Common use of Sub-processing Clause in Contracts

Sub-processing. 2.1 Customer generally authorises Xxxxx to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally authorises Xxxxx 6.1 Each Subscriber Group Member authorizes iCIMS and each iCIMS Affiliate to appoint (and permit each Sub- Processor appointed in accordance with this Section 6 to appoint) Sub-Processors in accordance with this Paragraph 2Section 6 and any restrictions in the Subscription Agreement. 2.2 Pryon 6.2 iCIMS and each iCIMS Affiliate may continue to use those Sub-Processors already engaged by Xxxxx iCIMS or any iCIMS Affiliate as at the date of this DPA (Addendum, subject to iCIMS and each iCIMS Affiliate in each case as those soon as practicable meeting the obligations set out in Section 6.4. The list of Sub-Processors are shown, together with used to provide the Subscription and their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written country or location of Processing may be accessed at xxxxx://xxxxx.xxxx/GDPR- subprocessors. iCIMS provides a mechanism which may be accessed at xxxxx://xxx.xxxxx.xxx/gc for Subscriber to subscribe to receive email notice of the appointment of any proposed when iCIMS intends to add or replace a Sub-Processor, including reasonable details and if Subscriber subscribes, iCIMS shall provide notification to Subscriber of the Processing such changes. 6.3 Subscriber may object to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the iCIMS’ proposed Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 changes by notifying iCIMS within thirty (European Annex)]. If, within [fourteen (14)] 30) days of receipt iCIMS’ notice in accordance with the mechanism set forth in Section 6.2 (the “Objection Period”) if Subscriber reasonably determines such Sub-Processor is unable to Process Subscriber Personal Data in accordance with the terms of that noticethis Addendum. Such notice shall explain the Subscriber’s good-faith, Customer notifies Pryon in writing of any objections (on reasonable grounds) to grounds for the proposed appointmentobjection. If iCIMS receives a Sub-Processor objection notice from Subscriber within the Objection Period: (a) Pryon 6.3.1 iCIMS shall use reasonable efforts work with Subscriber in good faith to make available a commercially reasonable change in the provision of the Services, Subscription or recommend a reasonable change to Subscriber’s configuration or use of the Subscription which avoids the use of that the proposed Sub-Processor; and (b) where: (i) and where such a change cannot be made within fourteen thirty (1430) days from Xxxxx’s iCIMS’ receipt of Customer’s Subscriber's objection notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear , notwithstanding anything in the cost of the proposed changeSubscription Agreement, then either Party Subscriber may by written notice to the other Party iCIMS within such 30-day period, with immediate effect effect, terminate the Agreementapplicable Order Form(s) with respect only to those Subscriptions (i.e., either in whole or to the extent that it relates to the Services product offering, portal, module, line item) which require cannot be provided by iCIMS without the use of the objected-to new Sub-Processor (the “Terminated Service Portion”). iCIMS will refund to Subscriber any prepaid fees covering the remainder of the Subscription Period for the Terminated Service Portion following the effective date of termination with respect to such Terminated Service Portion, without imposing a penalty for such termination on Subscriber. If Subscriber does not terminate the applicable Order Form(s) within such 30-day period, Subscriber’s objection shall be considered withdrawn and the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorapproved. 2.5 6.4 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and iCIMS or the relevant iCIMS Affiliate shall: 6.4.1 before the Sub-Processor first Processes Subscriber Personal Data (or, where relevant, in accordance with Section 6.2), carry out due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Subscriber Personal Data required by the Subscription Agreement; 6.4.2 ensure that the arrangement between on the one hand (a) iCIMS, or (b) the relevant iCIMS Affiliate, or (c) the relevant intermediate Sub-Processor; and on the other hand, the Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Subscriber Personal Data as those set out in this DPA Addendum and meet the requirements of Data Protection & Privacy Laws, which include Article 28(3) of the GDPR; and 6.4.3 if that arrangement involves a Restricted Transfer, ensure that appropriate safeguards (including e.g., the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a applicable Standard Contractual Clauses, binding corporate rules, etc.) are at all relevant times incorporated into the agreement between on the one hand (a) iCIMS, or (b) the relevant iCIMS Affiliate, or (c) the relevant intermediate Sub-Processor; and on the other hand, the Sub-Processor. 6.5 iCIMS shall be liable for the acts and omissions of its Sub-Processors to the same extent iCIMS would be liable if performing the services of each Sub-Processor directly under the terms of this Addendum. 6.6 The Parties agree that any copy of a Sub-Processor agreement that iCIMS must provide to Subscriber pursuant to the Standard Contractual Clauses may have all commercial, proprietary, and confidential information, and clauses unrelated to this Addendum and the Standard Contractual Clauses, removed or redacted by iCIMS beforehand; and, that such copy will be provided by iCIMS, in a manner mutually agreed upon by the Parties, only upon request by Subscriber. 6.7 For the avoidance of doubt, Subscriber is solely responsible for its integration and/or use of any Third-Party Product to Process Subscriber Personal Data pursuant to or in connection with the Subscription and ensuring that such Processing complies with Data Protection & Privacy Laws. Any Third-Party Product integrated and/or used shall not be deemed a Sub-Processor for any purpose under this Addendum.

