Common use of Changes to Sub-processors Clause in Contracts

Changes to Sub-processors. Customer may reasonably object to Tripwire’s use of a new Sub-Processor (e.g., if making Personal Data available to the Sub-Processor may violate Applicable Data Protection Law or weaken the protections for such Personal Data) by notifying the Tripwire Data Privacy Contact within ten (10) business days after receipt of Tripwire’s notice in accordance with the notification mechanism described in Section 4.1 above. Such notice must explain the reasonable grounds for the objection. If Customer objects to a new Sub-Processor as permitted in this Section 4.2, Tripwire will use commercially reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-Processor without unreasonably burdening Customer. If Tripwire is unable to make available such change within a reasonable period of time (not exceeding thirty (30) days), Customer may terminate without penalty the Agreement with respect only to those Services that cannot be provided by Tripwire without the use of the objected- to new Sub-Processor by providing written notice to the Tripwire Data Privacy Contact. Tripwire will refund any fees that were prepaid to Tripwire covering the remainder of the term of such Agreement following the effective date of termination with respect to the terminated Services.

Changes to Sub-processors. Customer may reasonably object to Tripwire’s use of a new Sub-Processor (e.g., if making Personal Data available to the Sub-Processor may violate Applicable Data Protection Law or weaken the protections for such Personal Data) by notifying the Tripwire Data Privacy Contact within ten (10) business days after receipt of Tripwire’s notice in accordance with the notification mechanism described in Section 4.1 above. Such notice must explain the reasonable grounds for the objection. If Customer objects to a new Sub-Processor as permitted in this Section 4.2, Tripwire will use commercially reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-Processor without unreasonably burdening Customer. If Tripwire is unable to make available such change within a reasonable period of time (not exceeding thirty (30) days), Customer may terminate without penalty the Agreement with respect only to those Services that cannot be provided by Tripwire without the use of the objected- object-to new Sub-Processor by providing written notice to the Tripwire Data Privacy Contact. Tripwire will refund any fees that were prepaid to Tripwire covering the remainder of the term of such Agreement following the effective date of termination with respect to the terminated Services.

Changes to Sub-processors. Customer may reasonably object to Tripwire’s use of a new Sub-Processor (e.g., if making Personal Data available to the Sub-Processor may violate Applicable Data Protection Law or weaken the protections for such Personal Data) by notifying the Tripwire Data Privacy Contact within ten (10) business days after receipt of Tripwire’s notice in accordance with the notification mechanism described in Section 4.1 above. Such notice must explain the reasonable grounds for the objection. If Customer objects to a new Sub-Processor as permitted in this Section 4.2, Tripwire will use commercially reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-Processor without unreasonably burdening Customer. If Tripwire is unable to make available such change within a reasonable period of time (not exceeding thirty (30) days), Customer may terminate without penalty the Agreement with respect only to those Services that cannot be provided by Tripwire without the use of the objected- objected-to new Sub-Processor by providing written notice to the Tripwire Data Privacy Contact. Tripwire will refund any fees that were prepaid to Tripwire covering the remainder of the term of such Agreement following the effective date of termination with respect to the terminated Services.