Common use of Restricted Transfers Clause in Contracts

Restricted Transfers. Parties agree that when the transfer of personal data from Customer (as “data exporter”) to Atlassian (as “data importer”) is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will be subject to the Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, as follows: (a) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes will be as set out in Section 2.10 of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 18(b), disputes will be resolved before the courts of Ireland; vii. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (b) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) to Atlassian (as “data importer”) NICE is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In in relation to transfers of Customer Personal Data governed data that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. (i) Module Two or Module Three will apply (as applicable)apply; (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section Clause 2.10 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Appendix I to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs shall be deemed completed with the TOMs. (b) in relation to data that is protected by the UK GDPR, the UK SCCs will apply completed as follows: (i) for so long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to processors set out in the European Commission’s Decision 2010/87/EU of 5 February 2010 (“Prior C2P SCCs”) for transfers of personal data from the United Kingdom, the Prior C2P SCCs shall apply between NICE and the Customer on the following basis: (A) Appendix 1 of the UK SCCs shall be deemed completed with the information set out under the relevant headings Appendix I to this DPA; and (B) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B to this DPA;the TOMs; and (bC) In relation the optional illustrative indemnification clause will not apply. (ii) where sub-clause 2.5(b)(i) of this Clause above does not apply, but NICE and the Customer are lawfully permitted to rely on the EU SCCs for transfers of personal data governed from the United Kingdom subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under s.119A(1) of the Data Protection Act 2018, then: (A) the EU GDPR and processed SCCs, completed as set out above in accordance with Section 2.2(bclause 2.5(a) of this DPAClause shall also apply to transfers of such Data, the EU SCCs apply, completed as follows: i. Module One will applysubject to sub-clause (B) below; ii. in Clause 7, (B) the optional docking clause will not apply; iii. in Clause 11, UK Addendum shall be deemed executed between the optional language will not apply; iv. in Clause 17, Option 1 will applytransferring Customer and NICE, and the EU SCCs will shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 Addendum in Part 1 respect of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B transfer of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendumsuch Data. (diii) In relation If neither sub-clause 2.5(b)(i) or sub-clause 2.5(b)(ii) of this Clause applies, then NICE and the Customer shall cooperate in good faith to implement appropriate safeguards for transfers of personal data governed such Data as required or permitted by the Swiss FADPUK GDPR without undue delay. (c) in the event that any provision of this DPA contradicts, directly or indirectly, the EU SCCs will also apply in accordance with paragraphs (a) and (b) aboveStandard Contractual Clauses, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-Processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) In relation Module Two (Controller to transfers Processor) shall apply where the Customer is a Controller of Customer Personal Data governed by and the Company is processing Personal Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of Personal Data and the Company uses a Sub-Processor to process the Personal Data; (iii) Module Four (Processor to Controller) shall apply where the Company is processing Personal Data and the Customer is not subject to the EU GDPR and processed in accordance with Section 2.2(aor UK GDPR; (iv) In Clause 7 of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will shall not apply; iii. in (v) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor Sub- Processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (ix) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (x) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FADP applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FADP; (ii) Restricted Transfers subject to both the FADP and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FADP, all references to the GDPR in the EU SCCs are to be understood to be references to the FADP; (v) Where Restricted Transfers are subject to both the FADP and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FADP insofar as the Restricted Transfers are subject to the FADP; 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Personal Data from Customer (as “data exporter”) to Atlassian (as “data importer”) Rapid7 is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual ClausesClauses as follows: a. in relation to Personal Data that is protected by the EU GDPR, which are deemed incorporated into and form a part of this DPA, the EU SCCs will apply completed as follows: (ai) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs Module Two will apply, completed as follows: i. Module Two or Module Three will apply ; (as applicable); ii. ) in Clause 7, the optional docking clause will not apply; ; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 7 of this DPA; ; (iv. ) in Clause 11, the optional language will not apply; v. ; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; ; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of the Republic of Ireland; ; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex I in the Appendix to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Annex II in the Appendix to this DPA; (b) In b. in relation to transfers of personal data governed Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU UK SCCs apply, will apply completed as follows: i. Module One will apply; (i) the EU SCCs, completed as set out in clause 3.a) above, shall between the Customer as Data Exporter and Rapid7 as Data Importer, and shall be modified by the UK Addendum (completed as set out in clause 3.b) below); and (ii. ) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply3.a) above, and the options "Exporter" and "Importer" shall be deemed checked in Table 4. The start date of the UK Addendum (as set out in Table 1) shall be the effective date of this DPA; and c. in the event that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail; and d. in the event the EU SCCs will or the UK SCCs are replaced by new standard contractual clauses approved by the European Commission and/or the Information Commissioner's Office as applicable, the Parties agree that such new standard contractual clauses shall automatically apply to the relevant Restricted Transfer from the date that such new standard contractual clauses become applicable and shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before deemed completed on a mutatis mutandis basis to the courts of Ireland; vi. Annex I completion of the EU SCC and the UK SCCs is deemed completed with the information set out as described in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) clause 3.a and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;

