Common use of EEA/Switzerland-Specific Terms Clause in Contracts

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information transferred to it (directly or indirectly) from the EEA or Switzerland on the basis of the Standard Contractual Clauses under provision 3(e)(i), Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses as provided by the EU Commission (set forth on Lilly’s Procurement Portal as “EU Standard Contractual Clauses for Data Transfer”) modified as necessary in respect of such Personal Information. Supplier hereby grants any applicable third party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data Subject, or entity acting on his/her behalf, is entitled to bring a claim against Xxxxx or its Affiliate (s) for breach of the Standard Contractual Clauses, and such claim arises from Supplier’s Processing operations under this Agreement and Standard, Supplier shall indemnify Lilly or its Affiliate (s) for all liabilities, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full indemnity basis, and all other reason able professional costs and expenses) suffered or incurred by Xxxxx or its Affiliate(s) arising out of or in connection with such claim, provided that: x. Xx soon as reasonably practicable, Supplier is given notice of such claim; and xx.Xxxxx or its Affiliate (s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx or such Affiliate (s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to Supplier, but without obtaining Supplier's consent) if Xxxxx or such Affiliate(s) believes that failure to settle s uch claim would be prejudicial to Lilly or its Affiliate (s) in any material respect. (c) Promptly upon request from Lilly or its Affiliates, Supplier shall return to Lilly or a requesting Affiliate (if any) a completed Data Processing Information Form usi ng the template set out in Exhibit A. (to be completed by Supplier and returned to Lilly upon request from Xxxxx or its Affiliates) Supplier represents that the following is accurate t o the best of their knowledge: 1. Supplier’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to Data Subjects that will be Processed by Supplier as part of the Services:  Employee Data  Consumer Data  Healthcare Provider Data  Animal Healthcare Provider Data  Clinical Trial Subject Data  Clinical Investigator Data  Supplier and other Contractor Employee Data  Other Personal Information Processed (please list): 4. Select the categories of Lilly data that will be Processed by Supplier as part of the Services:  The following data of customers and business partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded communication channels, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -value-score and data of prospective customers.  The following data of health care professionals, including thought leaders: name, institution, location, address(es), contact persons, communication data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interests, participation in events, payment conditions.  The following data of visitors of websi tes: IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitor.  The following data of employees of Xxxxx (staff, freelancers, managing directors, and members of the executive board): in particular personnel master data, e.g. data derived from CVs, salary accounting data, da ta in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log data, as well as all data potentially c ollected in the personnel records.  The following data of patients: patient master data, including data in relation to state of health, medication, information in relation to patient support programs, information in relation to the notification of adverse events and product complaints, etc.  Business communication with contact persons, in particular: traffic data of e -mail, facsimile, telephone and content of emails, facsimile, and postal communication.  Data and results deriving from surveys and other market research activities; accounts and sub-accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  Contract master data, offers, prices, special conditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  Business documents and text as well as the related history with respect to individual business partners, customers, potential customers and business partners, contacts, accounts or other data records that are stored in the system.  