Sub-processing. 2.1 4.1 The Customer generally authorises Xxxxx to appoint Sub-shall authorize the following: (a) Processor may engage Sub Processors in accordance connection with this Paragraph 2the provision of the Services. 2.2 Pryon (b) Processor may continue to use those Sub-Sub Processors already engaged by Xxxxx as the Processor at the date of this DPA (as those Sub-Addendum and the Agreement, subject to the Sub Processor in each case meeting the obligations set out in section 4. The Processor uses the Sub Processors are shown, together with their respective functions and locations, specified in Annex 4 (Authorised Sub-Processors) (Privacy Policy at the “Sub-Processor List”)date of this Addendum. 2.3 Pryon (c) Processor shall give Customer prior written notice of the appointment of any proposed Sub-new Sub Processor, including reasonable full details of the Processing to be undertaken by the Sub-Sub Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] 30 days of receipt of that notice, Customer notifies Pryon the Processor in writing of any reasonable objections (on reasonable groundse.g., if making Personal Data available to the Sub Processor may violate applicable Data Protection Law or weaken the protections for such Personal Data) to the proposed appointment:. (ad) Pryon Processor shall use reasonable efforts work with the Customer in good faith to make available a commercially reasonable change in the provision of the Services, Services which avoids the use of that proposed Sub-Sub Processor; and (be) where: (i) where such a change cannot be made within fourteen (14) 30 days from Xxxxx’s Processor's receipt of Customer’s 's notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear , notwithstanding the cost provisions of the proposed changeAgreement, then either Party Customer may by written notice to the other Party Processor with immediate effect terminate the Agreement, either in whole or Agreement to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Sub Processor. 2.5 With respect 4.2 Where no objectin is provided, the Processor shall: (a) before the Sub Processor first Processes Customer Personal Data, carry out adequate due diligence to each Sub-Processor, Pryon shall maintain ensure that the Sub Processor is capable of providing the level of protection for Customer Personal Data required by this Addendum and the Agreement; (b) ensure that the arrangement between the Processor and the Sub Processor is governed by a written contract between Pryon and the Sub-Processor that includes including terms which offer at least an equivalent the same level of protection for Customer Personal Data as those set out in this DPA Addendum and provides for sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of Data Protection Laws; (including c) provide to the Security Measures). Pryon Customer for review such copies of the Processors’ agreements with the Sub Processors (which may be redacted to remove confidential commercial information not relevant to the requirements of this Addendum) as Customer may request from time to time. 4.3 Where the Authorized Sub Processor fails to fulfil its data protection obligations, the Processor shall remain fully liable to the Customer for any breach the performance of this DPA caused by a Sub-that Authorized Sub Processor’s obligations to the extent provided under the terms of the Agreement.

