Common use of CONFIDENTIALITY; SECURITY AND PRIVACY Clause in Contracts

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo Group will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardo’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo Group hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo Group Party shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardo, Service Data may be hosted by the iVcardo Group or their respective authorized third-party service providers in the United States, the EEA or other locations around the world. In providing the Services, iVcardo will engage entities within the iVcardo Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 3.1. Subject to the express permissions of set forth in this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each it protects its own Confidential Information, but with no less than with reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo Group 3.2. Secure Privacy will maintain reasonable administrative, physical, and technical safeguards for the protection of the security, confidentiality confidentiality, and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of the Service Data by the Personnel except (a) to provide the SAAS Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance for compliance with Sections 3.1(b) this Agreement or 3.1(c); (c) in accordance with the provisions of Section 3.4applicable law; or (dc) as You expressly permit in writing. The iVcardo Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardo’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 3.3. To the extent Service Data constitutes Personal Data, You and the iVcardo Group Secure Privacy hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo Group Party Secure Privacy shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Lawto 3.4. Unless otherwise specifically agreed to by iVcardo, Service Data may be hosted by the iVcardo Group or their respective authorized third-party service providers in the United States, the EEA or other locations around the world. In providing the Services, iVcardo will engage entities within the iVcardo Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group Secure Privacy and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You its agents, including Subprocessors shall have the right to access Your the Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the SAAS Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group Secure Privacy will only be given access to Your the Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which that are commercially reasonable and substantially consistent with the standards described described. 3.5. You acknowledge that Secure Privacy uses essential cookies for the SAAS Services to function. Currently, Secure Privacy uses the following types of cookies: 1. s_e_c_u_r_e_k_e_y – to enable the system to record the opt-in Section 3.2; or opt-out of cookie consent inside the system account. 2. ss-id cookies – temporary cookies for getting information during your session on the websites on how you use them. These cookies last only until the end of your session on the websites. They get deleted when you leave the websites. 3. ss-pid – persistent cookies for getting information during your session on the websites on how you use them. These cookies stay on your computer after the end of your session and (b) their agreement use the collected data to comply with improve your experience when you return to the data transfer restrictions applicable to Personal Data as set forth in Section 3.4websites.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo Group will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardo’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo Group hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo Group Party shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardo, Service Data may be hosted by the iVcardo Group or their respective authorized third-party service providers in the United States, the EEA or other locations around the world. In providing the Services, iVcardo will engage entities within the iVcardo Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. As a Subscriber, You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement Agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo IJJCorp Group will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address serviceService, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo IJJCorp Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardoIJJCorp’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo IJJCorp Group hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo IJJCorp Group Party shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardoIJJCorp, Service Data may be hosted by the iVcardo IJJCorp Group or their respective authorized third-party service providers in the United States, the EEA EEA, or other locations around the world. In providing the Services, iVcardo IJJCorp will engage entities within the iVcardo IJJCorp Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo IJJCorp Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx.of 3.5 You agree that the iVcardo IJJCorp Group and the third-party service providers that are utilized by the iVcardo IJJCorp Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo IJJCorp Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement Agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data.and 3.2 The iVcardo IJJCorp Group will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address serviceService, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo IJJCorp Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardoIJJCorp’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo IJJCorp Group hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo IJJCorp Group Party shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardoIJJCorp, Service Data may be hosted by the iVcardo IJJCorp Group or their respective authorized third-party service providers in the United States, the EEA EEA, or other locations around the world. In providing the Services, iVcardo IJJCorp will engage entities within the iVcardo IJJCorp Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo IJJCorp Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law.data 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx.of 3.5 You agree that the iVcardo IJJCorp Group and the third-party service providers that are utilized by the iVcardo IJJCorp Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo IJJCorp Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement Agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4. 