Restricted Transfers. Parties 6.1 The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 6.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where the Customer is a Controller of Customer Data and the Company is processing Customer Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of Customer Data and the Company uses a Sub-processor to process the Customer Data; (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-Sub- processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (vii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (viii) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (ix) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 6.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 6.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 6.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data occurs between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-processor which is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) In relation Module Two (Controller to transfers Processor) shall apply where the Customer is a Controller of Customer Personal Data governed by and the Company is processing Personal Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of the Personal Data and the Company uses a Sub-processor to process the Personal Data; (iii) Module Four (Processor to Controller) shall apply where the Company is processing Personal Data and the Customer is not subject to the EU GDPR and processed in accordance with Section 2.2(aor UK GDPR; (iv) In Clause 7 of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will does not apply; iii. in (v) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (ix) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (x) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA; 7.3 The Parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-Processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where the Customer is a Controller of Personal Data and the Company is processing Personal Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of Personal Data and the Company uses a Sub-Processor to process the Personal Data; (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will shall not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor Sub- Processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (vii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (viii) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (ix) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs shall be deemed completed with the information set out in Exhibit A of this DPA; and (ii) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Personal Data from Customer (as “data exporter”) to Atlassian (as “data importer”) Rapid7 is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual ClausesClauses as follows: a. in relation to Personal Data that is protected by the EU GDPR, which are deemed incorporated into and form a part of this DPA, the EU SCCs will apply completed as follows: (ai) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs Module Two will apply, completed as follows: i. Module Two or Module Three will apply ; (as applicable); ii. ) in Clause 7, the optional docking clause will not apply; ; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 7 of this DPA; ; (iv. ) in Clause 11, the optional language will not apply; v. ; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; ; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of the Republic of Ireland; ; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex I in the Appendix to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Annex II in the Appendix to this DPA;]; and (b) In b. in relation to transfers of personal data governed Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU UK SCCs apply, will apply completed as follows: i. Module One for so long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to processors set out in the European Commission’s Decision 2010/87/EU of 5 February 2010 (“Prior C2P SCCs”) for transfers of personal data from the United Kingdom, the Prior C2P SCCs shall apply between the Customer and the Rapid7 on the following basis: (aa) Annex I shall be completed with the relevant information set out in Annex I to this DPA; (bb) Annex II shall be completed with the relevant information set out in Annex II to this DPA; and (cc) the optional illustrative indemnification Clause will not apply; ii. in Clause 7, the optional docking where sub-clause will (b)(i) above does not apply; iii. , but the Customer and the Rapid7 are lawfully permitted to rely on the EU SCCs for transfers of personal data from the United Kingdom subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under s.119A(1) of the Data Protection Xxx 0000, then: (aa) the EU SCCs, completed as set out above in Clause 11clause 3(a) of this DPA shall also apply to transfers of such Personal Data, subject to sub-clause (bb); and (bb) the optional language will not apply; iv. in Clause 17, Option 1 will applyUK Addendum shall be deemed executed between the transferring Customer and the Rapid7, and the EU SCCs will shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK AddendumAddendum in respect of the transfer of such Personal Data; iii. If neither sub-clause (b)(i) or sub-clause (b)(ii) applies, which is deemed executed then the Customer and the Rapid7 shall cooperate in good faith to implement appropriate safeguards for transfers of such Personal Data as required or permitted by the parties and incorporated into and forming an integral part UK GDPR without undue delay; and c. in the event that any provision of this DPA. In additionDPA contradicts, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADPdirectly or indirectly, the EU SCCs will also apply in accordance with paragraphs (a) and (b) aboveStandard Contractual Clauses, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties 5.1. The parties agree that when the transfer of personal data Customer Personal Data from Customer and/or any of its Affiliates (as “data exporter”) to Atlassian Solytics (as “data importer”) is a Restricted Transfer and Applicable Data Protection EU Area Law requires that appropriate safeguards are put in placeapplies, the transfer will shall be subject to the Standard Contractual Clausesappropriate Controller to Processor SCCs, which are shall be deemed incorporated into and form a part of this DPA, Addendum as follows: (a) a. In relation to transfers of Customer Personal Data governed that is protected by the EU GDPR and processed in accordance with Section 2.2(a) by Solytics on behalf of this DPAand under the instruction of Customer, the EU SCCs will apply, apply completed as follows: i. 1. Module Two or Module Three will apply (as applicablecontroller to processor transfers); ii2. in In Clause 7, the optional docking clause will not apply; iii3. in In Clause 9, Option 2 will apply, and the time period for prior notice of Sub-sub- processor changes will shall be as set out in Section 2.10 4.2(d) of this DPAAddendum; iv4. in In Clause 11, the optional language will not apply; v. in 5. In Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi6. in In Clause 18(b), disputes will shall be resolved before the courts of the Republic of Ireland; vii7. Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex 1 to this DPA, as applicableAddendum; and viii8. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Section 4 of Annex 1 to this DPA;Addendum. (b) b. In relation to transfers of personal data governed Customer Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this Swiss DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) shall apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 5.1(a) of the UK this Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, but with the following modifications: i. any 1. Any references in the EU SCCs to “Directive 95/46/EC” or “"Regulation (EU) 2016/679” will " shall be interpreted as references to the Swiss FADPDPA and the equivalent articles or sections therein; 2. Any references to "EU", "Union", "Member State", and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “"Member State law” will " shall be interpreted as references to Switzerland and Swiss law, as the case may be, ; 3. Any references to the "competent supervisory authority" and will not "competent courts" shall be interpreted as references to the relevant data protection authority and courts in such a way as Switzerland; and 4. The Controller to exclude data subjects in Processor SCCs shall be governed by the laws of Switzerland from exercising their rights in their place of habitual residence and disputes shall be resolved before the competent Swiss Courts. c. In relation to Customer Personal Data that is protected by the UK GDPR, the EU SCCs shall apply in accordance with Clause 18(cSection 5.1(a) of this Addendum, but as modified and interpreted by the Part 2: Mandatory Clauses of the UK Addendum, which shall be incorporated into and form an integral part of this Addendum. Any conflict between the terms of the EU SCCs;SCCs and the UK Addendum shall be resolved in accordance with Section 10 and Section 11 of the UK Addendum. In addition, tables 1 to 3 in Part 1 of the UK Addendum shall be completed respectively with the information set out in Annex I of this Addendum, and table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting both "Importer" and "Exporter". 5.2. Solytics shall not participate in any other Restricted Transfers of Customer Personal Data (whether as an importer or an exporter of the Customer Personal Data) unless the Restricted Transfer is made in compliance with applicable Data Protection Law and pursuant to the relevant Standard Contractual Clauses implemented between the relevant exporter and importer of the Customer Personal Data, as necessary in order to comply with applicable Data Protection Law