Data accrued within the scope of use of services that are provided by Lilly (e.g. personnel identification derived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information transferred to it (directly or indirectly) from the EEA or Switzerland on the basis of the Standard Contractual Clauses under provision 3(e)(i), Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses as provided by the EU Commission (set forth on Lilly’s Procurement Portal as “EU Standard Contractual Clauses for Data Transfer”) modified as necessary in respect of such Personal InformationInf ormation. Supplier hereby grants any applicable third party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data Subject, or entity acting on his/her behalf, is entitled to bring a claim against Xxxxx or its Affiliate (saffiliate(s) for breach of the Standard Contractual Clauses, and such claim arises from SupplierSupplier ’s Processing operations under this Agreement and Standard, Supplier shall indemnify Lilly or its Affiliate (saffiliate(s) for all liabilities, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full ful l indemnity basis, and all other reason able reasonable professional costs and expenses) suffered or incurred by Xxxxx or its Affiliate(saffiliate(s) arising out of or in connection with such claim, provided that: x. Xx (i) as soon as reasonably practicable, Supplier is given notice of such claim; and xx.Xxxxx and (ii) Lilly or its Affiliate (saffiliate(s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx Lilly or such Affiliate (saffiliate(s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to SupplierSupplier , but without obtaining SupplierSupplier 's consent) if Xxxxx Lilly or such Affiliate(saffiliate( s) believes that failure to settle s uch such claim would be prejudicial to Lilly or its Affiliate (saffiliate(s) in any material respect. (c) Promptly upon request from Lilly or its Affiliatesaffiliates, Supplier shall return to Lilly or a requesting Affiliate affiliate (if any) a completed Data Processing Information Form usi ng using the template set out in Exhibit A. (to be completed by Supplier and returned to Lilly upon request from Xxxxx or its Affiliatesaffilia tes) Supplier represents that the following is accurate t o to the best of their knowledge: 1. SupplierSupplier ’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to of Data Subjects that will be Processed by Supplier as part of the Services:  Employee Data  Consumer Data  Healthcare Provider Data  Animal Healthcare Provider Data  Clinical Trial Subject Data  Clinical Investigator Data  Supplier and other Contractor Employee Data  Other Personal Information Processed (please list): 4. Select the categories of data of Lilly data that will be Processed by Supplier as part of the Servicesservices:  The following data of customers and business partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded communication channels, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -value-score and data of prospective customers.  The following data of health care professionals, including thought leaders: name, institution, location, address(es), contact persons, communication data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interests, participation in events, payment conditions.  The following data of visitors of websi teswebsites: IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitor.  The following data of employees of Xxxxx (staff, freelancers, managing directors, and members of the executive board): in particular personnel master data, e.g. data derived from CVs, salary accounting data, da ta data in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log datadat a, as well as all data potentially c ollected collected in the personnel records.  The following data of patients: patient master data, including data in relation to state of health, medication, information in relation to patient support programs, information in relation relat ion to the notification of adverse events and product complaints, etc.  Business communication with contact persons, in particular: traffic data of e -maile-mail, facsimile, telephone and content of emails, facsimile, and postal communication.  Data and results deriving from surveys and other market research activities; accounts and sub-accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  Contract master data, offers, prices, special conditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  Business documents and text as well as the related history with respect to individual individu al business partners, customers, potential customers and business partners, contacts, accounts or other data records that are stored in the system.  Data accrued within the scope of use of services that are provided by Lilly Xxxxx (e.g. personnel identification derived d erived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information transferred to it (directly or indirectly) from the EEA or Switzerland on the basis of the Standard Contractual Clauses under provision 3(e)(i), Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses as provided by the EU Commission (set forth on Lilly’s Procurement Portal as “EU Standard St andard Contractual Clauses for Data Transfer”) modified as necessary in respect of such Personal Information. Supplier hereby here by grants any applicable third party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data Subject, or entity acting on his/her behalfbe half, is