Common use of Obligation after the termination of personal data Clause in Contracts

Obligation after the termination of personal data. processing services 1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms part of the Clauses and must be completed and signed by the parties The jurisdictions may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix The data exporter is: [TO BE COMPLETED] The data importer is: BZ DISC, Inc is a wholly owned subsidiary of Third Iron, LLC which processes personal data on behalf of the data exporter strictly in accordance of the terms of the Agreement. The personal data transferred concern the following categories of data subjects: Authorized users of library services affiliated with subscribing institution. The personal data transferred concern the following categories of data: When users register for, download, access and otherwise use Third Iron, BZ DISC may collect contact information such as e-mail address, mailing address, name, physical address, IP data, login information, and mobile device identifier. The personal data transferred concern the following special categories of data: None The personal data transferred will be subject to the following basic processing activities: The objective of Processing Personal Data by data importer is the performance of Third Iron service pursuant to the Agreement. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms part of the Clauses and must be completed and signed by the parties. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c): Access Control: Access to systems containing personal data are restricted to only those personnel possessing a valid business reason to do so and is secured with encrypted credentials.

Obligation after the termination of personal data. processing services 1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms part of the Clauses and must be completed and signed by the parties The jurisdictions may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix The data exporter is: [TO BE COMPLETED] The data importer is: BZ DISC, Inc is a wholly owned subsidiary of Third Iron, LLC which processes personal data on behalf of the data exporter strictly in accordance of the terms of the Agreement. The personal data transferred concern the following categories of data subjects: Authorized users of library services affiliated with subscribing institution. The personal data transferred concern the following categories of data: When users register for, download, access and otherwise use Third IronBrowZine, BZ DISC may collect contact information such as e-mail address, mailing address, name, physical address, IP data, login information, and mobile device identifier. The personal data transferred concern the following special categories of data: None The personal data transferred will be subject to the following basic processing activities: The objective of Processing Personal Data by data importer is the performance of Third Iron BrowZine service pursuant to the Agreement. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms part of the Clauses and must be completed and signed by the parties. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c): Access Control: Access to systems containing personal data are restricted to only those personnel possessing a valid business reason to do so and is secured with encrypted credentials.

Obligation after the termination of personal data. processing services 1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms part of the Clauses and must be completed and signed by the parties Name: hospital Name: Thibaut de Cours Position: Director, Chief Executive Officer Address: CardioScan Ltd Signature………………………………………. Signature………………………………………. The jurisdictions Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix The data Data exporter is: [TO BE COMPLETED] The data hospital Data importer is: BZ DISC, Inc is a wholly owned subsidiary of Third Iron, LLC which processes personal data on behalf of the data exporter strictly in accordance of the terms of the Agreement. CardioScan Ltd Data subjects The personal data transferred concern the following categories of data subjects: Authorized users patients/service users, whose data is being processed as part of library services affiliated with subscribing institutionthe review and delivery of the Services delivered under this Agreement. A limited amount of other data (e.g. names of other clinicians) may also be processed, including Customer staff name and contact details. Categories of data The personal data transferred concern the following categories of data: When users register for, download, access and otherwise use Third Iron, BZ DISC may collect patient demographic data. Customer staff contact information such as e-mail address, mailing address, name, physical address, IP data, login information, and mobile device identifier. details Special categories of data (if appropriate) The personal data transferred concern the following special categories of data: None heart monitor data, certain demographic information, clinical information about a patient. Processing operations The personal data transferred will be subject to the following basic processing activities: The objective the review and interpretation of Processing Personal Data by heart monitor data importer is the performance of Third Iron service pursuant and other information so as to the Agreement. Signature ______________________________ Name Xxxxxxx Xxxxxxx Title CEO Date Signed ____________________________ Signature ______________________________ Name _________________________________ Title __________________________________ Date Signed ____________________________ This Appendix forms diagnose illness or other medical conditions in a patient, as part of the Clauses and must be completed and signed by delivery of services under the partiesagreement, including delivery/collection of Equipment, allocation of a diagnostic to a service user, allocation of diagnostic to prescribing clinician. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c): Access ControlName: Access to systems containing personal data are restricted to only those personnel possessing a valid business reason to do so and is secured with encrypted credentialshospital Authorised signature………………………………………. Name: Thibaut de Cours Position: Director, Chief Executive Officer Address: CardioScan Ltd Authorised signature ……………………………………….