Common use of Processing of Customer Personal Data Clause in Contracts

Processing of Customer Personal Data. 2.1. The Parties acknowledge that: (a) Crunchy Data acts as a Processor; and (b) Customer acts as the Controller. 2.2. Crunchy Data shall: (a) comply with the GDPR in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 2.9); and (ii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data to Process Customer Personal Data as necessary: (a) to provide the Services to Customer; and (b) to perform Crunchy Data’s obligations and exercise Crunchy Data’s rights under the Agreement. 2.5. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy Data’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.7. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party to this Data Processing Addendum. 2.8. Where Crunchy Data receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data shall inform Customer. 2.9. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPR; and (b) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data under the Agreement. 2.10. Notwithstanding anything to the contrary herein, Crunchy Data may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.11. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).

Processing of Customer Personal Data. 2.1. The In respect of Customer Personal Data, the Parties acknowledge that: (a) Crunchy Data Precisely acts as a Data Processor; and (b) Customer acts as the Data Controller. 2.2. Crunchy Data Precisely shall: (a) comply with the GDPR all applicable Data Protection Laws in Processing Customer Personal Data; and; (b) not Sell Customer Personal Data; (c) not Process Customer Personal Data other than: (i) for the specific business purpose of providing the Services; (ii) on Customer’s instructions (subject always to Paragraph 2.92.8); and (iiiii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data Precisely to Process Customer Personal Data as necessary:necessary:‌ (a) to provide the Services to Customer; and (b) to perform Crunchy DataPrecisely’s obligations and exercise Crunchy DataPrecisely’s rights under the Agreement. 2.52.4. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataPrecisely’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.62.5. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data Precisely from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR.Data Protection Laws.‌ 2.72.6. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.62.5) confers any right or imposes any obligation on any party Party to this Data Processing Addendum.Addendum.‌ 2.82.7. Where Crunchy Data Precisely receives an instruction from Customer that, in its reasonable opinion, infringes the GDPRData Protection Laws, Crunchy Data Precisely shall inform Customer. 2.92.8. Customer acknowledges and agrees that any instructions issued by Customer with regards to the any Processing of Customer Personal Data by or on behalf of Crunchy Precisely of Customer Personal Data pursuant to or in connection with the Agreement:Agreement:‌ (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) (without limitation to the generality of Paragraph 2.6) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data Precisely under the Agreement. 2.102.9. Notwithstanding anything to the contrary herein, Crunchy Data Precisely may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Precisely considers (in its reasonable discretion) that:that:‌ (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). For the avoidance of doubt, this Paragraph 2.9 does not refer to the instructions set out in Paragraph 2.3. 2.112.10. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data Precisely of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).

Processing of Customer Personal Data. 2.1. The In respect of Customer Personal Data, the Parties acknowledge that: (a) Crunchy Data Firefly acts as a Processor; and (b) Customer acts as the Controller. 2.2. Crunchy Data Firefly shall: (a) comply with the GDPR all applicable Data Protection Laws in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 2.92.7); and (ii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data Firefly to Process Customer Personal Data as necessary: (a) to provide the Services to Customer; and (b) to perform Crunchy DataFirefly ’s obligations and exercise Crunchy DataFirefly ’s rights under the Agreement. 2.52.4. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataFirefly’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.72.5. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party Party to this Data Processing Addendum. 2.82.6. Where Crunchy Data Firefly receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Firefly shall inform Customer. 2.92.7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Firefly pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) (without limitation to the generality of Paragraph 2.5) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data Firefly under the Agreement. 2.102.8. Notwithstanding anything to the contrary herein, Crunchy Data Firefly may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Firefly considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.112.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data Firefly of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing). 2.10. Customer will indemnify and hold harmless Firefly and its employees, officers, directors and agents from and against any and all liabilities, losses, damages, costs, fines and other expenses (including legal costs and fees) arising from or relating to any breach by Customer of Paragraph 2.10. Any and all limitations on liability set out in the Agreement shall not apply to liability arising under or in connection with the indemnity set out in this Paragraph 2.10.

