SUB CONTRACTUAL RELATIONS Clause Samples

SUB CONTRACTUAL RELATIONS. 4.1. Processor may employ following other processors (hereinafter referred to as “Sub- processor”) for the purpose of providing certain services respectively: - Equinix, providing providing physical devices in the data center located in Germany and related services; and - Globalswitch, providing physical devices in the data center located in the Netherlands and related services. 4.2. Prior to employing further or replacing existing Sub-processors listed above, Processor shall inform Controller in due time, in writing. 4.3. Controller may – for important data protection reasons – object to such changes within a reasonable period of time (no longer than Two (2) Weeks) and appeal to the body Processor specified. If there is no objection within the deadline, acceptance of change is considered given. In exceptional cases an agreement in the aftermath shall be possible. Processor then shall inform Controller about the exchange of a Sub-processor in a timely manner. 4.4. If Sub-processor provides agreed service(s) outside the EU/EEA, Controller and Processor shall ensure compliance in terms of data protection by taking appropriate measures. 4.5. Any further outsourcing by Sub-processor requires Controller’s written explicit consent; any contractual provisions with regard to data protection within the contractual chain must also be imposed on the further Sub-processor to ensure data protection requirements are met. 4.6. Subcontracting in the sense of Agreement always refers to services that directly relate to the provision of the main service. This does not include other services provided by Processor, such as the disposal of data carriers and other measures with the aim to ensure confidentiality, availability, integrity and resilience of hard- and soft- ▇▇▇▇ of data processing systems. However, Processor shall be obliged to hold appropriate and legally compliant contractual agreements and control measures for outsourced ancillary services in order to guaranteeing data protection and data security of Controller‘s data.

SUB CONTRACTUAL RELATIONS. By appropriate agreement, written where legally required for validity, the Contractor shall require each Subcontractor, to the extent of the Work to be performed by the Subcontractor, to be bound to the Contractor by terms of the Contract Documents, and to assume toward the Contractor all obligations and responsibilities, which the Contractor, by the Contract Documents, assumes toward the District and the Architect. Each subcontract agreement shall preserve and protect the rights of the District and the Architect under the Contract Documents with respect to the Work to be performed by the Subcontractor so that subcontracting thereof will not prejudice such rights, and shall allow to the Subcontractor, unless specifically provided otherwise in the subcontract agreement, the benefit of all rights, remedies, and redress against the Contractor that the Contractor, by the Contract Documents, has against the District. Where appropriate, the Contractor shall require each Subcontractor to enter into similar agreements with Sub-subcontractors.

SUB CONTRACTUAL RELATIONS. By an appropriate written agreement, Contractor shall require each sub-contractor, to the extent of the Work to be performed by the subcontractor, to be bound to Contractor by the terms of this Agreement and to assume toward Contractor all obligations and responsibilities which Contractor, by this Agreement, assumes towards the City. Contractor shall make available to each proposed subcontractor prior to the execution of any such agreement, a copy of this Agreement.

SUB CONTRACTUAL RELATIONS. The OWNER or his designated representative shall have the right prior to or following the execution of the agreement between the CONTRACTOR and any of its subcontractors or material suppliers to review said agreement or agreements in order to assure that such subcontractor or material suppliers are expressly bound by all of the applicable terms, covenants and conditions under this Agreement and the Agreement Documents connected herewith, and the OWNER shall have the right to request modifications to the aforesaid agreement(s) as deemed necessary to fulfill the requirements of this paragraph. Failure of the OWNER to review such agreement(s) shall not relieve the CONTRACTOR from such language and provisions.

SUB CONTRACTUAL RELATIONS. 17.2.1 By appropriate written agreement, the Contractor shall require each Subcontractor, to the extent of the Work to be performed by the Subcontractor, to be bound to the Contractor by terms of the Contract Documents, and to assume toward the Contractor all the obligations and responsibilities, including the responsibility for safety of the Subcontractor’s Work that the Contractor, by these Contract Documents, assumes toward the Owner and Architect. Each subcontract agreement shall preserve and protect the rights of the Owner and Architect under the Contract Documents with respect to the Work to be performed by the Subcontractor so that subcontracting thereof will not prejudice such rights, Where appropriate, the Contractor shall require each Subcontractor to enter into similar agreements with Sub-subcontractors. The Contractor shall make available to each proposed Subcontractor, prior to the execution of the subcontract agreement, copies of the Contract Documents to which the Subcontractor will be bound, and Subcontractors will similarly make copies of applicable portions of such documents available to their respective proposed Sub-subcontractors.

SUB CONTRACTUAL RELATIONS. 5.3.1. By appropriate agreement, written where legally required for validity, Contractor shall require each Subcontractor, to the extent of the Work to be performed by Subcontractor, to be bound to Contractor by the same terms and conditions of the Contract Documents. Through that binding commitment, Subcontractor shall assume all the obligations and responsibilities, including the responsibility for safety of Subcontractor’s Work and workers, which Contractor, by these Documents, assumes toward ▇▇▇▇ COUNTY and Design Consultant. Each Subcontractor agreement shall preserve and protect the rights of ▇▇▇▇ COUNTY and Design Consultant under the Contract Documents, with respect to the Work to be performed by Subcontractor, so that subcontracting thereof shall not prejudice such rights. Where appropriate, Contractor shall require each Subcontractor to enter into similar agreements with Sub-Subcontractors. Contractor shall make available to each proposed Subcontractor, prior to the execution of all Subcontractor agreement(s), copies of the Contract Documents to which Subcontractor(s) shall be bound. Subcontractors similarly shall make copies of applicable portions of such documents available to their respective proposed Sub-Subcontractors.

