Common use of PERSONAL DATA PROTECTION Clause in Contracts

PERSONAL DATA PROTECTION. 16.1 Customer acknowledges that in order for Kodak to provide the Services hereunder, Customer may provide Kodak with personal information. Customer represents and warrants that this personal information has been collected in accordance with applicable laws and that it has the authority to provide such data to Kodak. Kodak shall process the personal information as needed to provide the Services, in accordance with Customer’s instructions, or as required or permitted by law. 16.2 Each Party warrants that it shall comply at all times with its obligations under the local data privacy legislation applicable to it in any specific country (the “Privacy Laws”), including (without limitation) the EU General Data Protection Regulation and the California Consumer Privacy Act. For clarity, Customer (and its affiliates) act as data controllers (as that term may be defined in the Privacy Laws) and Kodak, its affiliates and subprocessors act as data processors. 16.3 Kodak shall at all times have implemented reasonable operational, technical and organizational measures to protect the personal information against accidental or unlawful destruction or alteration and unauthorized disclosure or access. Once per year upon request, Kodak will provide Customer with copies of any applicable Service Organizational Control (SOC) or other internal control reports that it has received. Customer understand that these internal control reports contain Confidential Information of Kodak. Customer shall not disclose the internal controls reports other than to its auditors and advisors in connection with verifying Kodak’s compliance with this section. 16.4 If Kodak becomes aware of a security breach (as defined in any applicable Privacy Law) that compromises the security, confidentiality or integrity of Customer’s personal information (an “Incident”), Kodak will take appropriate actions to contain, investigate and mitigate the Incident. As required by applicable Privacy Laws, Kodak will notify Customer without undue delay to enable Customer to expeditiously implement its response program. 16.5 Customer authorizes Kodak to use its affiliates, suppliers and subcontractors including for data processing, hosting and storage purposes, provided that Kodak remains responsible for the quality of the Services and the affiliates’, suppliers’ and subcontractors’ compliance with the Privacy Law as applied to data processors. Where required by Privacy Laws, Kodak has entered into agreements containing standard contractual clauses for the transfer of personal information to processors located in a third country with other Kodak Affiliates and subprocessors as needed to document their commitment to adequate protection of personal information and authorize the transfer. 16.6 To the extent required by the Privacy Laws, Kodak will (at Customer’s expense) (i) reasonably assist Customer with fulfilling any obligations to respond to requests for exercising data subject's rights, (ii) delete or return the personal information when no longer needed for the provision of Services, (iii) provide Customer with all information reasonably necessary to demonstrate compliance with the specified obligations, and reasonably allow for and contribute to audits, including inspections.

PERSONAL DATA PROTECTION. 16.1 21.1 Customer acknowledges that in order for Kodak to provide the Services hereunder, Customer may provide Kodak with personal information. Customer represents and warrants that this personal information has been collected in accordance with applicable laws and that it has the authority to provide such data to Kodak. Kodak shall process the personal information as needed to provide the Services, in accordance with Customer’s instructions, or as required or permitted by law. 16.2 21.2 Each Party warrants that it shall comply at all times with its obligations under the local data privacy legislation applicable to it in any specific country (the “Privacy Laws”), including (without limitation) the EU General Data Protection Regulation and the California Consumer Privacy Act. For clarity, Customer (and its affiliates) act as data controllers (as that term may be defined in the Privacy Laws) and Kodak, its affiliates and subprocessors act as data processors. 16.3 21.3 Kodak shall at all times have implemented reasonable operational, technical and organizational measures to protect the personal information against accidental or unlawful destruction or alteration and unauthorized disclosure or access. Once per year upon request, Kodak will provide Customer with copies of any applicable Service Organizational Control (SOC) or other internal control reports that it has received. Customer understand that these internal control reports contain Confidential Information of Kodak. Customer shall not disclose the internal controls reports other than to its auditors and advisors in connection with verifying Kodak’s compliance with this section. 16.4 21.4 If Kodak becomes aware of a security breach (as defined in any applicable Privacy Law) that compromises the security, confidentiality or integrity of Customer’s personal information (an “Incident”), Kodak will take appropriate actions to contain, investigate and mitigate the Incident. As required by applicable Privacy Laws, Kodak will notify Customer without undue delay to enable Customer to expeditiously implement its response program. 16.5 21.5 Customer authorizes Kodak to use its affiliates, suppliers and subcontractors including for data processing, hosting and storage purposes, provided that Kodak remains responsible for the quality of the Services and the affiliates’, suppliers’ and subcontractors’ compliance with the Privacy Law as applied to data processors. Where required by Privacy Laws, Kodak has entered into agreements containing standard contractual clauses for the transfer of personal information to processors located in a third country with other Kodak Affiliates and subprocessors as needed to document their commitment to adequate protection of personal information and authorize the transfer. 16.6 21.6 To the extent required by the Privacy Laws, Kodak will (at Customer’s expense) (i) reasonably assist Customer with fulfilling any obligations to respond to requests for exercising data subject's rights, (ii) delete or return the personal information when no longer needed for the provision of Services, (iii) provide Customer with all information reasonably necessary to demonstrate compliance with the specified obligations, and reasonably allow for and contribute to audits, including inspections.