Sub-processing. 2.1 5.1. Customer generally authorises Xxxxx acknowledges and agrees that Netlify may utilize the authorized Sub- processorsset forth in Exhibit 1 Annex III. Customer can subscribe to appoint receive email notification of updates to Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged processors by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: submitting (i) the email address for such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; notifications and (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost full name of the proposed changesubscribing legal entity, then either Party if applicable. 5.2. Netlify shall by email inform Xxxxxxxx who has subscribed to receive notifications of any changes concerning the addition or replacement of sub-processors, at least ten (10) business days prior to such change(s), thereby giving Customer the opportunity to object to such changes. Customer may by written notice object in writing to Xxxxxxx’s intended change concerning Netlify’s Sub-processors within five (5) business days of such notice. 5.3. If it is not possible for Netlify and Customer to resolve the other Party with immediate effect issue within a reasonable time despite both parties’ good faith efforts, notwithstanding anything in the Principal Agreement, Customer may suspend or terminate the Agreement, either in whole or Principal Agreement to the extent that it thatit relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyprocessor. 2.4 If Customer does not object to Xxxxx’s appointment of 5.4. Netlify will enter into a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to written agreement with each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes processor containing terms which offer whichoffer at least an equivalent the same level of protection for Customer Personal Data as those set out in this DPA (including thisDPA, imposing in particular that each Sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Security Measures)Processing will meet the requirements of the GDPR. 5.5. Pryon Netlify shall remain fully liable to Customer for any breach the performance of its Sub-processor's obligations to the same extent Netlify would be liable if performing the Services directlyunder the terms of this DPA caused DPA. 5.6. If Customer and Netlify have entered into Standard Contractual Clauses as described in Section 11 (Transfer Mechanisms for Data Transfers), (i) the above authorizations will constitute Customer’s prior written consent to the subcontracting by a Netlify of the processing of Personal Data if such consent is required under the Standard Contractual Clauses, and (ii) the parties agree that the copies of the agreements with Sub-Processorprocessors that must be provided by Netlify to Customer pursuant to Clause 9(c) of the Standard Contractual Clauses may have commercial information, or information unrelated to the Standard Contractual Clauses or their equivalent, removed by Netlify beforehand, and that such copies will be provided by the Netlify only upon request by Customer.

Sub-processing. 2.1 Customer generally authorises Xxxxx Subscriber acknowledges and agrees that Pingboard may appoint third-parties to appoint Sub-Processors assist in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at providing the date Services and processing of this DPA Personal Data (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor Listprocessors”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed , provided that such Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointmentprocessors: (a) Pryon agree to act only on Pingboard’s instructions when processing Personal Data (which instructions shall use reasonable efforts be consistent with the Subscriber’s processing instructions to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-ProcessorPingboard); and (b) where: (i) such have entered into a change canwritten agreement with Pingboard containing data protection obligations not be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice less protective than those in this DPA with respect to the other Party with immediate effect terminate the Agreement, either in whole or protection of Personal Data to the extent that it relates applicable to the Services which require the use nature of the proposed services provided by such Sub- processor Pingboard shall make available to Subscriber the current list of Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment processors used for the processing of a Personal Data under this DPA at xxxxx://xxxxxxxxx.xxx/legal/subprocessors. When any new Sub-Processor during processor is appointed that will Process Personal Data, Pingboard will, at least thirty (30) days before the new Sub- processor processes any Personal Data, notify Subscriber of the appointment via email at the email address(es) listed in the signature block of this DPA. In the event that Subscriber reasonably objects to the processing of its Personal Data by any Sub-processor, it shall inform Pingboard immediately by emailing its objection period referred and the grounds for its objection to xxx@xxxxxxxxx.xxx. In such event, Pingboard will do one of the following at Pingboard’s option: (a) instruct the Sub-processor to cease any further processing of the Subscriber’s Personal Data, in Paragraph 2.3which event this DPA shall continue unaffected, Customer or (b) allow the Subscriber to terminate this DPA and the Agreement and related Services immediately, in which case Pingboard will provide Subscriber with a pro rata refund of any payment paid in advance for Services but not yet received by Subscriber. Pingboard shall be deemed to have approved liable for the engagement acts and ongoing use omissions of that its Sub-Processor. 2.5 With respect processors to the same extent Pingboard would be liable if performing the services of each Sub-Processorprocessor directly under the terms of this DPA. The Service provides links to integrations with third-party services, Pryon which Customer may, at Customer’s sole discretion, integrate directly into Customer’s instance of the Service and may have access to, or process, Subscriber’s Personal Data. The providers of these third-party services shall maintain a written contract between Pryon and the not be deemed Sub-Processor that includes processors for any purpose under this DPA. If Customer elects to enable, access or use such third-party services, its access and use of such third-party services is governed solely by the terms and conditions and privacy policies of such third-party services, and Pingboard does not endorse, is not responsible or liable for, and makes no representations as to any aspect of such third-party services, including, without limitation, the manner in which offer at least an equivalent level of protection for Customer they handle Subscriber’s Personal Data as those set out in this DPA (including the Security Measures)Data. Pryon shall remain Pingboard is not liable for any breach of this DPA damage or loss caused or alleged to be caused by a Subor in connection with Customer’s enablement, access or use of any such third-Processorparty services, or Subscriber’s reliance on the privacy practices, data security processes or other policies of such third-party services.