Processing of Customer Personal Data. 2.1. The In respect of Customer Personal Data, the Parties acknowledge that: (a) Crunchy Data Firefly acts as a Processor; and (b) Customer acts as the Controller. 2.2. Crunchy Data Firefly shall: (a) comply with the GDPR all applicable Data Protection Laws in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 2.92.7); and (ii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data Firefly to Process Customer Personal Data as necessary: (a) to provide the Services to Customer; and (b) to perform Crunchy DataFirefly ’s obligations and exercise Crunchy DataFirefly’s rights under the Agreement. 2.52.4. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataFirefly’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.72.5. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party Party to this Data Processing Addendum. 2.82.6. Where Crunchy Data Firefly receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Firefly shall inform Customer. 2.92.7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Firefly pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) (without limitation to the generality of Paragraph 2.5) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data Firefly under the Agreement. 2.102.8. Notwithstanding anything to the contrary herein, Crunchy Data Firefly may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Firefly considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.112.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data Firefly of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing). 2.10. Customer will indemnify and hold harmless Firefly and its employees, officers, directors and agents from and against any and all liabilities, losses, damages, costs, fines and other expenses (including legal costs and fees) arising from or relating to any breach by Customer of Paragraph 2.9. Any and all limitations on liability set out in the Agreement shall not apply to liability arising under or in connection with the indemnity set out in this Paragraph 2.10.

Processing of Customer Personal Data. 2.13.1. The In respect of Customer Personal Data, the Parties acknowledge that:that (as between the Parties): (a) Crunchy Data Bottomline acts as a Processor; and (b) Customer acts as the Controller. 2.23.2. Crunchy Data shall: (a) comply with the GDPR in Processing Customer Personal Data; and (b) Bottomline shall not Process Customer Personal Data other than: (ia) on Customer’s instructions (subject always to Paragraph 2.9Section 3.7); and (iib) as required by applicable laws. 2.33.3. To the extent permitted by applicable laws, Crunchy Data Bottomline shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(iiSection 3.2(b); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.43.4. Customer instructs Crunchy Data Bottomline to Process Customer Personal Data as necessary: (a) to provide the Relevant Services to Customer; and (b) to perform Crunchy DataBottomline’s obligations and exercise Crunchy DataBottomline’s rights under the Agreement. 2.53.5. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataBottomline’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.7. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party to this Data Processing Addendum. 2.83.6. Where Crunchy Data Bottomline receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Bottomline shall inform Customer. 2.93.7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Bottomline pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) shall not relate to the scope of, or otherwise materially change, the Relevant Services to be provided by Crunchy Data Bottomline under the Agreement. 2.103.8. Notwithstanding anything to the contrary herein, Crunchy Data Bottomline may without liability to either party and with immediate effect terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Bottomline considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.113.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and : (where applicablea) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicablewhether under Articles 6, 9 and/or 10 of the GDPR or otherwise as required under Data Protection Laws) condition for the Processing by Crunchy Data Bottomline of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing); and (b) where applicable, Customer has been instructed by, and obtained the valid and effective authorisation of, any relevant third party Controller(s) (including, for these purposes, Customer Affiliates) to instruct Bottomline (and its Subprocessors) to Process Customer Personal Data as set out in and contemplated by this Data Processing Addendum and the Agreement.

Processing of Customer Personal Data. 2.1. The In respect of Customer Personal Data, the Parties acknowledge that: (a) Crunchy Data Receipt Bank acts as a Data Processor; and (b) Customer acts as the Data Controller. 2.2. Crunchy Data Receipt Bank shall: (a) comply with the GDPR all applicable Data Protection Laws in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 2.92.8); and (ii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data Receipt Bank to Process Customer Personal Data as necessary: (a) to provide the Services to Customer; and (b) to perform Crunchy DataReceipt Bank’s obligations and exercise Crunchy DataReceipt Bank’s rights under the Agreement. 2.52.4. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataReceipt Bank’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.62.5. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data Receipt Bank from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPRData Protection Laws. 2.72.6. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.62.5) confers any right or imposes any obligation on any party Party to this Data Processing Addendum. 2.82.7. Where Crunchy Data Receipt Bank receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Receipt Bank shall inform Customer. 2.92.8. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Receipt Bank pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) (without limitation to the generality of Paragraph 2.6) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data Receipt Bank under the Agreement. 2.102.9. Notwithstanding anything to the contrary herein, Crunchy Data Receipt Bank may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Receipt Bank considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.112.10. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data Receipt Bank of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).