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) to Atlassian (as “data importer”) SonicWall is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In in relation to transfers of Customer Personal Data governed that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. (i) Module Two or Module Three will apply (as applicable)apply; (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 9 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex II to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Xxxxx XXX to this DPA; (b) In in relation to transfers of personal data governed Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU SCCs apply, UK Addendum will apply completed as follows: i. Module One will apply(i) The EU SCCs, completed as set out above in clause 4(a) of this DPA shall also apply to transfers of such Data, subject to sub-clause (ii) below; (ii. in Clause 7) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will applycompleted as set out above, and the EU SCCs will options "neither party" shall be governed by Irish law; v. deemed checked in Clause 18(b), disputes will be resolved before the courts of Ireland; viTable 4. Annex I The start date of the EU SCCs is deemed completed with the information UK Addendum (as set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 Table 1) shall be the date of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA;. (c) In relation to transfers in the event that any provision of personal data governed by UK Data Protection Lawthis DPA contradicts, directly or indirectly, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADPStandard Contractual Clauses, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Personal Data from Customer (as “data exporter”) to Atlassian (as “data importer”) Rapid7 is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual ClausesClauses as follows: a. in relation to Personal Data that is protected by the EU GDPR, which are deemed incorporated into and form a part of this DPA, the EU SCCs will apply completed as follows: (ai) In relation to transfers Module Two will apply; (ii) in Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; ; (iii. ) in Clause 99 of the EU SCCs, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 7 of this DPA; ; (iv. ) in Clause 1111 of the EU SCCs, the optional language will not apply; v. ; (v) in Clause 1717 of the EU SCCs, Option 1 will apply, and the EU SCCs will be governed by Irish law; ; (vi. ) in Clause 18(b)) of the EU SCCs, disputes will shall be resolved before the courts of the Republic of Ireland; ; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex I in the Appendix to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Annex II in the Appendix to this DPA; (b) In b. in relation to transfers of personal data governed Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU UK SCCs apply, will apply completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and (i) the EU SCCs will be governed by Irish law; v. in Clause 18(b)SCCs, disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information as set out in Exhibit A to this DPAClause 3(a) above, shall between the Customer as applicable; and vii. Subject to Section 2.8 of this DPAData Exporter and Rapid7 as Data Importer, Xxxxx XX of and shall be modified by the EU SCCs is deemed UK Addendum (completed with the information as set out in Exhibit B to this DPA; (cClause 3(b)(ii) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above); and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is shall be deemed completed respectively with the relevant information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;, completed as set out in

Restricted Transfers. Parties agree that when 5.1 To the extent the transfer of personal data Client Personal Data from Customer (as “data exporter”) Client to Atlassian (as “data importer”) Brandlive is a Restricted Transfer and Applicable Data Protection Law requires Laws require that appropriate safeguards are put in place, the such transfer will shall be subject to governed by the Standard Contractual Clauses, which are deemed shall be incorporated by reference into and form a an integral part of this DPAAgreement, as follows: 5.1.1 where the 2021 Controller-to-Processor Clauses apply: (ai) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7, the optional docking clause will not apply; iii. ; (ii) in Clause 99 of Modules Two and Three, Option 2 will apply, apply and the time period for prior notice of Sub-processor changes will be as set out is identified in Section 2.10 6 of this DPA; iv. Agreement; (iii) in Clause 11, the optional language will not apply; v. ; (iv) in Clause 17, Option 1 will apply, and the EU SCCs 2021 Controller-to- Processor Clauses will be governed by Irish law;; (v) in Clause 18(b), disputes shall be resolved before the courts of Ireland; (vi) Annex I shall be deemed completed with the information set out in Schedule 1 of this Agreement; (vii) Annex II shall be deemed completed with the information set out in Schedule 2 (Security Measures) (as applicable) of this Agreement; and Annex III shall be deemed completed with the information set out in Schedule 3 of this Agreement. 5.1.2 In relation to Client Personal Data that is protected by the UK GDPR or Swiss DPA, the 2021 Controller-to-Processor Clauses and as implemented under sub- paragraph (A) above will apply with the following modifications: (i) references to "Directive 95/46/EC" or "Regulation (EU) 2016/679" are interpreted as references to the UK GDPR or the Swiss DPA (as applicable); (ii) references to specific Articles of "Regulation (EU) 2016/679" are replaced with the equivalent article or section of the UK GDPR or Swiss DPA (as applicable); (iii) references to "EU", "Union" and "Member State" are replaced with "UK" and "Switzerland" (as applicable); (iv) Clause 13(a) and Part C of Annex II are not used and references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the "Information Commissioner" and the "courts of England and Wales" or the "Swiss Federal Data Protection and Information Commissioner" and the "relevant courts of Switzerland" (as applicable); (v) in Clause 17, the 2021 Controller-to-Processor Clauses are governed by the laws of England and Wales or Switzerland (as applicable); and (vi. ) in Clause 18(b), disputes will be resolved before the courts of Ireland; vii. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, England and Wales or Switzerland (as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (b) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;

Restricted Transfers. Parties 7.1 The parties agree that when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-Processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module One (Controller to Controller) shall apply where SigParser is processing Customer account data for its own purposes; (ii) Module Two (Controller to Processor) shall apply where the Customer is a Controller of Customer Data and SigParser is processing Customer Data; (iii) Module Three (Processor to Processor) shall apply where SigParser is a Processor of Customer Data and SigParser uses a Sub-Processor to process the Customer Data; (iv) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (v) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the method/time period for prior giving notice of Sub-processor Processor changes will shall be as set out forth in Section 2.10 6 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish lawthe law of Ireland; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (ix) Annex I of the EU SCCs is shall be deemed completed with the information set out forth in Exhibit A to of this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX (x) Annex II of the EU SCCs is shall be deemed completed with the information set out forth