entitled to bring a claim against Xxxxx Lilly or its Affiliate (saffiliate(s) for breach of the Standard Contractual ClausesClau ses, and such claim arises from Supplier’s Processing operations under this Agreement and Standard, Supplier shall indemnify Lilly or its Affiliate (saffiliate(s) for all liabilities, costs, expenses, damages and losses (including includi ng any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full indemnity basis, and all other reason able reasonable professional costs and expenses) suffered or incurred by Xxxxx Lilly or its Affiliate(safxxxxxte(s) arising out of or in connection with such claim, provided that: x. Xx i. As soon as reasonably practicable, Supplier is given notice of such claim; and xx.Xxxxx and ii. Lilly or its Affiliate (safxxxxxte(s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx Lilly or such Affiliate (saxxxxxate(s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to Supplier, but without obtaining Supplier's consent) if Xxxxx Lilly or such Affiliate(saffiliate(s) believes that failure to settle s uch such claim would be prejudicial to Lilly or its Affiliate (saffiliate(s) in any material respect. (c) Promptly upon request from Lilly or its Affiliatesaffiliates, Supplier shall return to Lilly or a requesting Affiliate affiliate (if any) a completed Data Processing Information Form usi ng Formusing the template set out in Exhibit A. EXHIBIT A Supplier Privacy Standard Data Processing Information Form (to be completed by Supplier and returned to Lilly Li lly upon request from Xxxxx Lilly or its Affiliatesaffiliates) Supplier represents that the following is accurate t o to the best of their knowledge: 1. Supplier’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to of Data Subjects that th at will be Processed by Supplier as part of the Services:  🞎 Employee Data  🞎 Consumer Data  🞎 Healthcare Provider Data  🞎 Animal Healthcare Provider Data  🞎 Clinical Trial Subject Data  🞎 Clinical Investigator Data  🞎 Supplier and other Contractor Employee Data  🞎 Other Personal Information Processed (please list): 4. Select the categories of data of Lilly data that will be Processed by Supplier as part of the Servicesservices:  🞎 The following data of customers and business partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded communication channelschanne ls, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -valuecustomer-value-score and data of prospective customers.  🞎 The following data of health care professionals, including thought leaders: name, institution, location, address(es), contact persons, communication communic ation data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interestsinte rests, participation in eventsev ents, payment conditions.  🞎 The following data of visitors of websi teswebsites: IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitorthevisitor.  🞎 The following data of employees of Xxxxx Lilly (staff, freelancersfxxxxxncers, managing directors, and members of the executive board): in particular personnel master mast er data, e.g. data e.x. xxxa derived from CVs, salary accounting data, da ta data in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log data, as well as all data potentially c ollected collected in the personnel records.  🞎 The following data of patients: patient master datadata , including data in relation to state of health, medication, information in relation to patient support programs, information in relation to the notification of adverse events and product complaints, etc.  🞎 Business communication with contact persons, in particular: traffic data of e -maile-mail, facsimile, telephone and content of emails, facsimile, and postal communication.  🞎 Data and results deriving from surveys and other othe r market research activities; accounts and sub-sub- accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  🞎 Contract master data, offers, prices, special conditionsco nditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  🞎 Business documents and text as well as the related relate d history with respect to individual business partners, customers, potential customers and business bu siness partners, contacts, accounts or other data records that are stored in the system.  🞎 Data accrued within the scope of use of services that are provided by Lilly (e.g. personnel identification derived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):): SCHEDULE 6 – INFORMATION SECURITY STANDARD This Information Security Standard sets forth Eli Lilly and Cxxxaxx’x (“Lill y”) information security requirements for third parties/suppliers (each, a “Third Party/Supplier”) with respect to the confidentiality, integrity and availability of Information (defined belo w). Any additional Third Party/Supplier obligations related to Information security under any agreement with Lilly are in adxxxxxn to the requirements of this Information Security Standard.

