Common use of Processing of Subscriber Personal Data Clause in Contracts

Processing of Subscriber Personal Data. 3.1 eMudhra and each eMudhra Affiliate shall: 3.1.1 comply with all applicable Data Protection Laws in the Processing of Subscriber Personal Data; and 3.1.2 not Process Subscriber Personal Data other than on the relevant Subscriber Group Member’s instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case eMudhra or the relevant eMudhra Affiliate shall to the extent permitted by Applicable Laws inform the relevant Subscriber Group Member of that legal requirement before the relevant Processing of that Personal Data. The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be under instructions from such subscriber group members.. 3.2 Each Subscriber Group Member: 3.2.1 instructs eMudhra and each eMudhra Affiliate (and authorises eMudhra and each eMudhra Affiliate to instruct each Subprocessor) to: 3.2.1.1 Process Subscriber Personal Data; and 3.2.1.2 in particular, transfer Subscriber Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement; and The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be uinstructions under Section 3.2.1from such subscriber group members. 3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 3.2.1 on behalf of each relevant Subscriber Affiliate. 3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Subscriber Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Subscriber may make reasonable amendments to Annex 1 by written notice to eMudhra from time to time as Subscriber reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right or imposes any obligation on any party to this Addendum. eMudhra and each eMudhra Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Subscriber Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Subscriber Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Processing of Subscriber Personal Data. 3.1 eMudhra Text Recruit and each eMudhra Text Recruit Affiliate shall: 3.1.1 comply with all applicable Data Protection Laws in the Processing of Subscriber Personal Data; and 3.1.2 not Process and Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Subscriber Personal Data other than on (e.g., via email), where such instructions are consistent with the relevant Subscriber Group Member’s instructions terms of the Subscription Agreement, unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case eMudhra Text Recruit or the relevant eMudhra Text Recruit Affiliate shall to the extent permitted by Applicable Laws inform the relevant Subscriber Group Member of that legal requirement before the relevant Processing of that Subscriber Personal Data. The usage parties agree that for the purpose of Clause 5(a) of the Standard Contractual Clauses, if in effect between the parties, the Processing of Subscriber Personal Data by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be Text Recruit is deemed to be under in compliance with Subscriber’s instructions from such subscriber group members..if expressly authorized by the Agreement. 3.2 Each Subscriber Group Member: 3.2.1 instructs eMudhra Text Recruit and each eMudhra Text Recruit Affiliate (and authorises eMudhra authorizes Text Recruit and each eMudhra Text Recruit Affiliate to instruct each Subprocessor) to: 3.2.1.1 Process Subscriber Personal Data; and 3.2.1.2 in particular, transfer Subscriber Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Subscription Agreement; and The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be uinstructions under Section 3.2.1from such subscriber group members.and 3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised authorized to give the instruction set out in section 3.2.1 on behalf of each relevant Subscriber Affiliate. 3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Subscriber Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Subscriber may make reasonable amendments to Annex 1 by written notice to eMudhra Text Recruit from time to time as Subscriber reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section Section 3.3) confers any right or imposes any obligation on any party to this Addendum. eMudhra and each eMudhra Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Subscriber Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Subscriber Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Processing of Subscriber Personal Data. 3.1 eMudhra iCIMS and each eMudhra iCIMS Affiliate shall: 3.1.1 comply with all applicable Data Protection & Privacy Laws in the Processing of Subscriber Personal Data; and; 3.1.2 not Process Subscriber Personal Data other than only on the relevant Subscriber Group Member’s documented instructions for the following purpose: 3.1.2.1 Processing in accordance with the Subscription Agreement and applicable Order Form(s); 3.1.2.2 Processing initiated by Candidates and Users in their use of the Subscription; 3.1.2.3 Processing to render Subscriber Personal Data anonymous, de-identified, and non- personal; and 3.1.2.4 Processing to comply with other documented reasonable instructions provided by Subscriber (e.g., via email); where such instructions are consistent with the terms of the Subscription Agreement, unless Processing is required by Applicable Data Protection & Privacy Laws to which the relevant Contracted Processor is subject, in which case eMudhra iCIMS or the relevant eMudhra iCIMS Affiliate shall to the extent permitted by Applicable Data Protection & Privacy Laws inform the relevant Subscriber Group Member of that legal requirement before the relevant Processing of that Subscriber Personal