PERSONAL DATA PROTECTION. 16.1 15.1 Customer acknowledges that in order for Kodak to provide the Support Services hereunder, Customer may provide Kodak with personal information. Customer represents and warrants that this personal information has been collected in accordance with applicable laws and that it has the authority to provide such data to Kodak. Kodak shall process the personal information as needed to provide the Support Services, in accordance with Customer’s instructions, or as required or permitted by law. 16.2 15.2 Each Party warrants that it shall comply at all times with its obligations under the local data privacy legislation applicable to it in any specific country (the “Privacy Laws”), including (without limitation) the EU General Data Protection Regulation and the California Consumer Privacy Act. For clarity, Customer (and its affiliates) act as data controllers (as that term may be defined in the Privacy Laws) and Kodak, its affiliates and subprocessors act as data processors. 16.3 15.3 Kodak shall at all times have implemented reasonable operational, technical and organizational measures to protect the personal information against accidental or unlawful destruction or alteration and unauthorized disclosure or access. Once per year upon request, Kodak will provide Customer with copies of any applicable Service Organizational Control (SOC) or other internal control reports that it has received. Customer understand that these internal control reports contain Confidential Information of Kodak. Customer shall not disclose the internal controls reports other than to its auditors and advisors in connection with verifying Kodak’s compliance with this section. 16.4 15.4 If Kodak becomes aware of a security breach (as defined in any applicable Privacy Law) that compromises the security, confidentiality or integrity of Customer’s personal information (an “Incident”), Kodak will take appropriate actions to contain, investigate and mitigate the Incident. As required by applicable Privacy Laws, Kodak will notify Customer without undue delay to enable Customer to expeditiously implement its response program. 16.5 15.5 Customer authorizes Kodak to use its affiliates, suppliers and subcontractors including for data processing, hosting and storage purposes, provided that Kodak remains responsible for the quality of the Support Services and the affiliates’, suppliers’ and subcontractors’ compliance with the Privacy Law as applied to data processors. Where required by Privacy Laws, Kodak has entered into agreements containing standard contractual clauses for the transfer of personal information to processors located in a third country with other Kodak Affiliates and subprocessors as needed to document their commitment to adequate protection of personal information and authorize the transfer. 16.6 15.6 To the extent required by the Privacy Laws, Kodak will (at Customer’s expense) (i) reasonably assist Customer with fulfilling any obligations to respond to requests for exercising data subject's rights, (ii) delete or return the personal information when no longer needed for the provision of Support Services, (iii) provide Customer with all information reasonably necessary to demonstrate compliance with the specified obligations, and reasonably allow for and contribute to audits, including inspections.