Processing of Customer Personal Data. 2.13.1. The In respect of Customer Personal Data, the Parties acknowledge that:that (as between the Parties): (a) Crunchy Data Bottomline acts as a Processor; and (b) Customer acts as the Controller. 2.23.2. Crunchy Data shall: (a) comply with the GDPR in Processing Customer Personal Data; and (b) Bottomline shall not Process Customer Personal Data other than: (ia) on Customer’s instructions (subject always to Paragraph 2.9Section 3.7); andor (iib) as required by applicable lawsData Protection Laws. 2.33.3. To the extent permitted by applicable laws, Crunchy Data Bottomline shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(iiSection 3.2(b); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.43.4. Customer instructs Crunchy Data Bottomline to Process Customer Personal Data as necessary: (a) to provide the Relevant Services to Customer; and (b) to perform Crunchy DataBottomline’s obligations and exercise Crunchy DataBottomline’s rights under the Agreement. 2.53.5. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataBottomline’s Processing of Customer Personal Data as required by Article 28(3) of the GDPRData. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.7. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party to this Data Processing Addendum. 2.83.6. Where Crunchy Data Bottomline receives an instruction from Customer that, in its reasonable opinion, infringes the GDPRData Protection Laws, Crunchy Data Bottomline shall inform Customer. 2.93.7. Customer acknowledges and agrees that any instructions additional to those set out in this Data Processing Addendum or the Agreement issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Bottomline pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) shall not relate to the scope of, or otherwise materially change, the Relevant Services to be provided by Crunchy Data Bottomline under the Agreement. 2.103.8. Notwithstanding anything to the contrary herein, Crunchy Data Bottomline may without liability to Customer and with immediate effect terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Bottomline considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise)., 2.113.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and : (where applicablea) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicableas required under Data Protection Laws) condition for the Processing by Crunchy Data Bottomline of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing); and (b) where applicable, Customer has been instructed by, and obtained the valid and effective authorisation of, any relevant third party Controller(s) (including, for these purposes, Customer Affiliates) to instruct Bottomline (and its Subprocessors that are approved subject to and in accordance with Section 6) to Process Customer Personal Data as set out in and contemplated by this Data Processing Addendum and the Agreement.

Processing of Customer Personal Data. 2.13.1. The In respect of Customer Personal Data, the Parties acknowledge that:that (as between the Parties): (a) Crunchy Data Bottomline acts as a Processor; and (b) Customer acts as the Controller. 2.23.2. Crunchy Data shall: (a) comply with the GDPR in Processing Customer Personal Data; and (b) Bottomline shall not Process Customer Personal Data other than: (ia) on Customer’s instructions (subject always to Paragraph 2.9Section 3.7); and (iib) as required by applicable laws. 2.33.3. To the extent permitted by applicable laws, Crunchy Data Bottomline shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(iiSection 3.2(b); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.43.4. Customer instructs Crunchy Data Bottomline to Process Customer Personal Data as necessary: (a) to provide the Relevant Services to Customer; and (b) to perform Crunchy DataBottomline’s obligations and exercise Crunchy DataBottomline’s rights under the Agreement. 2.53.5. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataBottomline’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.7. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party to this Data Processing Addendum. 2.83.6. Where Crunchy Data Bottomline receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Bottomline shall inform Customer. 2.93.7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Bottomline pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) shall not relate to the scope of, or otherwise materially change, the Relevant Services to be provided by Crunchy Data Bottomline under the Agreement. 2.103.8. Notwithstanding anything to the contrary herein, Crunchy Data Bottomline may without liability to Customer and with immediate effect terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Bottomline considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise)., 2.113.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and : (where applicablea) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicablewhether under Articles 6, 9 and/or 10 of the GDPR or otherwise as required under Data Protection Laws) condition for the Processing by Crunchy Data Bottomline of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing); and (b) where applicable, Customer has been instructed by, and obtained the valid and effective authorisation of, any relevant third party Controller(s) (including, for these purposes, Customer Affiliates) to instruct Bottomline (and its Subprocessors that are approved subject to and in accordance with Section 6) to Process Customer Personal Data as set out in and contemplated by this Data Processing Addendum and the Agreement.