Data. The usage by subscriber Group members For the avoidance of all websites doubt, an instruction, approval, request or similar action given via the Subscription, including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates Subscriber’s configuration of any settings or options in the Subscription (as Subscriber may be able to modify from time to time to process subscriber personal data will be time), is considered a Subscriber’s Processing instruction. The Parties agree that for the purpose of the Standard Contractual Clauses, the Processing of Subscriber Personal Data by iCIMS is deemed to be in compliance with Subscriber’s instructions if expressly authorized by the Subscription Agreement; 3.1.3 immediately inform the Subscriber if, in its opinion, an instruction from Subscriber infringes Data Protection & Privacy Laws. For purposes of clarity, Subscriber understands and acknowledges that iCIMS and the relevant iCIMS Affiliate do not monitor Subscriber’s configuration of settings or options in the Subscription and Subscriber is solely responsible to ensure that its Processing of Personal Data pursuant to or in connection with the Subscription does not violate Data Protection & Privacy Laws; and 3.1.4 where Processing of Subscriber Personal Data is subject to the CCPA, 3.1.4.1 be prohibited from: (i) Selling or Sharing Subscriber Personal Data; (ii) retaining, using, or disclosing the Subscriber Personal Data for a commercial purpose other than providing the Subscription and related services under instructions the Subscription Agreement, or as otherwise permitted by the applicable Data Protection & Privacy Laws; (iii) retaining, using, or disclosing the Subscriber Personal Data outside of the direct business relationship between iCIMS and Subscriber; and (iv) combining Subscriber Personal Data with Personal Data that iCIMS receives from or on behalf of any other source, or that iCIMS collects from its own interactions with Data Subjects, except where such subscriber group members..combination is a component of the Subscription or related services under the Subscription Agreement or as otherwise permitted to perform any Business Purpose permitted in the applicable regulations. iCIMS certifies that it understands the foregoing restrictions and shall comply with them; and 3.1.4.2 notify Subscriber if iCIMS makes a determination that it can no longer meet its obligations with respect to its Processing of Subscriber Personal Data, in which case upon such notice, Subscriber may take reasonable and appropriate steps to stop and remediate unauthorized use of Subscriber Personal Data. 3.2 Each Subscriber Group Member: 3.2.1 instructs eMudhra instructs, subject to section 3.1, iCIMS and each eMudhra iCIMS Affiliate (and authorises eMudhra authorizes iCIMS and each eMudhra iCIMS Affiliate to instruct each SubprocessorSub-Processor) to: 3.2.1.1 Process Subscriber Personal DataData and Personal Data Processed for iCIMS Business Operations; and 3.2.1.2 in particular, transfer Subscriber Personal Data to any country or territoryterritory permitted by Subscriber, which, for the avoidance of doubt, includes (i) the location(s) of the iCIMS data center(s), which will be the United States unless otherwise indicated in the Subscription Agreement, product addenda, and/or applicable Order Form(s), (ii) the locations of Processing by the Sub-Processors identified in this Addendum and/or the Standard Contractual Clauses, and (iii) the United States, India, European Economic Area (“EEA”), and UK, to the extent necessary for iCIMS personnel to implement and provide support and maintenance of the Subscription, as reasonably necessary for the provision of the Services Subscription and consistent with the Principal Subscription Agreement; and The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be uinstructions under Section 3.2.1from such subscriber group members.; 3.2.2 shall obtain all rights, permissions and/or authorizations, including provide all disclosures and/or obtain all consents, required by applicable Data Protection & Privacy Laws, to permit Processing of Personal Data, including Restricted Transfers, as provided in the Subscription Agreement and/or this Addendum; 3.2.3 is responsible for compliance with any data residency or localization obligations to the extent such obligations exist under applicable Data Protection & Privacy Laws; and 3.2.4 warrants and represents that its instructions for the Processing of Subscriber Personal Data and Personal Data Processed for iCIMS Business Operations complies with Data Protection & Privacy Laws, and it is and will at all relevant times remain duly and effectively authorised authorized to give the instruction set out in section 3.2.1 on behalf of each relevant Subscriber Affiliate. 