Common use of Obligations of the Contractor Clause in Contracts

Obligations of the Contractor. (1) The Contractor shall process Order Data only as instructed by the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data of the Customer, the Contractor will forward this request to the Customer without undue delay. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their area of responsibility, which includes Subcontractors according to Clause 9 of this Agreement, is carried out in accordance with the provisions of this Agreement. (3) Without prior consent from the Customer, the Contractor may not make copies or duplicates of the Order Data. However, this does not apply to copies, as far as they are necessary to ensure proper data processing and proper performance of the services in accordance with the Main Agreement (including backups). (4) The Contractor shall support the Customer regarding inspections by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsible. (5) The Contractor shall disclose to the Customer the contact details of the company data protection officer and the contact person for data protection issues arising under the Agreement. (6) The Contractor shall oblige the persons employed in the processing of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB). (7) The Contractor shall notify the Customer without undue delay of any disturbances and infringements of data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects concerned. (2) The Customer shall inform the Contractor immediately and in full if they find errors or irregularities regarding data protection provisions while examining the order results. (3) The Customer is responsible for the notification obligations resulting from Art. 33 and Art. 34

Obligations of the Contractor. (1) The Contractor shall process Order Data only as instructed by the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data of the Customer, the Contractor will forward this request to the Customer without undue delay. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their area of responsibility, which includes Subcontractors according to Clause 9 of this Agreement, is carried out in accordance with the provisions of this Agreement. (3) Without prior consent from the Customer, the Contractor may not make copies or duplicates of the Order Data. However, this does not apply to copies, as far as they are necessary to ensure proper data processing and proper performance of the services in accordance with the Main Agreement (including backups). (4) The Contractor shall support the Customer regarding inspections by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsible. (5) The Contractor shall disclose to the Customer the contact details of the company data protection officer and the contact person for data protection issues arising under the Agreement. (6) The Contractor shall oblige the persons employed in the processing of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB)GDPR. (7) The Contractor shall notify the Customer without undue delay of any disturbances and infringements of data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects concerned. (2) The Customer shall inform the Contractor immediately and in full if they find errors or irregularities regarding data protection provisions while examining the order results. (3) The Customer is responsible for the notification obligations resulting from Art. 33 and Art. 34

Obligations of the Contractor. (1) The Contractor shall process Order Data only as instructed by the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data of the Customer, the Contractor will forward this request to the Customer without undue delay. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their area of responsibility, which includes Subcontractors according to Clause 9 of this Agreement, is carried out in accordance with the provisions of this Agreement. (3) Without prior consent from the Customer, the Contractor may not make copies or duplicates of the Order Data. However, this does not apply to copies, as far as they are necessary to ensure proper data processing and proper performance of the services in accordance with the Main Agreement (including backups). (4) The Contractor shall support the Customer regarding inspections by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsible. (5) The Contractor shall disclose to the Customer the contact details of the company data protection officer and the contact person for data protection issues arising under the Agreement. (6) The Contractor shall oblige the persons employed in the processing of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB)GDPR. (7) The Contractor shall notify the Customer without undue delay of any disturbances and infringements of data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior instructions from the Customer.. sample (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects concerned. (2) The Customer shall inform the Contractor immediately and in full if they find errors or irregularities regarding data protection provisions while examining the order results. (3) The Customer is responsible for the notification obligations resulting from Art. 33 and Art. 34