Sub-processing. 2.1 Customer generally authorises Xxxxx Processor shall not subcontract its obligations under this Addendum or under the Service Contract to appoint Suba sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at processor without the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice consent of Controller. Processor shall inform Controller of its intention to engage a sub-processor and Controller shall have the right to consent to the appointment of any proposed Suba new sub-Processorprocessor, including reasonable details which consent shall not be unreasonably withheld, conditioned or delayed. If Controller agrees to the appointment of sub-processors, those sub‑processors must be appointed on the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or substantially similar bulk distribution mechanism sent via email to Customer’s contact point terms as are set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) this Addendum with respect to the proposed appointment: protection of Customer Data to the extent applicable to the nature of the services provided by such sub-processor. Controller hereby approves the appointment of the following third-party sub-processors: Amazon Web Services (ato the extent that the Controller has purchased a cloud hosted solution) Pryon shall use reasonable efforts to make available a commercially reasonable change as its web hosting provider (and All Lines Technology in the provision U.S. to the extent the Controller has purchased the Emerald support package) by Processor as a sub-processer. Controller acknowledges and agrees that Affiliates of Panopto EMEA Limited will be retained as sub-processors. Except as otherwise set forth in the ServicesServices Contract, which avoids Processor shall be liable for the use act and omission of that proposed Subits sub-Processor; and processors to the same extent Processor would be liable if performing the services of each sub-processor directly under this Addendum. Processor may, by giving no less than thirty (b30) where: (i) such a change cannot be made days’ notice to Controller, as or make changes to the list of sub- processors. Controller may object to the appointment of an additional sub-processor within fourteen (14) days from Xxxxxof such notice on reasonable grounds relating to the protection of Personal Data, in which case Processor shall have the right to cure the objection through one of the following options (to be selected at Processor’s sole discretion): (a) Processor will cancel its plans to use such sub-processor with regard to Personal Data or will offer an alternative to provide its services without such sub-processor; (b) Processor will take the corrective steps requested by Controller in its objections (which remove Controller’s objection) and proceed to use the sub-processor with regard to the Personal Data; or (c) Processor may cease to provide or Controller may agree not to use (temporarily or permanently) the particular aspect of the services that would involve the use of such sub-processor with regard to Personal Data, subject to a mutual agreement of the parties to adjust the remuneration for the services provided considering the reduced scope of the services to the extent possible. If note on the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Processor’s receipt of CustomerController’s notice; (ii) no commercially reasonable objection, either party may terminate the Agreement and Controller will be entitled to a pro-rata refund for the prepaid fees for the services not performed as of the date of termination. Notwithstanding the foregoing, Processor may replace a sub-processor if the need for the change is available; and/or (iii) Customer declines urgent and necessary to bear provide the cost Processor’s services and the reason for the change is beyond the Processors control in which case Processor shall notify Controller of such replacement as soon as reasonably practicable and Controller shall retain the proposed change, then either Party may by written notice right to object to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Subreplacement sub-Processor, processor as its sole and exclusive remedyset forth above. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally authorises Xxxxx to appoint 7.1. DT engages Sub-Processors in accordance to perform certain Processing of Supply Partner Personal Data on Supply Partner’s behalf. Prior to an engagement with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed a Sub-Processor, including reasonable details DT: (i) Carries out reviews and requires or receives adequate assurances that the Sub-Processor complies with obligations substantially similar to the obligations as set out in this Addendum; and (ii) ensures that a Statutory Data Transfer Agreement or such other appropriate methods of Personal Data transfer are at all relevant times incorporated into the Processing to be undertaken by agreement executed between DT and the Sub-Processor, [by providing Customer if the engagement with an updated copy the Sub-Processor involves a Personal Data Transfer of Supply Partner Personal Data,. 7.2. Upon the execution of this Addendum, Supply Partner hereby gives DT Supply Partner’s approval to engage the companies detailed at xxxx://xxxxxxxxxxxxxx.xxx/legal/sub- processor-list-for-dtx as Sub-Processors. 