3.3 Annex Appendix 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Subscriber Personal Data as required by article Article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection & Privacy Laws)) and Personal Data Processed for iCIMS Business Operations. Subscriber may make reasonable amendments to Annex By itself, nothing in Appendix 1 by written notice to eMudhra from time to time as Subscriber reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any additional right or imposes any additional obligation on any party to this Addendum. eMudhra and each eMudhra Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Subscriber Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Subscriber Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Processing of Subscriber Personal Data. 3.1 eMudhra iCIMS and each eMudhra iCIMS Affiliate shall: 3.1.1 comply with all applicable Data Protection & Privacy Laws in the Processing of Subscriber Personal Data; and; 3.1.2 not be prohibited from: (i) Selling Subscriber Personal Data; (ii) retaining, using, or disclosing the Subscriber Personal Data for a commercial purpose other than providing the Subscription and related services under the Subscription Agreement; and (iii) retaining, using, or disclosing the Subscriber Personal Data outside of the direct business relationship between iCIMS and Subscriber; 3.1.3 Process Subscriber Personal Data other than only on the relevant Subscriber Group Member’s documented instructions for the following purpose: 3.1.3.1 Processing in accordance with the Subscription Agreement and applicable Order Form(s); 3.1.3.2 Processing initiated by Candidates and Users in their use of the Subscription; and 3.1.3.3 Processing to render Subscriber Personal Data anonymous, de-identified, and non- personal; 3.1.3.4 Processing to comply with other documented reasonable instructions provided by Subscriber (e.g., via email); where such instructions are consistent with the terms of the Subscription Agreement, unless Processing is required by Applicable Data Protection & Privacy Laws to which the relevant Contracted Processor is subject, in which case eMudhra iCIMS or the relevant eMudhra iCIMS Affiliate shall to the extent permitted by Applicable Data Protection & Privacy Laws inform the relevant Subscriber Group Member of that legal requirement before the relevant Processing of that Subscriber Personal Data. The usage by subscriber Group members For the avoidance of all websites doubt, an instruction, approval, request or similar action given via the Subscription, including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates Subscriber’s configuration of any settings or options in the Subscription (as Subscriber may be able to modify from time to time to process subscriber personal data will be time), is considered a Subscriber’s Processing instruction. The parties agree that for the purpose of the Standard Contractual Clauses, the Processing of Subscriber Personal Data by iCIMS is deemed to be under in compliance with Subscriber’s instructions if expressly authorized by the Subscription Agreement; and 3.1.4 immediately inform the Subscriber if, in its opinion, an instruction from such subscriber group members..Subscriber infringes Data Protection & Privacy Laws. 3.2 Each Subscriber Group Member: 3.2.1 instructs eMudhra Instructs, subject to section 3.1, iCIMS and each eMudhra iCIMS Affiliate (and authorises eMudhra authorizes iCIMS and each eMudhra iCIMS Affiliate to instruct each Subprocessor) to: 3.2.1.1 Process Subscriber Personal Data; and 3.2.1.2 in particular, transfer Subscriber Personal Data to any country or territoryterritory permitted by Subscriber, which, for the avoidance of doubt, includes (i) the location(s) of the iCIMS data center(s) identified in this Addendum and/or the Subscription Agreement and applicable Order Form(s), and (ii) the locations of Processing by the Subprocessors identified in this Addendum and/or the Standard Contractual Clauses, as reasonably necessary for the provision of the Services Subscription and consistent with the Principal Subscription Agreement; and The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be uinstructions under Section 3.2.1from such subscriber group members.and 3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised authorized to give the instruction set out in section 3.2.1 on behalf of each relevant Subscriber Affiliate. 3.3 Annex Appendix 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Subscriber Personal Data as required by article Article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection & Privacy Laws). Subscriber may make reasonable amendments to Annex By itself, nothing in Appendix 1 by written notice to eMudhra from time to time as Subscriber reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any additional right or imposes any additional obligation on any party to this Addendum. eMudhra and each eMudhra Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Subscriber Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Subscriber Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Processing of Subscriber Personal Data. 3.1 eMudhra iCIMS and each eMudhra iCIMS Affiliate shall: 3.1.1 comply with all applicable Data Protection & Privacy Laws in the Processing of Subscriber Personal Data; and; 3.1.2 not Process Subscriber Personal Data other than only on the relevant Subscriber Group Member’s documented instructions for the following purpose: 3.1.2.1 Processing in accordance with the Subscription Agreement and applicable Order Form(s); 3.1.2.2 Processing initiated by Candidates, Survey Recipient, and Users in their use of the Subscription; 3.1.2.3 Processing to render Subscriber Personal Data anonymous, de-identified, and non- personal; and 3.1.2.4 Processing to comply with other documented reasonable instructions provided by Subscriber (e.g., via email); where such instructions are consistent with the terms of the Subscription Agreement, unless Processing is required by Applicable Data Protection & Privacy Laws to which the relevant Contracted Processor is subject, in which case eMudhra iCIMS or the relevant eMudhra iCIMS Affiliate shall to the extent permitted by Applicable Data Protection & Privacy Laws inform the relevant Subscriber Group Member of that legal requirement before the relevant Processing of that Subscriber