Obligations of the Contractor. (1) The Contractor shall process Order processes Data only as instructed by exclusively within the framework of the agreements made and according to documented instructions of the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts unless the Contractor directly for the purpose of correcting is obligated to carry out different processing under individually applicable law (e.g., investigations by criminal prosecution authorities or deleting their data or requesting information about the stored data of the Customernational security authorities); in any such case, before processing, the Contractor will forward this request to shall inform the Customer without undue delayof these statutory requirements unless the statutory provisions in question prohibit such disclosure in order to protect an important public interest. The purpose, nature and extent of data processing shall be governed exclusively by the present Agreement and/or the Customer's instructions. (2) The Contractor shall ensure and regularly verify promptly inform the Customer if an instruction given by the Customer obviously violates statutory provisions. The Contractor is entitled to suspend implementation of the corresponding instruction until it is confirmed or amended by the Data Controller or by the Customer after review. If the Contractor can demonstrate that the carrying out a processing and use of data in their area of responsibility, which includes Subcontractors operation according to Clause 9 the Customer’s instructions would render the Contractor liable, the Contractor is entitled to refrain from further processing pending clarification of this Agreement, is carried out in accordance with the provisions of this Agreementliability between the Parties. (3) Without prior consent from the CustomerThe Data made available for processing shall not be used by Contractor for any other purposes, the Contractor may particularly not make Contractor’s own purposes. No copies or duplicates of the Order DataData shall be created without the Customer’s knowledge. However, Backup copies are excluded from this does not apply to copies, as far insofar as they are necessary to ensure proper orderly data processing and proper performance of the services in accordance processing, as well as Data that is necessary for compliance with the Main Agreement (including backups)statutory retention periods. (4) The Contractor shall support is not permitted to correct, delete, or limit the Customer regarding inspections processing of Data processed by commission autonomously, but only following documented instruction by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsibleCustomer. (5) The Within its area of responsibility, the Contractor shall disclose to design and monitor its internal organisation in such a way that it meets the Customer the contact details special requirements of the company data protection officer and the contact person for data protection issues arising under the Agreementprotection. (6) The Contractor shall oblige the persons employed in the maintain a list of all categories of processing activities carried out on behalf of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 which shall include all of the German Criminal Code (StGB)information necessary for a record of processing activities. (7) The Contractor shall notify Data processed for the Customer without undue delay shall be strictly separated from other databases. Physical separation is not absolutely necessary. (8) The data carriers originating from the Customer and/or used on behalf of any disturbances the Customer shall be marked separately. Their receipt and infringements of data protection provisions or the stipulations made in the order dispatch as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause their ongoing use shall be documented. (9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. ) The Contractor ensures that, if necessary, they will provide shall cooperate to the Customer necessary extent with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance complying with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects, the security of the processing, reporting of data protection violations, notification of data subjects concernedaffected by a violation of the protection, in necessary data protection impact assessments by the Customer as well as in necessary consultations with a supervisory authority, and reasonably support the Customer to the extent possible. (210) The Customer shall inform Processing Data outside of the Contractor immediately Contractor’s premises, for instance in employees’ home offices, is hereby permitted by the Customer. In such cases, the appropriate technical and in full if they find errors or irregularities regarding organisational data protection provisions while examining the order resultssecurity measures are taken. (311) The Contractor agrees to maintain confidentiality during processing of the Data as ordered. This duty shall continue in effect even after the end of this contractual relationship. The Contractor shall also comply with relevant confidentiality protection rules that the Customer is responsible subject to. (12) Prior to commencing the processing activities, the Contractor has familiarized the employees tasked with performing data processing and other persons working for the notification obligations resulting Contractor with the provisions of data protection relevant for them, and has obligated them in a suitable fashion to maintain confidentiality for the period of their activity as well as after termination of the employment relationship. The employees are prohibited from Artprocessing the Data outside of the Customer’s instructions unless the Contractor is obligated by law to carry out the processing. (13) A data protection officer has been appointed at the Contractor. 33 and Art. 34The current contact data has been published on the Contractor’s website in easily accessible form.