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information Data transferred to it (directly or indirectly) from the EEA or Switzerland on the basis of the Standard Contractual Clauses under provision 3(e)(i)Clauses, Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses included in Exhibit 2 (a) to this DPA and as provided by the EU Commission (set forth on Lilly’s Procurement Portal as “EU Standard Contractual Clauses for Data Transfer”) ” modified as necessary in respect of such Personal InformationData. Supplier hereby grants any applicable third third-party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data SubjectSubject to whom such Personal Data pertains (a “data subject”), or entity acting on his/her behalf, is entitled to bring a claim against Xxxxx Elanco or its Affiliate (saffiliate(s) for breach of the Standard Contractual Clauses, and such claim arises from Supplier’s Processing operations under this Agreement and StandardDPA, Supplier shall indemnify Lilly Elanco or its Affiliate (saffiliate(s) for all liabilities, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full indemnity basis, and all other reason able reasonable professional costs and expenses) suffered or incurred by Xxxxx Elanco or its Affiliate(saffiliate(s) arising out of or in connection with such claim, provided that: x. Xx (i) As soon as reasonably practicable, Supplier is given notice of such claim; and xx.Xxxxx and (ii) Elanco or its Affiliate (saffiliate(s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx Elanco or such Affiliate (saffiliate(s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to Supplier, but without obtaining Supplier's consent) if Xxxxx Elanco or such Affiliate(saffiliate(s) believes that failure to settle s uch such claim would be prejudicial to Lilly Elanco or its Affiliate (saffiliate(s) in any material respect. (c) Promptly upon request from Lilly or its Affiliates, Supplier shall return to Lilly or a requesting Affiliate (if any) a completed Data Processing Information Form usi ng the template set out in Exhibit A. (to be completed by Supplier and returned to Lilly upon request from Xxxxx or its Affiliates) Supplier represents that the following is accurate t o the best of their knowledge: 1. Supplier’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to Data Subjects that will be Processed by Supplier as part of the Services:  Employee Data  Consumer Data  Healthcare Provider Data  Animal Healthcare Provider Data  Clinical Trial Subject Data  Clinical Investigator Data  Supplier and other Contractor Employee Data  Other Personal Information Processed (please list): 4. Select the categories of Lilly data that will be Processed by Supplier as part of the Services:  The following data of customers and business partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded communication channels, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -value-score and data of prospective customers.  The following data of health care professionals, including thought leaders: name, institution, location, address(es), contact persons, communication data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interests, participation in events, payment conditions.  The following data of visitors of websi tes: IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitor.  The following data of employees of Xxxxx (staff, freelancers, managing directors, and members of the executive board): in particular personnel master data, e.g. data derived from CVs, salary accounting data, da ta in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log data, as well as all data potentially c ollected in the personnel records.  The following data of patients: patient master data, including data in relation to state of health, medication, information in relation to patient support programs, information in relation to the notification of adverse events and product complaints, etc.  Business communication with contact persons, in particular: traffic data of e -mail, facsimile, telephone and content of emails, facsimile, and postal communication.  Data and results deriving from surveys and other market research activities; accounts and sub-accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  Contract master data, offers, prices, special conditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  Business documents and text as well as the related history with respect to individual business partners, customers, potential customers and business partners, contacts, accounts or other data records that are stored in the system.  Data accrued within the scope of use of services that are provided by Lilly (e.g. personnel identification derived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information transferred to it (directly or indirectly) from the EEA or Switzerland on the basis of the Standard Contractual Clauses under provision 3(e)(i), Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses as provided by the EU Commission (set forth on Lilly’s Xxxxx’x Procurement Portal as “EU Standard Contractual Clauses for Data Transfer”) modified as necessary in respect of such Personal Information. Supplier hereby grants any applicable third party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data Subject, or entity acting on his/her behalf, is entitled to bring a claim against Xxxxx or its Affiliate (saffiliate(s) for breach of the Standard Contractual Clauses, and such claim arises from Supplier’s