3.6 Whenever You, Your Agents or End-Users interact with our Services, We automatically receive and record information on Our server logs from the browser or device, which may include IP address, “cookie” information, the type of browser and/or device being used to access the Services. “Cookies” are identifiers We transfer to the browser or device of Your Agents or End-Users that allow Us to recognize Agent or End-User and their browser or device along with how our Services are being utilized. When We collect this information, We only use this data in aggregate form, and not in a manner that would identify Your Agents or End-Users personally. For example, this aggregate data can tell Us how often users use a particular feature of the Services, and We can use that knowledge to improve the Services. 3.7 We receive and store any information You knowingly provide to Us. For example, through the registration process for Our Services and/or through your Account settings, We may collect Personal Data such as your name, email address, phone number, credit card information and third-party account credentials (for example, your login credentials for third party sites that integrate with the Services as further detailed in Section 3.9)

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us Party may use each other’s Confidential Information solely to exercise our its respective rights and perform our its respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel employees and/or non-employee service providers and contractors who have a need to know such Confidential Information for such purposes and who are bound by terms of confidentiality intended to maintain prevent the confidentiality of, and not misuse, misuse of such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Datathe exchange of Confidential Information after the acceptance of this Agreement. To be clear, any exchange of Confidential Information prior to the acceptance of this Agreement shall continue to be governed by such non-disclosure agreement. 3.2 The iVcardo Zendesk Group will maintain reasonable appropriate administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Your Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo Zendesk Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Your Service Data”) shall be deemed compliance with the iVcardoZendesk’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 3.3.1 To the extent Service Data constitutes Personal Data, You and the iVcardo Zendesk Group hereby agree that You shall be deemed to be the data controller Data Controller and the relevant entity in the iVcardo Zendesk Group Party shall be deemed to be the data processor Data Processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardoZendesk, Service Data may be hosted by the iVcardo Zendesk Group or their respective authorized third-party service providers in the United States, the EEA or other locations around the world. In providing the Services, iVcardo Zendesk will engage entities within the iVcardo Zendesk Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Zendesk Group be deemed a data controller Data Controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in 3.3.2 As between the EEAParties, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any all Service Data constitutes Processed under the terms of this Agreement shall remain the property of Subscriber. Except for where Zendesk collects (i) the contact information of Your Agents, which may include Personal Data, if Service Data is transferred to a country or territory outside in the ordinary course of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2You; and (bii) their agreement to comply with the data transfer restrictions applicable to Personal Data about visitors to Our Site, under no circumstances will We act, or be deemed to act as set forth in Section 3.4a “controller” (or equivalent concept) of the Service Data Processed within the Service under Applicable Data Protection Law. For the avoidance of doubt, Subscriber shall be considered the Data Controller of all End-User Personal Data under Applicable Data Protection Law.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo Group Smardii, Inc. will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitledTerms, “How We Protect Service Data” attached hereto, and the Supplemental Terms for the Deployed Associated Services, the Privacy Agreement as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions Clause 3.10 of Section 3.4; or (d) as You expressly permit in writing. The iVcardo Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardo’s Group’s obligations to protect Service Data as set forth in the this Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo Group Smardii, Inc. hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo Group Party Smardii, Inc. shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardoXxxxxxx, Inc., Service Data may be hosted by the iVcardo Group Smardii, Inc. or their respective authorized third-party service providers in the United States, the EEA European Economic Area (the “EEA”) or other locations around the world, as the case may be. In providing the Services, iVcardo Smardii, Inc. will engage entities within the iVcardo Smardii Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Smardii Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4.

