Audits and Certifications The parties agree that the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with the following specifications: Upon Customer’s request, and subject to the confidentiality obligations set forth in the Agreement, VTEX shall make available to Customer (or Customer’s independent, third-party auditor) information regarding the VTEX Group’s compliance with the obligations set forth in this DPA in the form of the third-party certifications and audits set forth in the Security Practices Data Sheet. Customer may contact VTEX to request an on-site audit of VTEX's procedures relevant to the protection of Personal Data, but only to the extent required under applicable Data Protection Law. Customer shall reimburse VTEX for any time expended for any such on-site audit at the VTEX Group’s then-current rates, which shall be made available to Customer upon request. Before the commencement of any such on-site audit, Customer and VTEX shall mutually agree upon the scope, timing, and duration of the audit and any measures to protect the security of third party personal data or VTEX confidential information, in addition to the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by VTEX. Customer shall promptly notify VTEX with information regarding any non-compliance discovered during the course of an audit, and VTEX shall use commercially reasonable efforts to address any confirmed non-compliance.