Processing of Customer Personal Data. 2.13.1. The In respect of Customer Personal Data, the Parties acknowledge that:that (as between the Parties): (a) Crunchy Data Bottomline acts as a Processor; and (b) Customer acts as the Controller. 2.23.2. Crunchy Data shall: (a) comply with the GDPR in Processing Customer Personal Data; and (b) Bottomline shall not Process Customer Personal Data other than: (ia) on Customer’s instructions (subject always to Paragraph 2.9Section 3.7); and (iib) as required by applicable laws.laws.‌ 2.33.3. To the extent permitted by applicable laws, Crunchy Data Bottomline shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(iiSection 3.2(b); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.43.4. Customer instructs Crunchy Data Bottomline to Process Customer Personal Data as necessary: (a) to provide the Relevant Services to Customer; and (b) to perform Crunchy DataBottomline’s obligations and exercise Crunchy DataBottomline’s rights under the Agreement. 2.53.5. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataBottomline’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.6. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPR. 2.7. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party to this Data Processing Addendum. 2.83.6. Where Crunchy Data Bottomline receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Bottomline shall inform Customer. 2.93.7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Bottomline pursuant to or in connection with the Agreement:Agreement:‌ (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRData Protection Laws; and (b) shall not relate to the scope of, or otherwise materially change, the Relevant Services to be provided by Crunchy Data Bottomline under the Agreement. 2.103.8. Notwithstanding anything to the contrary herein, Crunchy Data Bottomline may without liability to either party and with immediate effect terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Bottomline considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.113.9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and : (where applicablea) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicablewhether under Articles 6, 9 and/or 10 of the GDPR or otherwise as required under Data Protection Laws) condition for the Processing by Crunchy Data Bottomline of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing); and (b) where applicable, Customer has been instructed by, and obtained the valid and effective authorisation of, any relevant third party Controller(s) (including, for these purposes, Customer Affiliates) to instruct Bottomline (and its Subprocessors) to Process Customer Personal Data as set out in and contemplated by this Data Processing Addendum and the Agreement.

Processing of Customer Personal Data. 2.1. The In respect of Customer Personal Data, the Parties acknowledge that: (a) Crunchy Data Supplier acts as a ProcessorData Processor or “service provider” as defined under the CCPA; and (b) Customer acts as the ControllerData Controller or “business” as defined under the CCPA. 2.2. Crunchy Data Supplier shall: (a) comply with the GDPR all applicable Data Protection Laws in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 2.9); and (ii) as required by applicable laws. 2.3. To the extent permitted by applicable laws, Crunchy Data shall inform Customer of: (a) any Processing to be carried out under Paragraph 2.2(b)(ii); and (b) the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Customer Personal Data. 2.4. Customer instructs Crunchy Data Supplier to Process Customer Personal Data as necessary: (a) to provide the Services to Customer; and; (b) to perform Crunchy DataSupplier’s obligations and exercise Crunchy DataSupplier’s rights or defend legal claims under the Agreement; and (c) for the proper management and administration of Supplier’s business. 2.52.4. Annex 1 (Data Processing Details) sets out certain information regarding Crunchy DataSupplier’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR. 2.62.5. Customer may amend Annex 1 (Data Processing Details) on written notice to Crunchy Data Supplier from time to time as Customer reasonably considers necessary to meet any applicable requirements of the GDPRData Protection Laws. 2.72.6. Nothing in Annex 1 (Data Processing Details) (including as amended pursuant to Paragraph 2.6) confers any right or imposes any obligation on any party Party to this Data Processing Addendum. 2.82.7. Where Crunchy Data Supplier receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crunchy Data Supplier shall inform Customer. 2.92.8. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Crunchy Data Supplier pursuant to or in connection with the Agreement: (a) shall be strictly required for the sole purpose of ensuring compliance with the GDPRapplicable Data Protection Laws; and (b) (without limitation to the generality of Paragraph 2.7) shall not relate to the scope of, or otherwise materially change, the Services to be provided by Crunchy Data Supplier under the Agreement. 2.102.9. Notwithstanding anything to the contrary herein, Crunchy Data Supplier may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Crunchy Data Supplier considers (in its reasonable discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities; and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise). 2.11(c) For the avoidance of doubt, this Paragraph 2.9 does not refer to the instructions set out in Paragraph 2.3. 2.10. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Crunchy Data Supplier of Customer Personal Data in accordance with this Data Processing Addendum and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).