of personal data at its own discretion. ATOSS reserves the right not to use each of the sub processors listed below for the processing of personal data. Further information on data storage and data processing can be found on our website at xxxxx://xxxxxxxxx.xxxxx.xxx/en-gb/data-residency . Company Registered adress Description of activity Remark ATOSS companies ATOSS Software AG (Germany) Rosenheimer Str. 141h 81671 Munich Germany Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS CSD Software GmbH Xxxxxxxx Xxx. 00 00000 Xxxx Xxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software Ges.m.b.H. Ungargasse 64-66 Stiege 3 Top 503 1030 Vienna Austria Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) ATOSS Software AG (Schweiz) SchärenmoosstrXxxxxxxxxx. 77 8052 Zürich Switzerland 0 0000 Xxxxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) SC ATOSS Software SRL Calea Torontalului 69 Timisoara 300668 Romania Parameterization, soft- ware maintenance ser- vices, hotline services ATOSS affiliate (unless contracting party) Sub processors who provide ancillary services to support the provisioning of professional services Accenture N.V/XX SA Xxx Xxxxxx/Picardstraat 11 Boîte/Bus 100 1000 Brussel The Netherlands Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) AIKAVA GmbH Xxxxxxxx. 00 00000 Xxxx Xxxxxxxxxxx Parameterization, soft- ware maintenance ser- vices, hotline services Sub processor (as far as necessary for the provision of such services) Company Registered adress Description of activity Remark)