Personal Data. The usage by subscriber Group members For the avoidance of all websites doubt, an instruction, approval, request, or similar action given via the Subscription, including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates Subscriber’s configuration of any settings or options in the Subscription (as Subscriber may be able to modify from time to time to process subscriber personal data will be time), is considered a Subscriber’s Processing instruction. The Parties agree that for the purpose of the Standard Contractual Clauses, the Processing of Subscriber Personal Data by iCIMS is deemed to be in compliance with Subscriber’s instructions if expressly authorized by the Subscription Agreement; 3.1.3 immediately inform the Subscriber if, in its opinion, an instruction from Subscriber infringes Data Protection & Privacy Laws. For purposes of clarity, Subscriber understands and acknowledges that iCIMS and the relevant iCIMS Affiliate do not monitor Subscriber’s configuration of settings or options in the Subscription and Subscriber is solely responsible to ensure that its Processing of Personal Data pursuant to or in connection with the Subscription does not violate Data Protection & Privacy Laws; and 3.1.4 where Processing of Subscriber Personal Data is subject to the CCPA, 3.1.4.1 be prohibited from: (i) Selling or Sharing Subscriber Personal Data; (ii) retaining, using, or disclosing the Subscriber Personal Data for a commercial purpose other than providing the Subscription and related services under instructions the Subscription Agreement, or as otherwise permitted by the applicable Data Protection & Privacy Laws; (iii) retaining, using, or disclosing the Subscriber Personal Data outside of the direct business relationship between iCIMS and Subscriber; and (iv) combining Subscriber Personal Data with Personal Data that iCIMS receives from or on behalf of any other source, or that iCIMS collects from its own interactions with Data Subjects, except where such subscriber group members..combination is a component of the Subscription or related services under the Subscription Agreement or as otherwise permitted to perform any Business Purpose permitted in the applicable regulations. iCIMS certifies that it understands the foregoing restrictions and shall comply with them; and 3.1.4.2 notify Subscriber if iCIMS makes a determination that it can no longer meet its obligations with respect to its Processing of Subscriber Personal Data, in which case upon such notice, Subscriber may take reasonable and appropriate steps to stop and remediate unauthorized use of Subscriber Personal Data. 3.2 Each Subscriber Group Member: 3.2.1 instructs eMudhra instructs, subject to section 3.1, iCIMS and each eMudhra iCIMS Affiliate (and authorises eMudhra authorizes iCIMS and each eMudhra iCIMS Affiliate to instruct each SubprocessorSub-Processor) to: 3.2.1.1 Process Subscriber Personal Data; and 3.2.1.2 in particular, transfer Subscriber Personal Data to any country or territoryterritory permitted by Subscriber, which, for the avoidance of doubt, includes (i) the location(s) of the iCIMS data center(s), which will be the United States unless otherwise indicated in the Subscription Agreement, product addenda, and/or applicable Order Form(s), (ii) the locations of Processing by the Sub-Processors identified in this Addendum and/or the Standard Contractual Clauses, and (iii) the United States, India, European Economic Area (“EEA”), and UK, to the extent necessary for iCIMS personnel to implement and provide support and maintenance of the Subscription, as reasonably necessary for the provision of the Services Subscription and consistent with the Principal Subscription Agreement; and The usage by subscriber Group members of all websites including mobile applications owned and operated by eMudhra Limited and/or its subsidiaries and affiliates from time to time to process subscriber personal data will be deemed to be uinstructions under Section 3.2.1from such subscriber group members.; 3.2.2 shall obtain all rights, permissions and/or authorizations, including provide all disclosures and/or obtain all consents, required by applicable Data Protection & Privacy Laws, to permit Processing of Personal Data, including Restricted Transfers, as provided in the Subscription Agreement and/or this Addendum; 3.2.3 is responsible for compliance with any data residency or localization obligations to the extent such obligations exist under applicable Data Protection & Privacy Laws; and 3.2.4 warrants and represents that its instructions for the Processing of Subscriber Personal Data complies with Data Protection & Privacy Laws, and it is and will at all relevant times remain duly and effectively authorised authorized to give the instruction set out in section 3.2.1 on behalf of each relevant Subscriber Affiliate. 3.3 Annex Appendix 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Subscriber Personal Data as required by article Article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection & Privacy Laws). Subscriber may make reasonable amendments to Annex 1 by written notice to eMudhra from time to time as Subscriber reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right or imposes any obligation on any party to this Addendum. eMudhra and each eMudhra Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Subscriber Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Subscriber Personal Data, as strictly necessary Data Processed for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentialityiCIMS Business Operations.