Obligations of the Contractor. (1) The Contractor shall process Order processes Data only as instructed by exclusively within the framework of the agreements made and according to documented instructions of the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts unless the Contractor directly for the purpose of correcting is obligated to carry out different processing under individually applicable law (e.g., investigations by criminal prosecution authorities or deleting their data or requesting information about the stored data of the Customernational security authorities); in any such case, before processing, the Contractor will forward this request to shall inform the Customer without undue delayof these statutory requirements unless the statutory provisions in question prohibit such disclosure in order to protect an important public interest. The purpose, nature and extent of data processing shall be governed exclusively by the present Agreement and/or the Customer's instructions. (2) The Contractor shall ensure and regularly verify promptly inform the Customer if an instruction given by the Customer obviously violates statutory provisions. The Contractor is entitled to suspend implementation of the corresponding instruction until it is confirmed or amended by the Data Controller or by the Customer after review. If the Contractor can demonstrate that the carrying out a processing and use of data in their area of responsibility, which includes Subcontractors operation according to Clause 9 the Customer’s instructions would render the Contractor liable, the Contractor is entitled to refrain from further processing pending clarification of this Agreement, is carried out in accordance with the provisions of this Agreementliability between the Parties. (3) Without prior consent from the CustomerThe Data made available for processing shall not be used by Contractor for any other purposes, the Contractor may particularly not make Contractor’s own purposes. No copies or duplicates of the Order DataData shall be created without the Customer’s knowledge. However, Backup copies are excluded from this does not apply to copies, as far insofar as they are necessary to ensure proper orderly data processing and proper performance of the services in accordance processing, as well as Data that is necessary for compliance with the Main Agreement (including backups)statutory retention periods. (4) The Contractor shall support is not permitted to correct, delete, or limit the Customer regarding inspections processing of Data processed by commission autonomously, but only following documented instruction by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsibleCustomer. (5) The Within its area of responsibility, the Contractor shall disclose to design and monitor its internal organisation in such a way that it meets the Customer the contact details special requirements of the company data protection officer and the contact person for data protection issues arising under the Agreementprotection. (6) The Contractor shall oblige the persons employed in the maintain a list of all categories of processing activities carried out on behalf of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 which shall include all of the German Criminal Code (StGB)information necessary for a record of processing activities. (7) The Contractor shall notify Data processed for the Customer without undue delay shall be strictly separated from other databases. Physical separation is not absolutely necessary. (8) The data carriers originating from the Customer and/or used on behalf of any disturbances the Customer shall be marked separately. Their receipt and infringements of data protection provisions or the stipulations made in the order dispatch as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause their ongoing use shall be documented. (9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. ) The Contractor ensures that, if necessary, they will provide shall cooperate to the Customer necessary extent with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance complying with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects, the security of the processing, reporting of data protection violations, notification of data subjects concernedaffected by a violation of the protection, in necessary data protection impact assessments by the Customer as well as in necessary consultations with a supervisory authority, and reasonably support the Customer to the extent possible. (210) The Customer Processing Data outside of the Contractor’s premises, for instance in employees’ home offices, is hereby permitted by the Customer. Insofar as the Data is processed in an employee's private residence, access to the residence shall inform be contractually agreed with the Contractor immediately employee, so as to guarantee the Contractor’s control rights and in full if they find errors or irregularities regarding data protection provisions while examining the order resultsany further necessary measures. (311) The Contractor agrees to maintain confidentiality during processing of the Data as ordered. This duty shall continue in effect even after the end of this contractual relationship. The Contractor shall also comply with relevant confidentiality protection rules that the Customer is responsible subject to. (12) Prior to commencing the processing activities, the Contractor has familiarized the employees tasked with performing data processing and other persons working for the notification obligations resulting Contractor with the provisions of data protection relevant for them, and has obligated them in a suitable fashion to maintain confidentiality for the period of their activity as well as after termination of the employment relationship. The employees are prohibited from Artprocessing the Data outside of the Customer’s instructions unless the Contractor is obligated by law to carry out the processing. (13) A data protection officer has been appointed at the Contractor. 33 and Art. 34The current contact data has been published on the Contractor’s website in easily accessible form.