in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in Section 7.2 shall be adjusted as set forth below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting The term “neither party.member state” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will must not be interpreted in such a way as to exclude data subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; and (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs shall be deemed completed with the information set forth in Exhibit A of this DPA; and (ii) Appendix 2 of the UK SCCs shall be deemed completed with the information set forth in Exhibit B of this DPA. 7.5 If any provision of this DPA directly or indirectly contradicts any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties agree that when the transfer of personal data from Customer (as “data exporter”) to Atlassian (as “data importer”) is ƚƌĂŶƐĨĞƌ ŽĨ ƉĞƌƐŽŶĂdůat a Restricted Transfer and Applicable Data Protection Law requires that appropriate eĚxpĂorƚterĂ͟ ͿĨ ƌƚŽŽŵ ƵƐ ƚůĂƐƐdŝatĂa imŶp or;teĂr͟ƐͿ ͞ŝƐ Ă ZĞƐƚƌŝĐƚĞĚ dƌĂŶƐĨĞƌ ĂŶĚ ƉƉůŝĐĂďůĞ safeguards are put in place, the transfer will be subject to the Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, as follows: (a) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes will be as set out in Section 2.10 of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 18(b), disputes will be resolved before the courts of Ireland; vii. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (b) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be ďLJ ƐĞůĞĐƚƉŝĂŶƌŐƚ LJ͘͞Ŷ͟Ğ ŝ ƚŶŚLJĞ ƌĐŽŶĨůŝĐƚ ďĞƚǁĞĞŶ ƚŚĞ ƚĞƌŵƐ ŽĨ ƚ resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted ĂŶLJ ƌĞĨĞƌĞŶĐĞƐ ŝŶ ƚŚĞ h ^ Ɛ ƚŽ ͞ ŝƌĞĐƚŝǀĞ ϵϱͬϰϲͬ as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be ƌƚŝĐůĞƐ ŽĨ ͞ZĞŐƵůĂƚŝŽŶ ; replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references ƌĞĨĞƌĞŶĐĞƐ ƚŽ ͞ h͕͟ ͞hŶŝŽŶ͕͟ ͞DĞŵďĞƌ ^ƚĂƚĞ͟ ĂŶĚ ͞D to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs; iii. Clause 13 of the EU SCCs and Part C of Annex 1 are modified to provide that the Federal Data Protection ĂŶĚ /ŶĨŽƌŵĂƚŝŽFŶDP IC ͟ŽͿŵ ŵŽŝĨƐ Ɛ^ŝǁŽŝŶƚĞnjƌĞ ƌ;ů͞ĂŶĚ ǁŝůů ŚĂǀĞ ĂƵƚŚŽƌŝ by the Swiss FADP. Subject to the foregoing, all other requirements of Clause 13 will be observed; iv. ƌĞĨĞƌĞŶĐĞƐ ƚŽ ƚŚĞ ͞ĐŽŵƉĞƚĞŶƚ ƐƵƉĞƌǀŝƐŽƌLJ ĂƵƚŚŽƌŝƚLJ references to the FDPIC and competent courts in Switzerland; v. in Clause 17, the EU SCCs will be governed by the laws of Switzerland; and vi. Clause 18(b) states that disputes will be resolved before the applicable courts of Switzerland. (e) It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA), the Standard Contractual Clauses prevail to the extent of such conflict.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) to Atlassian (as “data importer”) NICE is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In in relation to transfers of Customer Personal Data governed data that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. (i) Module Two or Module Three will apply (as applicable)apply; (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section Clause 2.10 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Appendix I to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B to this DPA;TOMs. (b) In in relation to transfers of personal data governed that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU SCCs apply, UK Addendum will apply completed as follows: i. Module One will apply(i) the EU SCCs, completed as set out above in clause 2.5(a) of this Clause shall also apply to transfers of such Data, subject to sub-clause (ii) below; (ii. in Clause 7) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will applycompleted as set out above, and the EU SCCs will options "neither party" shall be governed by Irish law; v. deemed checked in Clause 18(b), disputes will be resolved before the courts of Ireland; viTable 4. Annex I The start date of the EU SCCs is deemed completed with the information UK Addendum (as set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 Table 1) shall be the date of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA;Agreement. (c) In relation to transfers in the event that any provision of personal data governed by UK Data Protection Lawthis DPA contradicts, directly or indirectly, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADPStandard Contractual Clauses, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties agree that when the transfer of personal data from Customer (as tradnatsa efxpeorrter”o)f tpoerson Atlassdiataa imnpor(tear”s) “data exporter”) to Atlassian (as “data importer”) is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will be subject to the Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, as follows: (a) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes will be as set out in Section 2.10 of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 18(b), disputes will be resolved before the courts of Ireland; vii. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (b) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict selectpianrgty“.n”eiAtnhyerconflict between the terms of the EU SCCs and the UK Addendum will be t resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted 95/46/ as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be E replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references M to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;

Restricted Transfers. Parties a. The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) to Atlassian (as “data importer”) WorkRails or from the WorkRails to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer it will be subject to the applicable Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, as follows:. (a) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, b. The parties agree that the EU SCCs will apply, apply to Restricted Transfers from the EEA. The EU SCCs are deemed entered into (and incorporated into this DPA by reference) and completed as follows: i. Module Two or Module Three will apply (as applicable)Controller to Processor) applies where Customer is a Controller of Customer Data and WorkRails is processing Customer Data; ii. Module Three (Processor to Processor) apples where WorkRails is a Processor of Customer Data and WorkRails uses a Sub-processor to process Customer Data; iii. Module Four (Processor to Controller) does not apply; iv. in Clause 77 of the EU SSCs, the optional docking clause will not apply; iii. v. in Clause 99 of the EU SSCs, Option 2 will applyapplies, and the time period for prior notice of Sub-processor changes will processors must be as set out in Section 2.10 8.c. of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 11 of the EU SSCs, the optional language does not apply; vii. in Clause 17 of the EU SSCs, Option 1 applies, the EU SCCs are governed by Irish law, and for the Swiss SCCs, Swiss law; viii. in Clause 18(b)) of the EU SSCs, disputes will must be resolved before by: the courts of IrelandIreland for the EU SCCs, and the courts of Switzerland for the Swiss SCCs; viiix. Annex I of the EU SCCs is are deemed completed with the information set out in Exhibit A to Schedule 1 of this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX x. Annex II of the EU SCCs is are deemed completed with the information set out in Exhibit B Schedule 2 of this DPA. c. The parties agree that the EU SCCs as amended in clause 9(b) above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: i. The Swiss Federal Data Protection and Information Commissioner (FDPIC) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; ii. Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Schedule 1 of this DPA; (b) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; iv. Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; v. Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; and vi. The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. d. The parties agree that the UK SCCs apply to Restricted Transfers from the UK and the UK SCCs are deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs are deemed completed with the information set out in Schedule 1 of this DPA; and (ii) Appendix 2 of the UK SCCs are deemed completed with the information set out in Schedule 2 of this DPA. e. If any provision of this DPA contradicts any Standard Contractual Clauses, the provisions of the applicable Standard Contractual Clauses prevail over this DPA.