SUB CONTRACTUAL RELATIONS. 6.1 Sub-contractual relations within the meaning of this regulation should be understood as those services which relate directly to the performance of the main service. This does not include supplementary services which the Agent evokes for other purposes, e.g. telecommunication services, postage/transportation services, maintenance and user services or disposing of data media or other measures for ensuring the confidentiality, availability, integrity and capacity of the hardware and software used in data processing systems. However, the Agent is obliged to establish appropriate and lawful contractual agreements and monitoring measures in order to ensure data protection and data security for the Client’s data, even in the case of outsourced supplementary services. 6.2 The Agent may only commission sub-contractors (other order processors) with prior express permission from the Client, obtained in written/documented form. A list of all commissioned sub-contractors can be found on the website ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇/en/data- protection/. The Client agrees to the commission of the sub-contractors listed there, abiding by the conditions of a contractual agreement subject to Article 28, para 2-4 of the GDPR. 6.3 Outsourcing further sub-contractors or changing the existing sub-contractor is permitted, provided that: • the Agent informs the Client of this sub-contractor outsourcing in advance with reasonable time to spare, in written or text form and • the Client does not raise an objection to the planned outsourcing with the Agent within 14 days in written or text form and • a contractual agreement is established subject to Article 28, para 2-4 of the GDPR. 6.4 The transferral of the Client’s personal data to sub-contractors and their initial commencement are only permitted once all requirements for sub-contracting are met.

SUB CONTRACTUAL RELATIONS. 6.1 This regulation understands “sub-contractual relations” to mean services provided in direct relation to the commissioned data processing. This does not include any additional services used by the Contractor, such as telecommunications services, postal / transport services, maintenance and user services and the disposal of data carriers, as well as other measures carried out to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing facilities. However, the Contractor shall be obliged to establish appropriate and lawful contractual agreements to ensure the protection and security of the Client’s data, even when outsourcing additional services. Topcart GmbH ▇▇▇▇▇▇-▇▇▇▇▇▇▇▇▇▇-Ring ▇▇-▇▇ ▇-▇▇▇▇▇ Wiesbaden Phone: +49 (0)611 - 949 190 Fax: +49 (0)611 - ▇▇▇ ▇▇▇▇ ▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇ Place of business: Wiesbaden Local court Wiesbaden HRB: ▇▇▇▇▇ ▇▇▇▇▇: DE 814683901 Deutsche Bank Wiesbaden IBAN: ▇▇▇▇ ▇▇▇▇ ▇▇▇▇ ▇▇▇▇ ▇▇▇▇ ▇▇ BIC: ▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇ ▇▇▇▇ ▇▇ ▇▇ ▇▇▇▇ 0150 0000 7528 ▇▇ ▇▇▇ ▇▇▇▇▇▇▇▇▇▇▇ Office Austria ▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇. ▇▇▇/▇, ▇-▇▇▇▇ ▇▇▇▇▇▇ Tel: +43 (0)▇-▇▇▇▇▇▇-▇ 6.2 The Contractor may only hire sub-contractors (extra processors) with the express prior written or documented consent of the Client. The Client hereby agrees to the hiring of the following sub-contractors on the basis of a contractual agreement pursuant to Article 28(2-4) of the GDPR: - None - 6.3 The Contractor may change sub-contractors if the Client is notified of such outsourcing suitably in advance in writing or in text form, the Client does not object to the scheduled outsourcing in writing or in text form before the change takes effect, and this is done on the basis of a contractual agreement pursuant to Article 28(2-4) of the GDPR. 6.4 The Contractor may only transfer personal data to sub-contractors – and sub-contractors may only start their work – if all sub- contracting requirements have been met.

SUB CONTRACTUAL RELATIONS. 6.1. The Controller herewith gives his general authorisation for engaging other processors as subcontractors for executing this DPA. If the Processor changes its subcontractors (by adding new ones or removing/replacing existing ones), it shall inform the Controller by updating the Privacy Policy - table at the end of the document (that can be accessed here: ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇.▇▇▇/data-privacy/). In this respect, the Controller hereby agrees to accept posting of a revised Privacy Policy on the website as the actual notice of the Processor of its sub-processors. 6.2. For important data protection reasons, the Controller may object to such changes within a reasonable period (not longer than two weeks) and contact the Processor. If there is no objection within the deadline, the acceptance of the change is deemed to have been given. It shall be understood and agreed that a limitation of the service owed under this contract resulting from an unfounded objection shall not be the responsibility of the Processor. In exceptional cases, agreement may be reached in the subsequent period. 6.3. If the subcontractor provides agreed service(s) outside the EU, the Controller and Processor shall take appropriate measures to ensure that data protection is permissible and complied with. 6.4. Subcontracting in the sense of this Agreement always refers to services that directly relate to the provision of the principal service. This does not include other (ancillary) services provided by the Processor, such as the disposal of data carriers and other measures to ensure confidentiality, availability, integrity and resilience of hard- and software of data processing systems. However, the Processor shall be obliged to enter into appropriate and legally compliant contractual agreements and control measures for outsourced ancillary services in order to ensure the data protection and data security of the Controller‘s data.