Obligations of the Contractor. (1) . The Contractor shall process Order processes Data only as instructed by within the framework of the agreements made and according to documented instructions of the Customer unless the Contractor is obligated to carry out different processing under individually applicable laws and regulations (e.g., investigations by criminal prosecution authorities or national security authorities); in compliance with Clause 6 any such case, before processing, they shall inform the Customer of this Agreementthe requirements unless the statutory provisions in question prohibit such disclosure in order to protect an important public interest. 2. The Contractor shall correct promptly inform the Customer if an instruction given by them obviously violates statutory provisions. The Contractor is entitled to suspend implementation of the corresponding instruction until it is confirmed or delete Order Data amended by the data Controller or restrict by the Customer after review. If the Contractor can demonstrate that processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts 's instructions may lead to liability on the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data part of the CustomerContractor, the Contractor will forward this request shall be free to suspend further processing until the Customer without undue delayliability between the parties has been clarified. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their area of responsibility, which includes Subcontractors according to Clause 9 of this Agreement, is carried out in accordance with the provisions of this Agreement. (3) Without prior consent from the Customer, the Contractor may not make . No copies or duplicates of the Order DataData shall be created without the Customer’s knowledge. However, this This does not apply to backup copies, as far insofar as they are necessary to ensure proper data processing and proper performance of the services in accordance processing, or to Data for compliance with the Main Agreement (including backups)existing retention obligations. (4) The Contractor shall support the Customer regarding inspections by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses)not correct, unless the inspection is connected with a violation of data protection provisions delete or stipulations in this Agreement for which the Contractor is responsible. (5) The Contractor shall disclose to the Customer the contact details of the company data protection officer and the contact person for data protection issues arising under the Agreement. (6) The Contractor shall oblige the persons employed in restrict the processing of the Customer’s data to confidentiality Data without authorisation, but only in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB). (7) The Contractor shall notify the Customer without undue delay of any disturbances and infringements of data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior documented instructions from the Customer. (1) 5. Within its area of responsibility, they shall design and monitor its internal organisation in such a way that it meets the special requirements of data protection. 6. The Data is strictly separated from other databases. 7. The Contractor shall cooperate to the necessary extent with the Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of in complying with the rights of the data subjects, the security of the processing, reporting of data protection violations, notification of data subjects concernedaffected by a violation of the protection, in necessary data protection impact assessments by the Customer as well as in necessary consultations with a supervisory authority, and reasonably support the Customer to the extent possible. (2) 8. Processing Data outside of the Contractor’s premises, for instance in employees’ home offices, is hereby permitted by the Customer. In such cases, the appropriate technical and organisational data security measures are taken. 9. The Customer Contractor undertakes to maintain the confidentiality of the Data and to observe any relevant confidentiality rules incumbent on the Customer. This shall inform continue in effect even after the end of this contractual relationship. 10. Prior to commencing the processing activities, the Contractor immediately and in full if they find errors or irregularities regarding has familiarised their employees with the provisions of data protection provisions while examining relevant for them and has obligated them in a suitable fashion to maintain confidentiality for the order resultsperiod of their activity as well as after termination of the employment or other relationship. (3) 11. A data protection officer has been appointed at the Contractor. The Customer is responsible for contact Data has been published on the notification obligations resulting from Art. 33 and Art. 34Contractor’s website in easily accessible form.

Obligations of the Contractor. (1) The Contractor shall process Order Data only as instructed by the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data of the Customer, the Contractor will forward this request to the Customer without undue delay. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their area of responsibility, which includes Subcontractors according to Clause 9 of this Agreement, is carried out in accordance with the provisions of this Agreement. (3) Without prior consent from the Customer, the Contractor may not make copies or duplicates of the Order Data. However, this does not apply to copies, as far as they are necessary to ensure proper data processing and proper performance of the services in accordance with the Main Agreement (including backups). (4) The Contractor shall support the Customer regarding inspections by the supervisory authority within the scope of what is reasonable and necessary, insofar as these inspections relate to data processing by the Contractor. The Contractor may request reimbursement for the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsible. (5) The Contractor shall disclose to the Customer the contact details of the company data protection officer and the contact person for data protection issues arising under the Agreement. (6) The Contractor shall oblige the persons employed in the processing of the Customer’s data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB).GDPR. sample (7) The Contractor shall notify the Customer without undue delay of any disturbances and infringements of data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractor, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility of the commissioned data processing as well as for the protection of the rights of the data subjects concerned. (2) The Customer shall inform the Contractor immediately and in full if they find errors or irregularities regarding data protection provisions while examining the order results. (3) The Customer is responsible for the notification obligations resulting from Art. 33 and Art. 34