Restricted Transfers. Parties 7.1 The parties agree that that, when the a transfer of personal data Personal Data occurs between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-processor which is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) In relation Module Two (Controller to transfers Processor) shall apply where You are a Controller of Customer Personal Data governed by and Redokun Srls is processing Personal Data; (ii) Module Three (Processor to Processor) shall apply where Redokun Srls is a Processor of Personal Data and uses a Sub-processor to process the Personal Data; (iii) Module Four (Processor to Controller) shall apply where Redokun Srls is processing Personal Data and You are not subject to the EU GDPR and processed in accordance with Section 2.2(aor UK GDPR; (iv) In Clause 7 of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will shall not apply; iii. in (v) In Clause 99 of the EU SCCs, Option 2 will applyapplies, and the time period for prior giving notice of Sub-Sub- processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish Italian law; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of IrelandRome in Italy; vii. (ix) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (x) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) NICE to Atlassian (as “data importer”) Vendor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In in relation to transfers of Customer Personal Data governed data that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. (i) Module Two or will apply to the extent that NICE is a controller of the Data, and Module Three will apply (as applicable)to the extent that NICE is a processor of the Data on behalf of a third party controller; (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 1 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 2.8 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A I to this DPA, as applicable; and; (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B II to this DPA;; and (bix) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I Xxxxx XXX of the EU SCCs is shall be deemed completed with the information set out in Exhibit A III to this DPA. (b) in relation to Data that is protected by the UK GDPR, the UK SCCs will apply and the "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses" issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018 ("UK Addendum") shall be deemed executed between Vendor and NICE and completed as applicable; andfollows: vii. Subject (i) The EU SCCs, completed as set out above in clause 2.4(a), shall apply to Section 2.8 transfers of this DPAsuch Data, Xxxxx XX of and the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are shall be deemed amended as specified by Part 2 of the UK Addendum, which is deemed executed by Addendum in respect of the parties and incorporated into and forming an integral part transfer of this DPA. such Data. (ii) In addition, Tables tables 1 to 3 in Part 1 of the UK Addendum is shall be deemed completed respectively with the information set out above at clause 2.4(a) (as applicable), the information set out in Section 2.9, as well as Exhibits A Exhibit I of this DPA and B the technical and organisational measures set out in Exhibit II of this DPA; Table , and table 4 in Part 1 is of the UK Addendum shall be deemed completed by selecting “"neither party".” Any conflict between (c) in the terms event that any provision of this DPA contradicts, directly or indirectly, the EU SCCs and Standard Contractual Clauses, the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK AddendumStandard Contractual Clauses shall prevail. (d) In relation to transfers of personal data governed by a Restricted Transfer where: (i) the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references competent United Kingdom authority issues alternative standard contractual clauses to the Swiss FADP, and references UK SCCs; or (ii) the European Commission issues alternative standard contractual clauses to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;, the parties agree that such alternative standard contractual clauses shall automatically apply to the Restricted Transfer as from the date the current UK SCCs or EU SCCs (as applicable) are no longer valid and shall be deemed completed on a mutatis mutandis basis as to the completion of the Standard Contractual Clauses as described in this Addendum.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where the Client is a Controller of Client Data and Timetastic is processing Client Data; (ii) Module Three (Processor to Processor) shall apply where Timetastic is a Processor of Client Data and Timetastic uses a Sub-processor to process the Client Data; (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (vii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (viii) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (ix) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs shall be deemed completed with the information set out in Exhibit A of this DPA; and (ii) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B of this DPA. 7.5 If any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where the Customer is a Controller of Customer Data and the Company is processing Customer Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of Customer Data and the Company uses a Sub-processor to process the Customer Data; (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-Sub- processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (vii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (viii) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (ix) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) to Atlassian (as “data importer”) Granicus is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual ClausesClauses as follows: a) in relation to data that is protected by the EU GDPR, which are deemed incorporated into and form a part of this DPA, the EU SCCs will apply completed as follows: (ai) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs Module Two will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 0 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Appendix I to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs shall be deemed completed with the TOMs. b) in relation to data that is protected by the UK GDPR, the UK SCCs will apply completed as follows: (i) for so long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to processors set out in the European Commission’s Decision 2010/87/EU of 5 February 2010 (“Prior C2P SCCs”) for transfers of personal data from the United Kingdom, the Prior C2P SCCs shall apply between Granicus and the Customer on the following basis: a) Appendix 1 of the UK SCCs shall be deemed completed with the information set out under the relevant headings Appendix I to this DPA; and b) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B to this DPA;the TOMs; and c) the optional illustrative indemnification clause will not apply. (ii) where sub-clause b) In relation of this Clause above does not apply, but Granicus and the Customer are lawfully permitted to rely on the EU SCCs for transfers of personal data governed from the United Kingdom subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the EU GDPR and processed in accordance with Section 2.2(bInformation Commissioner’s Office under s.119A(1) of this DPAthe Data Protection Xxx 0000, then: a) the EU SCCs applySCCs, completed as follows: i. Module One will applyset out above in clause 0 of this Clause shall also apply to transfers of such Data, subject to sub-clause (B) below; ii. in Clause 7, b) the optional docking clause will not apply; iii. in Clause 11, UK Addendum shall be deemed executed between the optional language will not apply; iv. in Clause 17, Option 1 will applytransferring Customer and Granicus, and the EU SCCs will shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 Addendum in Part 1 respect