7.3. Where a Sub-Processor fails to fulfill its data protection obligations or statements, DT will remain fully liable to Supply Partner for the performance of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) Processor's obligations to the proposed appointment: (a) Pryon shall use reasonable efforts same extent that DT would be liable to make available a commercially reasonable change Supply Partner directly under the terms of this Addendum, except as otherwise set forth in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to if DT would have performed the extent that it relates to the Services which require the use obligations of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect 7.4. DT will inform Supply Partner of DT’s engagement with a new Sub-Processor. Supply Partner may object to each the use of new or additional Sub-Processor by sending DT a written notice within five (5) business days of receipt of said notice. If Supply Partner objects to the new Sub-Processor, Pryon shall maintain a written contract between Pryon DT will make commercially reasonable efforts to provide Supply Partner the same level of Service without the use of such Sub-Processor. Notwithstanding, Supply Partner’s objection and the Sub-Processor that includes terms which offer at least an equivalent level results thereof will not amend, alter or reduce Supply Partner’s obligations under the Agreement. Supply Partner will not be entitled to any refund and will hold DT harmless from and against any claims, suits and demands associated with or related to Supply Partner’s termination of protection for Customer Personal Data as those set out the Agreement, in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by connection with Supply Partner’s objection to a new Sub-Processor. 7.5. Notwithstanding the provisions here above (e.g. prior consent by Supply Partner), Supply Partner hereby authorizes DT to sub-contract the Processing to Sub-Processors based outside of Supply Partner’s jurisdiction, to the extent necessary, at DT sole discretion, to duly perform the Service on condition that the Sub-Processors provide sufficient guarantees in relation to required level of data protection, e.g. through a sub-contracting agreement which is based on a Statutory Data Protection Agreement , or based on such other applicable Personal Data Transfer mechanisms. Any such Statutory Data Protection Agreement concluded by DT will be treated as if concluded in the name and on behalf of Supply Partner. Supply Partner will be responsible to obtain regulatory approvals from the relevant Supervising Authorities and to perform any submissions and registrations, as required by Data Protection Laws.

Sub-processing. 2.1 Customer generally authorises Xxxxx 7.1 Third Party shall be authorized to appoint engage other Processors in relation to the Contract Data Processing (each a "Sub-Processor") only in accordance with the Main Contract and subject to the following provisions. 7.2 Any engagement of a Sub-Processor requires prior written consent of the Company and a confidentiality undertaking by the Sub-Processors. Third Party shall provide the Company with a list of Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at required for performance of its obligations under the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon Main Contract. Third Party shall give Customer the Company prior written notice of the intended appointment of any proposed new Sub-Processor, including reasonable full details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days four weeks of receipt of that notice, Customer the Company notifies Pryon the Third Party in writing of any objections (on reasonable grounds) grounds to the proposed appointment: (a) Pryon , Third Party shall use work with the Company in good faith to take reasonable efforts measures to make available a commercially reasonable change in address the provision of objections raised by the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) Company and where such a change measure cannot be made agreed within fourteen (14) days four weeks from XxxxxThird Party’s receipt of Customer’s the Company's notice; , the Third Party shall not appoint (iinor disclose any Company Personal Data to) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyProcessor except with the prior written consent of the Company. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 7.3 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Third Party shall: (a) before any Company Personal Data are transferred to the Sub-Processor, carry out adequate due diligence to ensure that the Sub-Processor that includes terms which offer at least an equivalent is capable of providing the level of protection for Customer Company Personal Data required by this Agreement and the Main Contract; (b) enter into a written agreement with the Sub-Processor which imposes the same obligations on the Sub-Processor in relation to the protection of Company Personal Data as those set out are imposed on Third Party under the NDPR and this Agreement. This shall apply in particular, but shall not be limited to, the confidentiality obligations and the Data Security Standards to be observed pursuant to Section 3; (c) immediately upon request provide the Company with the sub-contracting agreement and any other documentation reasonably requested by the Company (it being understood that the Third Party shall be permitted to redact any commercial terms which are confidential and not required by the Company to assess compliance with their obligations under this DPA (including Agreement); 7.4 Third Party shall ensure that each Sub-Processor complies with this Agreement, the Security Measures). Pryon NDPR and any other relevant data protection law. 7.5 Third Party shall at all times and without being so requested provide the Company with an up to date list of Sub-Processors, detailing company name, address, contact details, the specific area of Contract Data Processing operations outsourced and the location of the Processing. 