Common use of OTHER DATA PROCESSORS Clause in Contracts

OTHER DATA PROCESSORS. 6.1 Data Processor is not entitled to disclose, transfer or hand over Customer Personal Data to third parties or other data processors (sub-processors), other than to the sub- processors accepted pursuant to this Clause 6, unless such disclosure or handover is set out by mandatory law. 6.2 Data Controller acknowledges and agrees that Data Processor’s current sub-processors may be retained as sub-processors, and that Data Processor may change or engage new sub-processors in connection with the provisions of the Services. 6.3 Current list of sub-processors for the Services is identified in Annex 1, which include the identities of the sub-processors and their country of location. 6.4 Before transferring Customer Personal Data to a sub-processor, Data Processor must ensure that such sub-processor has executed a data processing agreement in which the sub-processor undertakes vis-à-vis Data Processor and Data Controller to be bound by back-to-back terms with respect to the contents of this Agreement. If applicable, Data Processor and sub-processors may have to enter into the EU standard contractual clauses for transfers to sub-processors in non-EU/EEA countries, and the Data Controller hereby gives the Data Processor the necessary power of attorney to conclude such standard contractual clauses on behalf of Data Controller. 6.5 Data Processor shall remain fully liable to Data Controller for the performance of the sub- processor's obligations. The fact that Data Controller has given consent to the Data Processor's use of sub-processors is without prejudice for the Data Processor’s duty to comply with the Agreement 6.6 Data Processor shall provide notification of a new sub-processor before authorizing a new sub-processor to process Customer Personal Data in connection with the provision of the applicable services. Data Controller may object to a new sub-processor by notifying Data Processor promptly in writing within ten (10) business days after receipt of Data Processor’s notice to the Data Controller, in accordance with Annex 1. In the event Data Controller objects to a new sub-processor, Data Processor will use reasonable efforts to make available to Data Controller change in the Services or recommend a commercially reasonable change to Data Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new sub-processor without unreasonably burdening the Data Controller. If Data Processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Data Controller may terminate the part of the Services which cannot be provided by Data Processor without the use of the objected-to new sub-processor by providing written notice to Data Processor. Data Processor will refund Data Controller any prepaid fees covering the remainder of the term of such part(s) following the effective date of termination with respect to such terminated Services.