Common use of OBLIGATIONS OF THE DATA IMPORTER Clause in Contracts

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational security measures specified in Annex B before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its the data exporter’s instructions and the Clausesclauses; if it the data importer cannot provide such compliance for whatever reasonsreason, it the data importer agrees to inform promptly inform, promptly, the data exporter of its the data importer’s inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it he has no reason to believe that the legislation applicable to it prevents it himprevents him from fulfilling the instructions received from the data exporter and its obligations his obligation under the contract and that in the event of a change in this that legislation which is likely to have a substantial adverse effect on the warranties and obligations guarantees provided by the Clauses, it he will promptly notify the change to the data exporter as soon as it he is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it the data importer has implemented the technical and organizational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) to process the personal data in accordance with the mandatory data protection principles set out in Chapter III of this Attachment A; (e) to deal promptly and properly with all reasonable inquiries from the data exporter or the data subject relating to this processing of the personal data subject to the transfer and to cooperate with the competent supervisory authority in the course of all its inquiries and abide by the advice of the supervisory authority with regard to the processing of the data transferred; MASTER SERVICES AGREEMENT SCHEDULE M – NSA COMPLIANCE REQUIREMENTS (f) at the request of the data exporter to submit its data processing facilities for audit which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications, selected by the data exporter, where applicable, in agreement with the supervisory authority; and (g) to make available to the Data Subject, upon request, a copy of the Clauses set out in this Attachment A and indicate the office which handles complaints; (h) that it will the data importer shall promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized access; and (iii) any request received directly from the data subjects without responding to that request, unless it the data importer has been otherwise authorized to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. 5.1 The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrantswarrants that: (a) to it will only process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; these Data Transfer Terms and if it cannot provide comply with such compliance instructions for whatever reasonsreason, it agrees to inform promptly the data exporter of its inability to complyexporter, in which case case, the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clausesthese Data Transfer Terms, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex Annexure B before processing the personal data transferred; (d) that it will promptly notify the data exporter aboutregarding: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law laws to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to it will deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to it will submit its data processing facilities for audit of the processing activities covered by the Clauses these Data Transfer Terms which shall will be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to it will make available to the data subject upon request a copy of the Clausesthese Data Transfer Terms, or any existing contract for sub-sub- processing, unless these Data Transfer Terms or the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex Annexure B which shall must be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause clause 11; and (j) to it will promptly send promptly a copy of any sub-processor agreement it concludes under the Clauses these Data Transfer Terms to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 of Schedule 1 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;, (ii) any accidental or unauthorized unauthorised access; , and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-sub- processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 of Schedule 1 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) : a to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) ; b that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) ; c that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 of Schedule 2 before processing the personal data transferred; (d) ; d that it will promptly notify the data exporter about: (i) : i any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) , ii any accidental or unauthorized unauthorised access; and (iii) , and iii any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) ; e to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) ; f at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) ; g to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 of Schedule 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) ; h that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) ; i that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) j to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data data- processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processingsubprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor subprocessor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor subprocessor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;contract;‌ (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;contract;‌ (c) that it has implemented the technical and organizational organisational security measures specified in Annex B before processing the personal data transferred;transferred;‌ (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;transferred;‌ (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;exporter;‌ (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.exporter.‌

