Common use of CUSTOMER DATA AND DATA PROTECTION Clause in Contracts

CUSTOMER DATA AND DATA PROTECTION. 9.1 The Customer, or any third party from whom the Customer derives its right, owns and shall retain all rights, title and interest in and to Customer Data. The Product Owner rights to the Customer data regarding the Service is set out in paragraph 3. 9.2 Per the date of the Customer’s order for Egain’s products and services, the Service provided by Service Provider to Customer does not include any processing of personal data. If the Parties at a later stage during the term of the Agreement would conclude that the Service Provider will process personal data on behalf of the Customer as a personal data processor, the Parties undertake to enter into the relevant data processing agreements, based on the Service Provider’s template, required to ensure compliance with the Data Privacy Laws. In such case, the Service Provider shall be entitled to charge reasonable fees to compensate for additional measures and work required in connection with and for the fulfillment of the role as a data processor for the Customer. 9.3 In terms of the Services, Egain collects and processes personal data from the Customer in the form of name, address, e-mail addresses and telephone numbers. 9.4 Egain processes the Customer’s personal data for: 1. provision of the Services; 2. communication with the Customer; 3. compiling statistics; 4. performing analyses; 5. direct marketing. The legal basis for processing as set out in clauses 1 and 2 is that Egain must be able to fulfil the Agreement that Egain has entered into with the Customer. The legal basis for processing as set out in clauses 3 to 5 is that processing is necessary for the purposes pursuant to Egain’s legitimate interests, such as being able to contact the Customer with information or material regarding Egain’s goods and services that may be of interest to the Customer, develop Egain’s business and to produce forecasts. Egain believes that these legitimate interests usurp the privacy infringement the Customer is exposed to as a result of the processing. This assessment has been made taking into account that Egain believes that the processing is beneficial to the Customer. 9.5 Egain deletes (or anonymises) the Customer’s personal data once the data is no longer required to fulfil the purpose of the processing. The personal data processed for direct marketing is stored for up to three years after the agreement with the Customer has expired. 9.6 Egain shares the Customer’s personal data with: companies within the Egain group, subcontractors, partners and authorities. 9.7 The Egain company signing the agreement with the Customer is the personal data controller for the processing. 9.8 A Customer who is a natural person, or a natural person who is employed by the Customer, is entitled to request a copy of all personal data that Egain processes on him or her, and is also entitled to receive the personal data in a structured, generally familiar and machine- readable format for the purpose of transferring this personal data to another personal data controller (known as data portability). This person is also entitled to request the correction or deletion of personal data and request a restriction to the personal data processing that concerns the Customer. If any Customer who is a natural person, or a natural person who is employed by the Customer, considers that Egain is processing personal data in an incorrect manner, they are entitled to file a complaint with the Data Inspectorate (the Swedish Data Protection Authority).

CUSTOMER DATA AND DATA PROTECTION. 9.1 The Customer, or any third party from whom the Customer derives its right, owns and shall retain all rights, title and interest in and to Customer Data. The Product Owner rights to the Customer data regarding the Service is set out in paragraph 3. 9.2 Per the date of the Customer’s order for Egain’s products and services, the Service provided by Service Provider to Customer does not include any processing of personal data. If the Parties at a later stage during the term of the Agreement would conclude that the Service Provider will process personal data on behalf of the Customer as a personal data processor, the Parties undertake to enter into the relevant data processing agreements, based on the Service Provider’s template, required to ensure compliance with the Data Privacy Laws. In such case, the Service Provider shall be entitled to charge reasonable fees to compensate for additional measures and work required in connection with and for the fulfillment of the role as a data processor for the Customer.Customer.‌ 9.3 In terms of the Services, Egain collects and processes personal data from the Customer in the form of name, address, e-mail addresses and telephone numbers. 9.4 Egain processes the Customer’s personal data for: 1. provision of the Services; 2. communication with the Customer; 3. compiling statistics; 4. performing analyses; 5. direct marketing. The legal basis for processing as set out in clauses 1 and 2 is that Egain must be able to fulfil the Agreement that Egain has entered into with the Customer. The legal basis for processing as set out in clauses 3 to 5 is that processing is necessary for the purposes pursuant to Egain’s legitimate interests, such as being able to contact the Customer with information or material regarding Egain’s goods and services that may be of interest to the Customer, develop Egain’s business and to produce forecasts. Egain believes that these legitimate interests usurp the privacy infringement the Customer is exposed to as a result of the processing. This assessment has been made taking into account that Egain believes that the processing is beneficial to the Customer. 9.5 Egain deletes (or anonymises) the Customer’s personal data once the data is no longer required to fulfil the purpose of the processing. The personal data processed for direct marketing is stored for up to three years after the agreement with the Customer has expired. 9.6 Egain shares the Customer’s personal data with: companies within the Egain group, subcontractors, partners and authorities. 9.7 The Egain company signing the agreement with the Customer is the personal data controller for the processing. 9.8 A Customer who is a natural person, or a natural person who is employed by the Customer, is entitled to request a copy of all personal data that Egain processes on him or her, and is also entitled to receive the personal data in a structured, generally familiar and machine- readable format for the purpose of transferring this personal data to another personal data controller (known as data portability). This person is also entitled to request the correction or deletion of personal data and request a restriction to the personal data processing that concerns the Customer. If any Customer who is a natural person, or a natural person who is employed by the Customer, considers that Egain is processing personal data in an incorrect manner, they are entitled to file a complaint with the Data Inspectorate (the Swedish Data Protection Authority).