7.6 In case of non-compliance of the Sub-Processor with its contractual obligations, the Third Party shall remain fully liable to the Company for any breach of this DPA damages caused by a such non- compliance and shall indemnify and hold harmless the Company against any claims or damages in connection with or resulting from the engagement of the Sub-Processor.

Sub-processing. ‌ 2.1 Customer Client generally authorises Xxxxx Inselligence to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon Inselligence may continue to use those Sub-Processors already engaged by Xxxxx Inselligence as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 3 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon Inselligence shall give Customer Client prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] ) days of receipt of that notice, Customer Client notifies Pryon Inselligence in writing of any objections (on reasonable grounds) to the proposed appointment:appointment:‌ (a) Pryon Inselligence shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from XxxxxInselligence’s receipt of CustomerClient’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer Client declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer Client does not object to XxxxxInselligence’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer Client shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon Inselligence shall maintain a written contract between Pryon Inselligence and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Client Personal Data as those set out in this DPA (including the Security Measures). Pryon Inselligence shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 a. In accordance with the structure of the Services as described in Section 2 of this DPA, Customer generally authorises Xxxxx consents to appoint Xxxxxxx Xxxxx'x use of Sub-Processors (which shall be understood as potentially any Rosetta Stone affiliates or subsidiaries, as defined in this DPA) in the performance of Xxxxxxx Xxxxx'x obligations under the Agreement in accordance with the terms of the this Paragraph 2DPA. 2.2 Pryon may continue b. In addition to the possible use those Sub-Processors already engaged by Xxxxx of Xxxxxxx Xxxxx’x affiliates or subsidiaries as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) , Customer authorizes Xxxxxxx Xxxxx to engage, as third parties Sub-Processors, the entities listed at xxxxx://xxxxxxx.xxxxxxxxxxxx.xxx/s/article/Enterprise -and-Education-Subprocessors?language=en_US (the “as may be updated by Xxxxxxx Xxxxx from time to time). For TrueNorth and Webcape products, a list of third party sub processors can be obtained on demand. i. If Customer subscribes to such webpage, Rosetta Stone shall inform Customer of any Sub-Processor List”)additions or replacements by updating such webpage at least ten (10) days prior to the addition or replacement. 2.3 Pryon c. Customer may object to a Sub-Processor addition or replacement solely on reasonable grounds by notifying Rosetta Stone of its objection and the grounds within ten (10) days after receipt of Xxxxxxx d. Notwithstanding the foregoing, Xxxxxxx Xxxxx may replace a Sub-Processor if the need for the change is urgent and necessary to provide the Services and continuity thereof. In such instance, Rosetta Stone shall give notify Customer prior written notice of the appointment replacement as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-Processor pursuant to this paragraph. e. Xxxxxxx Xxxxx shall remain at all times responsible for and fully liable to Customer for the Sub-Processors' performance of any proposed its obligations. Xxxxxxx Xxxxx shall also enter into a binding written agreement with each authorized Sub-Processor that imposes, for the concerned processing, the same or greater obligations as Xxxxxxx Xxxxx’x obligations as set forth under this DPA. i. When Rosetta Stone LLC acts as a Sub-Processor, including reasonable details where applicable, Rosetta Stone LLC shall comply with the obligations imposed on "data importers" under Module THREE of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy EU Model Clauses ("P2P Model Clauses"). ii. For purposes of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. IfP2P Model Clauses, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon Sections 6 and 7 below shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyapply. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally authorises Xxxxx 7.1 Third Party shall be authorized to appoint engage other Processors in relation to the Contract Data Processing ("Sub-Processor") only in accordance with the Main Contract and subject to the following provisions. 