of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B transfer of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendumsuch Data. (diii) In relation If neither sub-clause b) or sub-clause b)c) of this Clause applies, then Granicus and the Customer shall cooperate in good faith to implement appropriate safeguards for transfers of personal data governed such Data as required or permitted by the Swiss FADPUK GDPR without undue delay. c) in the event that any provision of this DPA contradicts, directly or indirectly, the EU SCCs will also apply in accordance with paragraphs (a) and (b) aboveStandard Contractual Clauses, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties 7.1 The parties agree that that, when the a transfer of personal data Personal Data occurs between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-processor which is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer it will be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs will apply to Restricted Transfers from the EEA. The EU SCCs will be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) In relation Module Two (Controller to transfers Processor) will apply where the Customer is a Controller of Customer Personal Data governed by and the Company is processing Personal Data; (ii) Module Three (Processor to Processor) will apply where the Company is a Processor of Personal Data and the Company uses a Sub-processor to process the Personal Data; (iii) Module Four (Processor to Controller) will apply where the Company is processing Personal Data and the Customer is not subject to the EU GDPR and processed in accordance with Section 2.2(aor UK GDPR; (iv) In Clause 7 of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (v) In Clause 99 of the EU SCCs, Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor changes will be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will be governed by Irish law; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will be resolved before by the courts of Ireland; vii. (ix) Annex I of the EU SCCs is will be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (x) Annex II of the EU SCCs is will be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, will be adjusted as set out below where the FADP applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) will be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FADP; (ii) Restricted Transfers subject to both the FADP and the EU GDPR, will be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FADP, all references to the GDPR in the EU SCCs are to be understood to be references to the FADP; (v) Where Restricted Transfers are subject to both the FADP and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FADP insofar as the Restricted Transfers are subject to the FADP; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FADP. 7.4 The parties agree that the UK SCCs willl apply to Restricted Transfers from the UK and the UK SCCs will be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs will prevail over the terms of the DPA.

Restricted Transfers. Parties agree that when 9.1. To the transfer extent required to ensure the legality of personal data from Customer (as “data exporter”) to Atlassian (as “data importer”) is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfers, the transfer will be subject to parties hereby incorporate the Standard Contractual Clauses, which are deemed incorporated Clauses into and form a part of this DPA, Data Processing Addendum as follows: (a) In relation to transfers the context of a Restricted Transfer originating in the EEA: (i) the EEA SCCs are hereby incorporated into this Data Processing Addendum; (ii) Customer Personal Data governed by shall be the EU GDPR ‘data exporter’ and processed in accordance with Section 2.2(aZip shall be the ‘data importer’; (iii) the optional Clause 7 of this DPA, the EU EEA SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable)is hereby deleted; ii. in Clause 7, (iv) the optional docking clause will not apply; iii. in language of Clause 911 of the EEA SCCs is hereby deleted; (v) for purposes of Clause 17 of the EEA SCCs, Option 2 will apply, is hereby selected and the time period for prior notice of Sub-processor changes will governing law shall be as set out in Section 2.10 of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 18(b), disputes will be resolved before the courts law of Ireland; vii. ; (vi) Annex I of the EU EEA SCCs is deemed completed hereby populated with the corresponding information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 Attachment 1 of this DPA, Xxxxx XX Data Processing Addendum; and (vii) Annex II of the EU EEA SCCs is deemed completed shall be populated with the information Security Measures set out in Exhibit B to Attachment 2 of this DPA;Data Processing Addendum. (b) In relation the context of a Restricted Transfer originating in the United Kingdom: (i) the UK SCCs are hereby incorporated into this Data Processing Addendum; (ii) Customer shall be the ‘data exporter’ and Zip shall be the ‘data importer’; (iii) all references to transfers European Union Member States are hereby replaced by references to the United Kingdom; (iv) the governing law for purposes of personal data governed by the EU GDPR Clauses 9 and processed in accordance with Section 2.2(b11(3) of this DPA, the EU UK SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, shall be the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option law of England and Wales; (v) Appendix 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU UK SCCs is deemed completed hereby populated with the corresponding information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 Attachment 1 of this DPA, Xxxxx XX Data Processing Addendum; and (viii) Appendix 2 of the EU UK SCCs is deemed completed shall be populated with the information Security Measures set out in Exhibit B Attachment 2 of this Data Processing Addendum. 9.2. Customer’s rights of audit under the SCCs may be exercised as specified in Section 11 of this Data Processing Addendum. 9.3. Pursuant to clause 9(a) of the SCCs and as set out in this DPA; (c) In relation Data Processing Addendum, Zip may engage third-party Subprocessors in connection with the provision of the Services. Zip will make available its then-current list of Subprocessors available to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed Customer in accordance with paragraphs (athis Data Processing Addendum. The parties agree that copies of Subprocessor agreements that Zip must provide to Customer pursuant to clause 9(c) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with SCCs may have all commercial information, or clauses unrelated to the information set out in Section 2.9SCCs or their equivalent, as well as Exhibits A and B of this DPAremoved by Zip beforehand; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum and, that such copies will be resolved provided by Zip, in a manner to be determined in its discretion, only upon request by Customer. Any such agreements provided to the Customer in accordance with Section 10 and Section 11 this section or the SCCs shall be considered the Confidential Information of the UK AddendumZip. 9.4. In the event that the SCCs (dor any alternative transfer mechanism utilized) In relation cease to be a valid mechanism for transferring Customer Personal Data under Applicable Data Protection Laws, the parties shall work together in good faith to enter into an appropriate data transfer agreement or negotiate in good faith a solution to enable the transfer of Customer Personal Data to be conducted in compliance with Applicable Data Protection Laws. 9.5. To the extent required by Applicable Data Protection Laws or a Regulatory Authority, the parties shall execute or re-execute the applicable SCCs as separate documents setting out the proposed transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted Personal Data in such a way manner as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;may be required.