Common use of Rights and Obligations of the Processor Clause in Contracts

Rights and Obligations of the Processor. 6.1 The Data Processor shall only process Personal Data in accordance with the Data Controller’s written instruction as specified herein and shall not use Personal Data except to deliver the Offering and the Services as instructed by the Agreement, unless such processing is required by law to which the Data Processor is subject, in which case the Data Processor shall, to the extent permitted by law, inform the Data Controller of that legal requirement prior to carrying out the applicable processing. 6.2 The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s reasonable opinion, an instruction from the Data Controller infringes the Data Privacy Laws. 6.3 The Data Processor shall not transfer Personal Data outside the European Economic Area (“EEA”) without the prior written consent of the Data Controller and not without procuring provision of adequate safeguards (as defined by the European Commission from time to time); 6.4 In the event that the UK ceases to be a member of the European Union or ceases to be considered by the European Commission to be an adequate country pursuant to Article 45 of GDPR, then the parties agree that Darktrace shall apply the EU Model Clauses as set out at xxx.xxxxxxxxx.xxx/xx/xxxxxxxxx/xxxxx-xxxxxxxx-xxxxx-xxxxxxx.xxx to any relevant transfer of data and such EU Model Clauses shall be deemed incorporated from the date of first transfer. 6.5 The Data Processor shall take reasonable steps to ensure the reliability of its agents and employees who have access to any Personal Data.

Rights and Obligations of the Processor. 6.1 The Data Processor shall only process Personal Data in accordance with the Data Controller’s written instruction as specified herein and shall not use Personal Data except to deliver the Offering and the Services as instructed by the Agreement, unless such processing is required by law to which the Data Processor is subject, in which case the Data Processor shall, to the extent permitted by law, inform the Data Controller of that legal requirement prior to carrying out the applicable processing. 6.2 The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s reasonable opinion, an instruction from the Data Controller infringes the Data Privacy Laws. 6.3 The Data Processor shall not transfer Personal Data outside the European Economic Area (“EEA”) without the prior written consent of the Data Controller and not without procuring provision of adequate safeguards (as defined by the European Commission from time to time); 6.4 In the event that the UK ceases to be a member of the European Union or ceases to be considered by the European Commission to be an adequate country pursuant to Article 45 of GDPR, then the parties agree that Darktrace shall apply the EU Model Clauses as set out at xxx.xxxxxxxxx.xxx/xx/xxxxxxxxx/xxxxx-xxxxxxxx-xxxxx-xxxxxxx.xxx xxx.xxxxxxxxx.xxx/xxxxx/xxxxxxxx_xxxxx_xxxxxxx, to any relevant transfer of data and such EU Model Clauses shall be deemed incorporated from the date of first transfer. 6.5 The Data Processor shall take reasonable steps to ensure the reliability of its agents and employees who have access to any Personal Data.

Rights and Obligations of the Processor. 6.1 The Data Processor shall only process Personal Data in accordance with the Data Controller’s written instruction as specified herein and shall not use Personal Data except to deliver the Offering and the Services register an Enrolment, administer a Course and/or Exam, confer upon an Attendee a Darktrace Certification as instructed by in the Agreement, or as otherwise instructed by You in writing, unless such processing is required by law to which the Data Processor is subject, in which case the Data Processor shall, to the extent permitted by law, inform the Data Controller of that legal requirement prior to carrying out the applicable processing. 6.2 The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s reasonable opinion, an instruction from the Data Controller infringes the Data Privacy Laws. 6.3 The Data Processor shall not transfer Personal Data outside the European Economic Area (“EEA”) without the prior written consent of the Data Controller and not without procuring provision of adequate safeguards (as defined by the European Commission from time to time);. 6.4 In the event that the UK ceases to be a member of the European Union or ceases to be considered by the European Commission to be an adequate country pursuant to Article 45 of GDPR, then the parties Parties agree that Darktrace shall apply the EU Model Clauses as set out at xxx.xxxxxxxxx.xxx/xx/xxxxxxxxx/xxxxx-xxxxxxxx-xxxxx-xxxxxxx.xxx to any relevant transfer of data and such EU Model Clauses shall be deemed incorporated from the date of first transfer. 6.5 The Data Processor shall take reasonable steps to ensure the reliability of its agents and employees who have access to any Personal Data.

Rights and Obligations of the Processor. 6.1 The Data Processor shall only process Personal Data in accordance with the Data Controller’s written instruction as specified herein and shall not use Personal Data except to deliver the Offering and the Services as instructed by the Agreement, unless such processing is required by law to which the Data Processor is subject, in which case the Data Processor shall, to the extent permitted by law, inform the Data Controller of that legal requirement prior to carrying out the applicable processing. 6.2 The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s reasonable opinion, an instruction from the Data Controller infringes the Data Privacy Laws. 6.3 The Data Processor shall not transfer Personal Data outside the European Economic Area (“EEA”) without the prior written consent of the Data Controller and not without procuring provision of adequate safeguards (as defined by the European Commission from time to time); 6.4 In the event that the UK ceases to be a member of the European Union or ceases to be considered by the European Commission to be an adequate country pursuant to Article 45 of GDPR, then the parties agree that Darktrace shall apply the EU Model Clauses as set out at xxx.xxxxxxxxx.xxx/xx/xxxxxxxxx/xxxxx-xxxxxxxx-xxxxx-xxxxxxx.xxx to any relevant transfer of data and such EU Model Clauses shall be deemed incorporated from the date of first transfer.. V20.10.2020 MCA SHRINKWRAP 13 6.5 The Data Processor shall take reasonable steps to ensure the reliability of its agents and employees who have access to any Personal Data.