7.2 Any engagement of a Sub-Processor requires prior written consent of the Company and a confidentiality undertaking by the Sub-Processors. Third Party shall provide the Company with a list of Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at required for performance of its obligations under the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon Main Contract. Third Party shall give Customer the Company prior written notice of the intended appointment of any proposed new Sub-Processor, including reasonable full details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days four weeks of receipt of that notice, Customer the Company notifies Pryon the Third Party in writing of any objections (on reasonable grounds) grounds to the proposed appointment: (a) Pryon , Third Party shall use work with the Company in good faith to take reasonable efforts measures to make available a commercially reasonable change in address the provision of objections raised by the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) Company and where such a change measure cannot be made agreed within fourteen (14) days four weeks from XxxxxThird Party’s receipt of Customer’s the Company's notice; , the Third Party shall not appoint (iinor disclose any Company Personal Data to) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyProcessor except with the prior written consent of the Company. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 7.3 With respect to each Sub-Processor, Pryon shall maintain Third Party shall (a) where processing may result in high risk within the context of the NDPA conduct a written contract between Pryon data privacy impact assessment before any Company Personal Data are transferred to the Sub-Processor, and carry out adequate due diligence to ensure that the Sub-Processor that includes terms which offer at least an equivalent is capable of providing the level of protection for Customer Company Personal Data required by this Agreement and the Main Contract; (b) enter into a written agreement with the Sub-Processor which imposes the same obligations on the Sub-Processor in relation to the protection of Company Personal Data as those set out are imposed on Third Party under the NDPA and this Agreement. This shall apply in particular, but shall not be limited to, the confidentiality obligations and the Data Security Standards to be observed pursuant to Section Error! Reference source not found.; (c) immediately upon request provide the Company with the sub-contracting agreement and any other documentation reasonably requested by the Company (it being understood that the Third Party shall be permitted to redact any commercial terms which are confidential and not required by the Company to assess compliance with their obligations under this DPA (including the Security MeasuresAgreement). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.;

Sub-processing. 2.1 6.1 Customer generally authorises Xxxxx Raft to appoint Sub-Processors in accordance with this Paragraph 2Section 6. Without limitation to the foregoing, Customer authorises the engagement of the Sub- Processors listed as of the Addendum Effective Date at the URL specified in Section 6.2. 2.2 Pryon may continue to use those 6.2 Information about Raft’s Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shownProcessors, together with including their respective functions and locations, is available at: xxxxx://xxx.xxxx.xx/xxxx-xxxxxxxxxxxxx-xxxxxx in Annex 4 the Data Processing Agreement section (Authorised Subas may be updated by Raft from time-Processorsto-time) or such other website address as Raft may provide to Customer from time to time (the “Sub-Processor ListSite”). 2.3 Pryon shall give 6.3 When Raft engages any Sub-Processor after the Addendum Effective Date, Raft will notify Customer prior written notice of the appointment engagement (including the name and location of any proposed the relevant Sub-Processor, including reasonable details of Processor and the Processing to be undertaken activities it will perform) by the Sub-Processor, [by providing Customer with an updated copy of updating the Sub-Processor List via a ‘mailshot’ Site or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 by other written means at least thirty (European Annex)]30) days before such Sub-Processor Processes Customer Personal Data. If, within [fourteen ten (14)] 10) days of receipt being notified of that noticesuch engagement, Customer notifies Pryon Raft in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon Raft shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen thirty (1430) days from XxxxxRaft’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the SaaS Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 6.4 If Customer does not object to XxxxxXxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3Section 6.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 6.5 With respect to each Sub-Processor, Pryon Raft shall maintain a written contract between Pryon Raft and the Sub-Processor that includes terms which offer at least an equivalent a level of protection for Customer Personal Data as substantially similar to those set out in this DPA (including the Security Measures). Pryon Raft shall remain liable for any breach of this DPA caused by a Sub-ProcessorProcessor to the same extent as Raft would have been had Raft performed the Processing itself.