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where the Customer is a Controller of Customer Data and the Company is processing Customer Data; (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of Customer Data and the Company uses a Sub-processor to process the Customer Data; (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-Sub- processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in (vii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; vii. (viii) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (ix) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs shall be deemed completed with the information set out in Exhibit A of this DPA; and (ii) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties The parties agree that when the transfer of personal data Personal Data from Customer (as “data exporter”) to Atlassian (as “data importer”) Rapid7 is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual ClausesClauses as follows: a. in relation to Personal Data that is protected by the EU GDPR, which are deemed incorporated into and form a part of this DPA, the EU SCCs will apply completed as follows: (ai) In relation to transfers of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs Module Two will apply, completed as follows: i. Module Two or Module Three will apply ; (as applicable); ii. ) in Clause 7, the optional docking clause will not apply; ; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 7 of this DPA; ; (iv. ) in Clause 11, the optional language will not apply; v. ; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; ; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of the Republic of Ireland; ; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex I in the Appendix to this DPA, as applicable; and (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Annex II in the Appendix to this DPA; (b) In b. in relation to transfers of personal data governed Personal Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU UK SCCs apply, will apply completed as follows: i. Module One will apply; (i) the EU SCCs, completed as set out in clause 3(a) above, shall between the Customer as Data Exporter and Rapid7 as Data Importer, and shall be modified by the UK Addendum (completed as set out in clause 3(b)(ii) below); and (ii. ) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply3(a) above, and the options "Exporter" and "Importer" shall be deemed checked in Table 4. The start date of the UK Addendum (as set out in Table 1) shall be the effective date of this DPA; and c. in the event that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail; and d. in the event the EU SCCs will or the UK SCCs are replaced by new standard contractual clauses approved by the European Commission and/or the Information Commissioner's Office as applicable, the Parties agree that such new standard contractual clauses shall automatically apply to the relevant Restricted Transfer from the date that such new standard contractual clauses become applicable and shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before deemed completed on a mutatis mutandis basis to the courts of Ireland; vi. Annex I completion of the EU SCC and the UK SCCs is deemed completed with the information set out as described in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (aclause 3(a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;

Restricted Transfers. Parties The parties agree that when the transfer of personal data Data from Customer (as “data exporter”) to Atlassian (as “data importer”) virtualDCS is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In a. in relation to transfers of Customer Personal Data governed data that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. Module Two or Module Three will apply (as applicable)apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 10 of this DPA; iv. in Clause 11, the optional language will not apply; v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; vi. in Clause 18(b), disputes will shall be resolved before the courts of Ireland; vii. Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Appendix 1 to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is shall be deemed completed with the information set out TOMs. b. in Exhibit B to this DPA; (b) In relation to transfers of personal data governed that is protected by the UK GDPR, the UK SCCs will apply and the "International Data Transfer Addendum to the EU GDPR and processed in accordance with Section 2.2(bCommission Standard Contractual Clauses" issued by the Information Commissioner's Office under s.119A(1) of this DPA, the EU SCCs apply, Data Protection Act 2018 ("UK Addendum") shall be deemed executed between Customer and virtualDCS and completed as follows: i. Module One will apply; ii. The EU SCCs, completed as set out above in Clause 7clause 2.5(a), the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will applyshall apply to transfers of such Data, and the EU SCCs will shall be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by Part 2 of the UK Addendum, which is deemed executed by Addendum in respect of the parties and incorporated into and forming an integral part transfer of this DPAsuch Data. ii. In addition, Tables tables 1 to 3 in Part 1 of the UK Addendum is shall be deemed completed respectively with the information set out above at clause 2.5(a) (as applicable), the TOMs and in Section 2.9, as well as Exhibits A and B Appendix 1 of this DPA; Table , and table 4 in Part 1 is of the UK Addendum shall be deemed completed by selecting “"neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum". (d) In relation to transfers c. in the event that any provision of personal data governed by the Swiss FADPthis DPA contradicts, directly or indirectly, the EU SCCs will also apply in accordance with paragraphs (a) and (b) aboveStandard Contractual Clauses, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties 7.1 The parties agree that that, when the a transfer of personal data Personal Data occurs between the Controller and the Processor or from Customer (as “data exporter”) the Processor to Atlassian (as “data importer”) a Sub-processor which is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the Standard Contractual Clauses, which are applicable SCCs. 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) In relation Module Two (Controller to transfers Processor) shall apply where the Customer is a Controller of Customer Personal Data governed by and Barbary Software SL is processing Personal Data; (ii) Module Three (Processor to Processor) shall apply where Barbary Software SL is a Processor of Personal Data and Barbary Software SL uses a Sub-processor to process the Personal Data; (iii) Module Four (Processor to Controller) shall apply where Barbary Software SL is processing Personal Data and the Customer is not subject to the EU GDPR and processed in accordance with Section 2.2(aor UK GDPR; (iv) In Clause 7 of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will shall not apply; iii. in (v) In Clause 99 of the EU SCCs, Option 2 will applyapplies, and the time period for prior giving notice of Sub-Sub- processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (vi) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vii) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish Spanish law; vi. in (viii) In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of IrelandBarcelona, in Spain; vii. (ix) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (x) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA. 7.3 The parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects Data Subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), as set out in Exhibit C of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any SCCs, the provisions of the applicable SCCs shall prevail over the terms of the DPA.