Processing operations under this Agreement and Standard, Supplier shall indemnify Lilly or its Affiliate (saffiliate(s) for all liabilities, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full indemnity basis, and all other reason able reasonable professional costs and expenses) suffered or incurred by Xxxxx or its Affiliate(saffiliate(s) arising out of or in connection with such claim, provided that: x. Xx soon as reasonably practicable, Supplier is given notice of such claim; and and xx.. Xxxxx or its Affiliate (saffiliate(s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx or such Affiliate (saffiliate(s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to Supplier, but without obtaining Supplier's consent) if Xxxxx or such Affiliate(saffiliate(s) believes that failure to settle s uch such claim would be prejudicial to Lilly or its Affiliate (saffiliate(s) in any material respect. (c) Promptly upon request from Lilly or its Affiliatesaffiliates, Supplier shall return to Lilly or a requesting Affiliate affiliate (if any) a completed Data Processing Information Form usi ng using the template set out in Exhibit A. (to be completed by Supplier and returned to Lilly upon request from Xxxxx or its Affiliatesaffiliates) Supplier represents that the following is accurate t o to the best of their knowledge: 1. Supplier’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to of Data Subjects that will be Processed by Supplier as part of the Services:  🞎 Employee Data  🞎 Consumer Data  🞎 Healthcare Provider Data  🞎 Animal Healthcare Provider Data  🞎 Clinical Trial Subject Data  🞎 Clinical Investigator Data  🞎 Supplier and other Contractor Employee Data  🞎 Other Personal Information Processed (please list): 4. Select the categories of data of Lilly data that will be Processed by Supplier as part of the Servicesservices:  🞎 The following data of customers and business partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded communication channels, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -valuecustomer-value-score and data of prospective customers.  🞎 The following data of health care professionals, including thought leaders: name, institution, location, address(es), contact persons, communication data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interests, participation in events, payment conditions.  🞎 The following data of visitors of websi teswebsites: IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitor.  🞎 The following data of employees of Xxxxx (staff, freelancers, managing directors, and members of the executive board): in particular personnel master data, e.g. data derived from CVs, salary accounting data, da ta data in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log data, as well as all data potentially c ollected collected in the personnel records.  🞎 The following data of patients: patient master data, including data in relation to state of health, medication, information in relation to patient support programs, information in relation to the notification of adverse events and product complaints, etc.  🞎 Business communication with contact persons, in particular: traffic data of e -maile-mail, facsimile, telephone and content of emails, facsimile, and postal communication.  🞎 Data and results deriving from surveys and other market research activities; accounts and sub-sub- accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  🞎 Contract master data, offers, prices, special conditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  🞎 Business documents and text as well as the related history with respect to individual business partners, customers, potential customers and business partners, contacts, accounts or other data records that are stored in the system.  🞎 Data accrued within the scope of use of services that are provided by Lilly (e.g. personnel identification derived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):): This Information Security Standard sets forth Xxx Xxxxx and Company’s (“Lilly”) information security requirements for third parties/suppliers (each, a “Third Party/Supplier”) with respect to the confidentiality, integrity and availability of Information (defined below). Any additional Third Party/Supplier obligations related to Information security under any agreement with Xxxxx are in addition to the requirements of this Information Security Standard. As used herein, “Information” encompasses both Confidential Information and Personal Information that we use for business purposes (hereinafter independently and/or collectively referred to herein as

EEA/Switzerland-Specific Terms. (a) Unless otherwise notified, if Supplier is Processing Personal Information transferred to it (directly or indirectly) from the EEA or Switzerland Switze rland on the basis of the Standard Contractual Clauses under provision 3(e)(i), Supplier must comply with the obligations imposed on a ‘data importer’ (or, as applicable, a ‘subprocessor’) under the Standard Contractual Clauses as provided by the EU Commission (set forth on Lilly’s Procurement Portal as “EU Standard Contractual Clauses for Data Transfer”) modified as necessary in respect of such Personal Information. Supplier hereby grants any applicable third party beneficiary rights referred to in the Standard Contractual Clauses. (b) Where a Data Subject, or entity acting on his/her behalf, is entitled to bring a claim against Xxxxx or its Affiliate (sAffiliate(s) for breach of