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;it (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data Personal Data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational security measures specified in Annex B Appendix 2 before processing the personal data Personal Data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data Personal Data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and11 (Sub-processing); (j) to send promptly a copy of any sub-processor Subprocessor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its his instructions and the Clausesclauses; if it he cannot provide such compliance for whatever reasons, it he agrees to inform promptly the data exporter of its his inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has they have no reason to believe that the legislation applicable to it him prevents it them from fulfilling the instructions PORTIONS OF THIS EXHIBIT WERE OMITTED AND HAVE BEEN FILED SEPARATELY WITH THE SECRETARY OF THE COMMISSION PURSUANT TO AN APPLICATION FOR CONFIDENTIAL TREATMENT UNDER RULE 406 OF THE SECURITIES ACT; [***] DENOTES OMISSIONS. IN CONFIDENCE received from the data exporter and its his obligations under the contract Contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it they will promptly notify the change to the data exporter as soon as it is they are aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has they have implemented the technical and organizational organisational security measures specified in Annex Appendix B before processing the personal data transferred; (d) that it will they shall promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it he has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its his processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its his data processing facilities for audit of the processing activities covered by the Clauses clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, set out in which case it may remove such commercial informationthis Annex, with the exception of Annex Appendix B PORTIONS OF THIS EXHIBIT WERE OMITTED AND HAVE BEEN FILED SEPARATELY WITH THE SECRETARY OF THE COMMISSION PURSUANT TO AN APPLICATION FOR CONFIDENTIAL TREATMENT UNDER RULE 406 OF THE SECURITIES ACT; [***] DENOTES OMISSIONS. IN CONFIDENCE which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its his instructions and the Clausesclauses; if it he cannot provide such compliance for whatever reasons, it he agrees to inform promptly the data exporter of its his inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it he has no reason to believe that the legislation applicable to it him prevents it him from fulfilling the instructions received from the data exporter and its his obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it he will promptly notify the change to the data exporter as soon as it he is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it he has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will he shall promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;; PORTIONS OF THIS EXHIBIT WERE OMITTED AND HAVE BEEN FILED SEPARATELY WITH THE SECRETARY OF THE COMMISSION PURSUANT TO AN APPLICATION FOR CONFIDENTIAL TREATMENT UNDER RULE 406 OF THE SECURITIES ACT; [***] DENOTES OMISSIONS. (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it he has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its his processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its his data processing facilities for audit of the processing activities covered by the Clauses clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, set out in which case it may remove such commercial informationthis Annex, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its his instructions and the Clausesclauses; if it he cannot provide such compliance for whatever reasons, it he agrees to inform promptly the data exporter of its his inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it he has no reason to believe that the legislation applicable to it him prevents it him from fulfilling the instructions received from the data exporter and its his obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it he will promptly notify the change to the data exporter as soon as it he is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it he has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will he shall promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it he has been otherwise authorized authorised to do so;; PORTIONS OF THIS EXHIBIT WERE OMITTED AND HAVE BEEN FILED SEPARATELY WITH THE SECRETARY OF THE COMMISSION PURSUANT TO AN APPLICATION FOR CONFIDENTIAL TREATMENT UNDER RULE 406 OF THE SECURITIES ACT; [***] DENOTES OMISSIONS. (e) to deal promptly and properly with all inquiries from the data exporter relating to its his processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its his data processing facilities for audit of the processing activities covered by the Clauses clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, set out in which case it may remove such commercial informationthis Annex, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in the relevant Annex B 2 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-sub- processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer agrees and warrants:– (a) to process Process the personal data Personal Data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasonsreason, it agrees to inform the Data Exporter promptly the data exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data Data and/or terminate the contractterminatethe Clauses; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event existence of a change in this legislation which is likely to any non-Abu Dhabi Global Market laws that would have a substantial adverse effect on the warranties and obligations provided by the enforceability of these Clauses, and it will promptly notify inform the change Data Exporter (which will pass such notification on to the data exporter as soon as Registrar where required) if it is aware, becomes aware of any such laws or any changes in such laws which case the data exporter is entitled to suspend the transfer of data and/or terminate the contracthave such a substantial adverse effect; (c) that it has implemented the technical and organizational security organisational measures specified in Annex B before processing Processing the personal data Personal Data transferred; (d) that it will promptly notify the data exporter Data Exporter about:– (i) any legally binding request for disclosure of the personal data Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under the criminal law of any jurisdiction outside the Abu Dhabi Global Market to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects Data Subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing Processing of the personal data Personal Data subject to the transfer and to abide by the advice of the supervisory authority Registrar with regard to the processing Processing of the data Data transferred; (f) at the request of the data exporter Data Exporter to submit its data processing Data Processing facilities for audit of the processing Processing activities covered by the Clauses which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authorityRegistrar; (g) to make available to the data subject Data Subject upon request a copy of the Clauses, or any existing contract for sub-processingsubprocessing, unless the Clauses or contract contain commercial information, in which case it may remove redact such commercial information, with the exception of Annex B which shall minimally be replaced by a summary description of the security measures in those cases where the data subject Data Subject is unable to obtain a copy from the data exporterData Exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; (i) that the processing Processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor Subprocessor agreement it concludes under the Clauses to the data exporterData Exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11clause (Standard Contractual Clauses)11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer hereby agrees and warrants: (a) to process the personal data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter Data Exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter Data Exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter Data Exporter as soon as it is aware, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will shall promptly notify the data exporter Data Exporter about: (i) any legally binding request for of disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter Data Exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processingsubprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporterData Exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; (i) that the processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and10; (j) to send promptly a copy of any sub-processor Subprocessor agreement it concludes under the Clauses to the data exporterData Exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer agrees and warrants: (a) 5.1 to process the personal data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter Data Exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) 5.2 that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter Data Exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter Data Exporter as soon as it is aware, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) 5.3 that it has implemented the technical and organizational organisational security measures specified in Annex Appendix B before processing the personal data transferred; (d) 5.4 that it will promptly notify the data exporter Data Exporter about: (i) 5.4.1 any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) 5.4.2 any accidental or unauthorized unauthorised access; and (iii) 5.4.3 any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) 5.5 to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) 5.6 at the request of the data exporter Data Exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authority; (g) 5.7 to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex Appendix B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporterData Exporter; (h) 5.8 that, in the event of sub-processing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; (i) 5.9 that the processing services by the sub-processor will be carried out in accordance with Clause 11; and (j) 5.10 to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporterData Exporter.