Obligations of the Contractor. (1) The Contractor shall may process Order Data only as instructed by the Customer and in compliance with Clause 6 of this Agreement. The Contractor shall correct or delete Order Data or restrict the processing of this data exclusively in accordance with the Customer’s instructions. If a data subject contacts the Contractor directly for the purpose of correcting or deleting their data or requesting information about the stored data of data subjects only within the Customer, scope of the Contractor will forward this request to order and the Customer without undue delayClient's instructions. (2) The Contractor shall ensure and regularly verify that the processing and use of data in their shall, within its area of responsibility, structure the internal organisation so that it meets the specific requirements of data protection. The Contractor will take technical and organisational measures to adequately protect the data of the Client, which includes Subcontractors according to Clause 9 meet the requirements of the General Data Protection Regulation (Art. 32 of the GDPR). Further regulations are contained in § 5 of this Agreement, is carried out in accordance with the provisions of this Agreementagreement. (3) Without prior consent from The Contractor shall inform the CustomerCustomer immediately if it becomes aware of any breaches of the Client's data protection. In this case, the Contractor may not make copies or duplicates may, intermittently and at its own discretion, take measures within its area of responsibility to protect the Order DataClient's data and to mitigate possible adverse consequences. However, this does not apply to copies, The Contractor shall inform the Client of any measures it has taken as far promptly as they are necessary to ensure proper data processing and proper performance of the services in accordance with the Main Agreement (including backups)possible. (4) The Contractor warrants that the employees involved in processing the Client's data and other persons working for the Contractor shall support not process the Customer regarding inspections by data other than instructed. Furthermore, the supervisory authority within Contractor warrants that the scope of what is reasonable and necessary, insofar as these inspections relate persons authorised to process the data processing by the Contractorhave been committed to confidentiality or are subject to an appropriate legally binding non- disclosure obligation. The Contractor may request reimbursement for confidentiality/non-disclosure obligation shall continue to apply even after termination of the demonstrable expenses and costs incurred by these support services (pure reimbursement of expenses), unless the inspection is connected with a violation of data protection provisions or stipulations in this Agreement for which the Contractor is responsibleorder. (5) The Contractor shall disclose to warrants compliance with the Customer requirements for the contact details written appointment of the company a data protection officer and shall inform the Client of the contact data on request. If the Contractor is not legally obliged to appoint a data protection officer, it shall inform the Client of the contact person for data protection issues arising under the Agreementthis agreement. (6) At the request of the Client, the Contractor shall assist the Client within the scope of what is reasonable in a) compliance with the Client's duties as regulated in Art. 32 to 36 GDPR; b) the fulfilment of inquiries and claims of data subjects pursuant to chapter III of the GDPR. The Contractor shall oblige may require reasonable compensation and reimbursement of expenses for such assistance, unless this is based on the persons employed in the processing of the Customer’s Contractor culpably breaching this agreement or applicable data to confidentiality in accordance with Art. 28 [3] [2] [b], 29, 32 [4] GDPR and secrecy in accordance with Section 203 of the German Criminal Code (StGB)protection law. (7) The Contractor shall notify In the Customer without undue delay event of any disturbances and infringements of a claim against the Client by a data protection provisions or the stipulations made in the order as well as of any suspected data protections violations or irregularities in the processing of personal data by the Contractorsubject, by the Contractor’s employees or a subcontractor employed in accordance with Clause 9. This shall apply in particular with regard to any notification obligations of the Customer pursuant to Art. 33 and Art. 34 GDPR. The Contractor ensures that, if necessary, they will provide the Customer with appropriate support in meeting their obligations claims under Art. 33 and 34 GDPR (Art. 28 [3] [2] [f] GDPR). The Contractor may only give notification for the Customer in accordance with Art. 33 or 34 GDPR upon prior instructions from the Customer. (1) The Customer is solely responsible for the assessment of admissibility 82 of the commissioned data processing as well as for the protection of the rights of the data subjects concerned. (2) The Customer shall inform GDPR, the Contractor immediately and undertakes, within its means, to support the Client in full if they find errors or irregularities regarding data protection provisions while examining defending the order resultsclaim. (3) The Customer is responsible for the notification obligations resulting from Art. 33 and Art. 34