Common use of EU Standard Contractual Clauses Clause in Contracts

EU Standard Contractual Clauses. The parties agree that the EU Standard Contractual Clauses will apply to Personal Information that is transferred via the Service from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal Information. For data transfers from the EEA that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows: (a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow is processing Customer Account Data; (b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Controller of Customer Personal Information and Webflow is processing Customer Personal Information; (c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Processor of Customer Personal Information and Webflow is processing Customer Personal Information; (d) For each Module, where applicable: 1. Clause 7: The optional docking clause will not apply; 2. Clause 9: Option 2 will apply and the time period for prior written notice of subprocessor changes will be as set forth in Section 5 (Use of Subprocessors) of the DPA; 3. Clause 11: The optional language will not apply; 4. Clause 17: the EU Standard Contractual Clauses will be governed by the laws of Ireland; 5. Clause 18: the EU Standard Contractual Clauses disputes will be resolved before the courts of Ireland. (e) Schedule 1 of this DPA serves as Annex I of the EU Standard Contractual Clauses (f) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clauses.

EU Standard Contractual Clauses. The parties agree that the EU Standard Contractual Clauses will apply to Personal Information Data that is transferred via the Service Services from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal InformationData. For data transfers from the EEA Area that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows: (a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow is processing Customer Account Data; (b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Controller controller of Customer Personal Information Data and Webflow Grafana Labs is processing Customer Personal Information;Data. (cb) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Processor processor of Customer Personal Information Data and Webflow Grafana Labs is processing Customer Personal Information;Data. (dc) For each Module, where applicable: 1. (i) in Clause 7: The 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply; 2. (ii) in Clause 9: 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of subprocessor changes will be as set forth in Section 5 6 (Use of Subprocessors) of the this DPA; 3. (iii) in Clause 11: The 11 of the EU Standard Contractual Clauses, the optional language will not apply; 4. (iv) in Clause 17: 17 (Option 1), the EU Standard Contractual Clauses will be governed by the laws of IrelandIrish law; 5. (v) in Clause 18: 18(b) of the EU Standard Contractual Clauses Clauses, disputes will be resolved before the courts of Ireland.; (evi) Schedule 1 of this DPA serves as in Annex I I, Part A of the EU Standard Contractual Clauses (f) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clauses: ▪ Data Exporter: Customer.

EU Standard Contractual Clauses. The parties Parties agree that the EU Standard Contractual Clauses will apply to Personal Information Data that is transferred via the Service Services from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal InformationData. For data transfers from the EEA Area that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows: (a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow is processing Customer Account Data; (b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Controller controller of Customer Personal Information Data and Webflow Bluecore is processing Customer Personal Information;Data. (cb) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Processor processor of Customer Personal Information Data and Webflow Bluecore is processing Customer Personal Information;Data. (dc) For each Module, where applicable: 1. (i) in Clause 7: The 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply; 2. (ii) in Clause 9: 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of subprocessor Subprocessor changes will be as set forth in Section 5 6 (Use of Subprocessors) of the this DPA; 3. (iii) in Clause 11: The 11 of the EU Standard Contractual Clauses, the optional language will not apply; 4. (iv) in Clause 17: 17 (Option 1), the EU Standard Contractual Clauses will be governed by the laws of IrelandIrish law; 5. (v) in Clause 18: 18(b) of the EU Standard Contractual Clauses Clauses, disputes will be resolved before the courts of Ireland.; (evi) Schedule 1 of this DPA serves as in Annex I I, Part A of the EU Standard Contractual Clauses (f) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clauses: ▪ Data Exporter: Customer.