OBLIGATIONS OF THE DATA IMPORTER. a. The data importer agrees and warrants: (a) i. to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) ii. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) iii. that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) iv. that it will promptly notify the data exporter about: (i) 1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) 2. any accidental or unauthorized unauthorised access; and (iii) 3. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) v. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) vi. at the request of the data exporter to submit its data data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) vii. to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) viii. that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) ix. that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) x. to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) : to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or and/ or terminate the contract; (b) ; that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) ; that it has implemented the technical and organizational organisational security measures specified in Annex B before processing the personal data transferred; (d) ; that it will promptly notify the data exporter about: (i) : any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) ; any accidental or unauthorized unauthorised access; and (iii) and any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) ; to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) ; at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) ; to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-sub- processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) ; that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) ; that the processing services by the sub-processor will be carried out in accordance with Clause clause 11; and (j) and to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. 5.1 The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B before Appnedix 2before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 of Schedule 2 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;, (ii) any accidental or unauthorized unauthorised access; , and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;the (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 of Schedule 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) i. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) . any accidental or unauthorized unauthorised access; and (iii) . any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer hereby agrees and warrants: (a) to process the personal data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter Data Exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter Data Exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter Data Exporter as soon as it is aware, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing the personal data transferred; (d) that it will shall promptly notify the data exporter Data Exporter about: (i) any legally binding request for of disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter Data Exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processingsubprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporterData Exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; ; (i) that the processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.10;

OBLIGATIONS OF THE DATA IMPORTER. The data importer agrees and warrants: (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B the Data Processing Addendum before processing the personal data transferred; (d) that it will promptly notify the data exporter about: (i) i. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) . any accidental or unauthorized unauthorised access; and (iii) . any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; (f) at the request of the data exporter to submit its data data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent; (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11; and; (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer agrees and warrants:– (a) to process Process the personal data Personal Data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasonsreason, it agrees to inform the Data Exporter promptly the data exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data Data and/or terminate the contractClauses; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event existence of a change in this legislation which is likely to any non‐Abu Dhabi Global Market laws that would have a substantial adverse effect on the warranties and obligations provided by the enforceability of these Clauses, and it will promptly notify inform the change Data Exporter (which will pass such notification on to the data exporter as soon as Registrar where required) if it is aware, becomes aware of any such laws or any changes in such laws which case the data exporter is entitled to suspend the transfer of data and/or terminate the contracthave such a substantial adverse effect; (c) that it has implemented the technical and organizational security organisational measures specified in Annex B before processing Processing the personal data Personal Data transferred; (d) that it will promptly notify the data exporter Data Exporter about:– (i) any legally binding request for disclosure of the personal data Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under the criminal law of any jurisdiction outside the Abu Dhabi Global Market to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects Data Subjects without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing Processing of the personal data Personal Data subject to the transfer and to abide by the advice of the supervisory authority Registrar with regard to the processing Processing of the data Data transferred; (f) at the request of the data exporter Data Exporter to submit its data processing Data Processing facilities for audit of the processing Processing activities covered by the Clauses which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authorityRegistrar; (g) to make available to the data subject Data Subject upon request a copy of the Clauses, or any existing contract for sub-processingsubprocessing, unless the Clauses or contract contain commercial information, in which case it may remove redact such commercial information, with the exception of Annex B which shall minimally be replaced by a summary description of the security measures in those cases where the data subject Data Subject is unable to obtain a copy from the data exporterData Exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; (i) that the processing Processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor Subprocessor agreement it concludes under the Clauses to the data exporterData Exporter.

OBLIGATIONS OF THE DATA IMPORTER. The data importer Data Importer agrees and warrants: (a) to process Process the personal data Personal Data only on behalf of the data exporter Data Exporter and in compliance with its instructions and the Clausesthis Exhibit; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter Data Exporter of its inability to comply, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contractAgreement; (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter Data Exporter and its obligations under the contract Agreement and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clausesthis Exhibit, it will promptly notify the change to the data exporter Data Exporter as soon as it is aware, in which case the data exporter Data Exporter is entitled to suspend the transfer of data and/or terminate the contractAgreement; (c) that it has implemented the technical and organizational organisational security measures specified in Annex B Appendix 2 before processing Processing the personal data Personal Data transferred; (d) that it will promptly notify the data exporter Data Exporter about: (i) any legally binding request for disclosure of the personal data Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; (ii) any accidental or unauthorized unauthorised access; and (iii) any request received directly from the data subjects a Data Subject without responding to that request, unless it has been otherwise authorized authorised to do so; (e) to deal promptly and properly with all inquiries from the data exporter Data Exporter relating to its processing Processing of the personal data Personal Data subject to the transfer and to abide by the advice of the supervisory authority Supervisory Authority with regard to the processing Processing of the data transferred; (f) at the request of the data exporter Data Exporter to submit its data processing Processing facilities for audit of the processing Processing activities covered by the Clauses this Exhibit which shall be carried out by the data exporter Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporterData Exporter, where applicable, in agreement with the supervisory authoritySupervisory Authority; (g) to make available to the data subject Data Subject upon request a copy of the Clausesthis Exhibit, or any existing contract for sub-processingsubprocessing, unless this Exhibit or the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex B Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject Data Subject is unable to obtain a copy from the data exporterData Exporter; (h) that, in the event of sub-processingsubprocessing, it has previously informed the data exporter Data Exporter and obtained its prior written consent; (i) that the processing Processing services by the sub-processor Subprocessor will be carried out in accordance with Clause 11; and (j) to send promptly a copy of any sub-processor Subprocessor agreement it concludes under the Clauses this Exhibit to the data exporterData Exporter.