Restricted Transfers. Parties 6.1 The parties agree that when the transfer of personal data Data from the Customer (as “data exporter”) to Atlassian (as “data importer”) Replyco is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in place, the transfer will it shall be subject to the appropriate Standard Contractual Clauses, which are deemed incorporated into and form a part of this DPA, Clauses as follows: (a) In in relation to transfers of Customer Personal Data governed that is protected by the EU GDPR and processed in accordance with Section 2.2(a) of this DPAGDPR, the EU SCCs will apply, apply completed as follows: i. (i) Module Two or Module Three will apply (as applicable)apply; (ii. ) in Clause 7, the optional docking clause will not apply; (iii. ) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor subprocessor changes will shall be as set out in Section 2.10 Clause 10 of this DPA; (iv. ) in Clause 11, the optional language will not apply; v. (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; (vi. ) in Clause 18(b), disputes will shall be resolved before the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A Annex I to this DPA, as applicable; and; (viii. Subject to Section 2.8 of this DPA, Xxxxx XX ) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B Annex II to this DPA; and (ix) Xxxxx XXX of the EU SCCs shall be deemed completed with the information set out in Xxxxx XXX to this DPA; (b) In in relation to transfers of personal data governed Data that is protected by the EU GDPR and processed in accordance with Section 2.2(b) of this DPAUK GDPR, the EU SCCs apply, UK Addendum will apply completed as follows: i. Module One will apply;(i) The EU SCCs, completed as set out above in clause 6.1(a) of this DPA shall also apply to transfers of such Data, subject to sub-clause (ii) below; and (ii. in Clause 7) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will applycompleted as set out above, and the EU SCCs will options "neither party" shall be governed by Irish law; v. deemed checked in Clause 18(b), disputes will be resolved before the courts of Ireland; viTable 4. Annex I The start date of the EU SCCs is deemed completed with the information UK Addendum (as set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 Table 1) shall be the date of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA;. (c) In relation to transfers in the event that any provision of personal data governed by UK Data Protection Lawthis DPA contradicts, directly or indirectly, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADPStandard Contractual Clauses, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will not be interpreted in such a way as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs;Standard Contractual Clauses shall prevail.

Restricted Transfers. Parties 7.1 The parties agree that that, when the transfer of personal data Personal Data from Customer (as “data exporter”) the Controller to Atlassian (as “data importer”) the Processor or from the Processor to a Sub-processor is a Restricted Transfer and Applicable Data Protection Law requires that appropriate safeguards are put in placeTransfer, the transfer will it shall be subject to the applicable Standard Contractual Clauses, which are . 7.2 The parties agree that the EU SCCs shall apply to Restricted Transfers from the EEA. The EU SCCs shall be deemed entered into (and incorporated into this DPA by reference) and form a part of this DPA, completed as follows: (ai) Module Two (Controller to Processor) shall apply where You are a Controller of Your Data and the Company is processing Your Data. (ii) Module Three (Processor to Processor) shall apply where the Company is a Processor of the Your Data and the Company uses a Sub-processor to process the Your Data. (iii) In relation to transfers Clause 7 of Customer Personal Data governed by the EU GDPR and processed in accordance with Section 2.2(a) of this DPA, the EU SCCs will apply, completed as follows: i. Module Two or Module Three will apply (as applicable); ii. in Clause 7SCCs, the optional docking clause will not apply; iii. in (iv) In Clause 9, 9 of the EU SCCs Option 2 will applyapplies, and the time period for prior giving notice of Sub-processor changes will shall be as set out in Section 2.10 clause 6.3 of this DPA; iv. in (v) In Clause 1111 of the EU SCCs, the optional language will shall not apply; v. in (vi) In Clause 1717 of the EU SCCs, Option 1 will apply, applies and the EU SCCs will shall be governed by Irish law; vi. in ; In Clause 18(b)) of the EU SCCs, disputes will shall be resolved before by the courts of Ireland; (vii. ) Annex I of the EU SCCs is shall be deemed completed with the information set out in Exhibit A to this DPA, as applicable; and viii. Subject to Section 2.8 of this DPA, Xxxxx XX ; (viii) Annex II of the EU SCCs is shall be deemed completed with the information set out in Exhibit B of this DPA; 7.3 The Parties agree that the EU SCCs as amended in clause 7.2 above, shall be adjusted as set out below where the FDPA applies to any Restricted Transfer: (i) The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Restricted Transfers exclusively subject to the FDPA; (ii) Restricted Transfers subject to both the FDPA and the EU GDPR, shall be dealt with by the EU Supervisory Authority named in Exhibit A of this DPA; (biii) In relation to transfers of personal data governed by the EU GDPR and processed in accordance with Section 2.2(b) of this DPA, the EU SCCs apply, completed as follows: i. Module One will apply; ii. in Clause 7, the optional docking clause will not apply; iii. in Clause 11, the optional language will not apply; iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law; v. in Clause 18(b), disputes will be resolved before the courts of Ireland; vi. Annex I of the EU SCCs is deemed completed with the information set out in Exhibit A to this DPA, as applicable; and vii. Subject to Section 2.8 of this DPA, Xxxxx XX of the EU SCCs is deemed completed with the information set out in Exhibit B to this DPA; (c) In relation to transfers of personal data governed by UK Data Protection Law, the EU SCCs: (i) apply as completed in accordance with paragraphs (a) and (b) above; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum is deemed completed respectively with the information set out in Section 2.9, as well as Exhibits A and B of this DPA; Table 4 in Part 1 is deemed completed by selecting “neither party.” Any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (d) In relation to transfers of personal data governed by the Swiss FADP, the EU SCCs will also apply in accordance with paragraphs (a) and (b) above, with the following modifications: i. any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP; ii. references to “EU”, “Union”, “Member State” and “Member State law” will be interpreted as references to Switzerland and Swiss law, as the case may be, and will The term ’member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland from exercising the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; (iv) Where Restricted Transfers are exclusively subject to the FDPA, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA; (v) Where Restricted Transfers are subject to both the FDPA and the EU GDPR, all references to the GDPR in the EU SCCs are to be understood to be references to the FDPA insofar as the Restricted Transfers are subject to the FDPA; (vi) The Swiss SCCs also protect the Personal Data of legal entities until the entry into force of the revised FDPA. 7.4 The parties agree that the UK SCCs shall apply to Restricted Transfers from the UK and the UK SCCs shall be deemed entered into (and incorporated into this DPA by reference), completed as follows: (i) Appendix 1 of the UK SCCs shall be deemed completed with the information set out in Exhibit A of this DPA; and (ii) Appendix 2 of the UK SCCs shall be deemed completed with the information set out in Exhibit B of this DPA. 7.5 In the event that any provision of this DPA contradicts directly or indirectly any Standard Contractual Clauses, the provisions of the applicable Standard Contractual Clauses shall prevail over the terms of the DPA.