the Standard Contractual Cont ractual Clauses, and such claim arises from Supplier’s Processing operations under this Agreement and Standard, Supplier shall indemnify Lilly or its Affiliate (sAffiliate(s) for all liabilitiesliabilit ies, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs, calculated on a full indemnity basis, and all other reason able reasonable professional costs and expenses) suffered or incurred by Xxxxx or its Affiliate(s) arising out of or in connection with such claim, provided that: x. Xx soon as reasonably practicable, Supplier Supplie r is given notice of such claim; and xx.Xxxxx or its Affiliate (sAffiliate(s) (as the case may be) shall not make any admission of liability, agreement or compromise in relation to such claim without the prior written consent of Supplier (such consent consen t not to be unreasonably conditioned, withheld or delayed), provided that Xxxxx Lill y or such Affiliate (sAffiliate(s) may settle such claim (after giving prior written notice of the terms of settlement (to the extent legally possible) to Supplier, but without obtaining Supplier's consent) if Xxxxx or such Affiliate(s) believes that failure to settle s uch such claim would be prejudicial to Lilly or its Affiliate (sAffiliate(s) in any material respect. (c) Promptly upon request from Lilly or its Affiliates, Supplier shall return to Lilly or a requesting Affiliate (if any) a completed Data Processing Information Form usi ng using the template set out in Exhibit A. (to be completed by Supplier and returned to Lilly upon request from Xxxxx or its Affiliates) Supplier represents that the following is accurate t o a ccurate to the best of their knowledge: 1. Supplier’s Registered Name and Address: 2. Describe the nature and purpose of the data Processing to be undertaken by Supplier as set forth in the description of Services: 3. Select the categories of data related to Data Subjects that will be Processed by Supplier as part of the Services:  Employee Data  Consumer Data  Healthcare Provider Data  Animal Healthcare Provider Data  Clinical Trial Subject Data  Clinical Investigator Data  Supplier and other Contractor Employee Data  Other Personal Information Processed (please list): 4. Select the categories of Lilly data that will wi ll be Processed by Supplier as part of the Services:  The following data of customers and business busine ss partners as well as contact persons at customers and business partners: name, company, location, address(es), contact person, communication data, preferred/excluded ex cluded communication channels, desired information/ordered newsletters, dispatch, freight, and payment conditions, account advisers, activities, participation in events, campaigns, customer satisfaction, customer -valuecustomer-value-score and data of prospective customers.  The following data of health care professionalsprofes sionals, including thought leaders: name, institution, location, address(es), contact persons, communication data, CV-data, such as education, areas of expertise, skills and experience, cooperation during clinical trials or observational studies, potential conflicts of interests, participation in events, payment conditions.  The following data of visitors of websi teswebsites : IP Address, date and time of visit of website, web pages visited, website visitor came from, type of browser visitor is using, type of operating system visitor is using, domain name and address of visitor’s internet service provider, and, as the case may be, data manually entered by the visitor.  The following data of employees of Xxxxx (staffs taff, freelancers, managing directors, and members of the executive boardboar d): in particular personnel master data, e.g. data derived from CVs, salary accounting data, da ta data in relation to trainings and performance management, data in relation to company pension schemes, vacation times, absent times, travel expenses, data in relation to driver’s licenses, accidents at work, system log data, as well as all data potentially c ollected collected in the personnel records.  The following data of patients: patient master data, including data in relation to state of health, medication, information in relation to patient support programs, information in relation to the notification of adverse events and product complaints, etc.  Business communication with contact persons, in particular: traffic data of e -maile-mail, facsimile, telephone and content of emails, facsimile, and postal communication.  Data and results deriving from surveys and other market research activities; accounts and sub-accounts (e.g. contact data, contact person/s, activities, dispatch, freight, and payment conditions), person in charge at Processor.  Contract master data, offers, prices, special spec ial conditions, order and delivery data, invoice data, payment data, bank account data, data in relation to outstanding payments, and in each case the history relating thereto.  Business documents and text as well as the related history with respect to individual business partners, customers, potential customers and business partners, contacts, accounts or other data records that are stored in the system.  Data accrued within the scope of use of services that are provided by Lilly (e.g. personnel identification derived from input and usage trails). 5. Supplier will Process the Personal Information in the following geographies (list countries where Processing operations will occur):