CONFIDENTIALITY; SECURITY AND PRIVACY. 3.1 Subject to the express permissions of this Agreement, each Party will protect each other’s Confidential Information from unauthorized use, access, access or disclosure in the same manner as each protects its own Confidential Information, but with no less than reasonable care. Except as otherwise expressly permitted pursuant to this Agreement, each of us may use each other’s Confidential Information solely to exercise our respective rights and perform our respective obligations under this Agreement and shall disclose such Confidential Information (a) solely to the Personnel who have a need to know such Confidential Information for such purposes and who are bound to maintain the confidentiality of, and not misuse, such Confidential Information; (b) as necessary to comply with an order or subpoena of any administrative agency or court of competent jurisdiction; or (c) as reasonably necessary to comply with any applicable law or regulation. The provisions of this Section 3.1 shall supersede any non-disclosure agreement by and between the Parties that would purport to address the confidentiality and security of Service Data and such agreement shall have no further force or effect with respect to Service Data. 3.2 The iVcardo Group will maintain reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Service Data, as described in the Agreement, the Supplemental Terms entitled, “How We Protect Service Data” attached hereto, and Supplemental Terms for the Deployed Associated Services, as applicable. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Service Data by Personnel except (a) to provide the Services and prevent or address service, support or technical problems; (b) as compelled by law in accordance with Sections 3.1(b) or 3.1(c); (c) in accordance with the provisions of Section 3.4; or (d) as You expressly permit in writing. The iVcardo Group’s compliance with the provisions of Sections 3.2 through 3.5 and the Security Measures set forth in Exhibit B, Section 2 (“How We Protect Service Data”) shall be deemed compliance with the iVcardo’s Group’s obligations to protect Service Data as set forth in the Agreement. 3.3 To the extent Service Data constitutes Personal Data, You and the iVcardo Group hereby agree that You shall be deemed to be the data controller and the relevant entity in the iVcardo Group Party shall be deemed to be the data processor as those terms are understood under the Applicable Data Protection Law. Unless otherwise specifically agreed to by iVcardo, Service Data may be hosted by the iVcardo Group or their respective authorized third-party service providers in the United States, the EEA or other locations around the world. In providing the Services, iVcardo will engage entities within the iVcardo Group and other authorized service providers, to Process Service Data, including and without limitation, any associated Personal Data pursuant to this Agreement within the European Economic Area (the “EEA”), the United States and in other countries and territories. Under no circumstances will any entity in the iVcardo Group be deemed a data controller with respect to Service Data under Applicable Data Protection Law or any relevant law or regulation of any Member State as defined in Applicable Data Protection Law. 3.4 If Personal Data originates from an Agent or End-User in the EEA, We will ensure, pursuant to Applicable Data Protection Law that, to the extent that any Service Data constitutes Personal Data, if Service Data is transferred to a country or territory outside of the EEA (a “non-EEA country”), that such transfer will only take place if: (a) the non-EEA country in question ensures an adequate level of data protection; (b) one of the conditions listed in Article 26(1) of Directive 95/46/EC (or its equivalent under any successor legislation) is satisfied; (c) done so on the basis of iVcardo’s approved binding corporate rules known as the iVcardo Binding Corporate Rules (“iVcardo’s BCR”) which establish adequate protection of such personal information and are legally binding on the iVcardo Group (iVcardo’s BCR can be accessed here and here); or (d) the transfer is via the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks. Upon Your request and subject to Your entry into iVcardo’s Data Processing Agreement (“DPA”) We will further ensure that the transfer is subject to the standard contractual clauses designed to facilitate transfers of Personal Data from the EEA to all third countries that have been adopted by the European Commission (known as the, “Model Clauses”), which have been incorporated into the DPA. You can execute Our DPA by emailing Your request to Us at xxxxxxx@xxxxxxx.xxx. 3.5 You agree that the iVcardo Group and the third-party service providers that are utilized by the iVcardo Group to assist in providing the Services to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Service Data to the extent necessary to provide the Services, including, without limitation, in response to Your support requests. Any third-party service providers utilized by the iVcardo Group will only be given access to Your Account and Service Data as is reasonably necessary to provide the Services and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4. 3.6 Whenever You, Your Agents or End-Users interact with our Services, We automatically receive and record information on Our server logs from the browser or device, which may include IP address, “cookie” information,