EU Standard Contractual Clauses. The parties agree that the EU Standard Contractual Clauses will apply to Personal Information Data that is transferred via the Service Services from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) is not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal InformationData. For data transfers from the EEA that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows: (a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow PowerPlan is processing Customer Client Account Data; (b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer Client is a Controller of Customer Personal Information Client Data and Webflow PowerPlan is processing Customer Personal InformationClient Data; (c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer Client is a processor of Client Data and PowerPlan is processing Client Data on behalf of Client; (d) Module Four (Processor to Controller) of the EU Standard Contractual Clauses will apply where Client is a Processor of Customer Personal Information Client Data and Webflow is processing Customer Personal Information;PowerPlan processes Client Account Data; and (de) For each Module, where applicable: 1. i. in Clause 7: The 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply; 2ii. in Clause 9: 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of subprocessor sub-processor changes will be as set forth in Section 5 4.2 (Use Current Subprocessors and Notification of SubprocessorsChanges) of the this DPA; 3iii. in Clause 11: The 11 of the EU Standard Contractual Clauses, the optional language will not apply; 4iv. in Clause 17: 17 (Option 1), the EU Standard Contractual Clauses will be governed by the laws of IrelandIrish law; 5. v. in Clause 18: 18(b) of the EU Standard Contractual Clauses Clauses, disputes will be resolved before the courts of Ireland.; (e) Schedule 1 of this DPA serves as vi. in Annex I I, Part A of the EU Standard Contractual Clauses (f) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clauses.: • Data Exporter: Client

EU Standard Contractual Clauses. The parties agree that For transfers of EU Personal Data to Supplier for processing in a jurisdiction outside the EU, the EEA, or the European Commission-approved countries or organisations providing ‘adequate’ data protection, Module 2 of the EU Standard Contractual Clauses SCCs will apply to Personal Information that is transferred via the Service from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized apply. The EU SCCs are incorporated herein by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal Information. For data transfers from the EEA that are reference subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as followsfollowing: (ai) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow is processing Customer Account Data; (b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Controller of Customer Personal Information and Webflow is processing Customer Personal Information; (c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Processor of Customer Personal Information and Webflow is processing Customer Personal Information; (d) For each Module, where applicable: 1. in Clause 7: The , the optional docking clause will not apply; 2. (ii) in Clause 8.5 and 16 (d), the Parties agree that the certification of deletion of Personal Data shall be provided by Supplier to Customer only upon written request; (iii) in Clause 8.9, the Parties agree that the audits described shall be carried out in accordance with the audit provisions agreed in the Agreement; (iv) in Clause 9: , Option 2 will apply apply, and the time period for prior written notice of subprocessor Sub-processor changes will shall be as set forth out in Section 5 Clause 8 of this DPA. For the purpose of Clause 9 (Use a), Customer gives general authorisation to engage Sub-processors in accordance with Clause 8 of Subprocessors) of the DPAthis Data Protection Schedule; 3. (v) in Clause 11: The , the optional language will not apply; 4(vi) in Clause 12, any claims brought under the EU SCCs shall be subject to the terms and conditions set forth in the Agreement. Supplier’s liability under Clause 12 (b) shall be limited to any damages caused by its Processing where Supplier has not complied with its obligations under the GDPR specifically directed to Processors, or where it has acted outside of or contrary to lawful instructions of Customer, as specified in Article 82 GDPR. In no event shall any party limit its liability with respect to any data subject rights under the EU SCCs. (vii) in Clause 15 (1) (a), Supplier shall only notify the Customer and not the Data Subject(s) in case of a government access request. Customer is solely responsible for promptly notifying the Data Subject as necessary. (viii) in Clause 17: the EU Standard Contractual Clauses , Option 1 will apply, and Irish law will be governed by the laws of Irelandgoverning law; 5. (ix) in Clause 18: the EU Standard Contractual Clauses 18(b), disputes will shall be resolved before the courts of Ireland.Dublin; (ex) Schedule 1 of this DPA serves as in Annex I I, Part A of the EU Standard Contractual Clauses (fSCC shall be completed as follows: Data Exporter: Customer Contact details: [The email address(es) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clausesdesignated by Customer in Customer’s account via its notification preferences].