Sub-processing. 2.1 Customer generally authorises Xxxxx to appoint 8.1 The Supplier may Process the Personal Data in the locations and with the Sub-Processors processors set out in accordance with Annex 2 to this Paragraph 2.Schedule in order to perform the Services.‌ 2.2 Pryon 8.2 The Customer may continue to use those receive notifications of new Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those processors and updates to existing Sub-Processors are shownprocessors by subscribing for updates. If the Customer subscribes, together the Supplier will provide the subscriber with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed new Sub-Processorprocessor, including reasonable full details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]processor. If, within [fourteen thirty (14)] 30) days of receipt of that notice, Customer the Company notifies Pryon the Supplier in writing of any reasonable objections (on reasonable grounds) to the proposed appointment:, neither the Supplier nor any Supplier Affiliate shall disclose any Personal Data to that proposed Sub-processor until reasonable steps have been taken to address the objections raised by the Customer and the Customer has been provided with a reasonable written explanation of the steps taken. (a) Pryon shall 8.3 In the event the Customer objects to a new Sub-processor, the Supplier will use reasonable efforts to make a change to the affected Services available a or recommend commercially reasonable change in changes to the provision Customer’s configuration or use of the ServicesServices to avoid the Processing that is the subject of the objection. If the Supplier is unable to make available such changes within a reasonable period of time, the Customer may terminate the applicable Service Order with respect only to those Services which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear provided by the cost Supplier without use of the proposed change, then either Party may objected-to Sub-processor by providing written notice to the other Party Supplier. The Supplier will then refund the Customer any prepaid fees covering the remainder of the term of such Service Order following the effective date of termination with immediate effect terminate respect to such terminated Services. 8.4 The Customer provides a general consent for the AgreementSupplier to engage onward Sub-processors, either provided the following requirements are satisfied: (a) any onward sub-processor must agree in whole writing to only process data in a country that the European Commission has declared to have an “adequate” level of protection or to the extent that it relates only process data on terms equivalent to the Services which require applicable Standard Contractual Clauses, or pursuant to Binding Corporate Rules and (b) the use Supplier will restrict the onward Sub-processor’s access to Personal Data only to what is strictly necessary to provide the Services, and will prohibit the Sub-processor from processing the Personal Data for any other purpose. 8.5 The Supplier will enter into a written agreement with each Sub-processor containing data protection obligations no less protective than those contained in this Data Protection Schedule with respect to the protection of Personal Data. The Parties agree that the copies of the proposed Sub-Processorprocessor agreements that must be provided by the Supplier to the Customer pursuant to the relevant Standard Contractual Clauses may have all commercial information, as or clauses unrelated to the Standard Contractual Clauses or their equivalent, removed by the Supplier beforehand; and, that such copies will be provided by the Supplier, in a manner to be determined in its sole and exclusive remedydiscretion, only upon the written request of the Customer. 2.4 If Customer does not object to Xxxxx’s appointment 8.6 Use of a Sub-Processor during processor will not relieve, waive or diminish any obligation the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved Supplier has under the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon Agreement and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain Supplier is liable for any breach acts or omissions of this DPA caused by a any Sub-Processor.processor to the same extent as if the acts or omissions were performed by the Supplier.‌

Sub-processing. 2.1 Customer generally authorises Xxxxx 4.1 VWGoA on its own behalf grants Supplier a general consent to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue engage Authorized Persons, including subcontractors, to use those Sub-Processors already engaged by Xxxxx perform the Services as needed. The list of authorized subprocessors at the date of the signature of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, DPSA is included in Annex 4 (Authorised Sub-Processors) (2 to this DPSA unless otherwise specified in the “Sub-Processor List”)Agreement. 2.3 Pryon 4.2 If Supplier uses subcontractors to fulfill its obligations under the Agreement, it will: • Conduct reasonable due diligence to ensure that the subcontractor is capable of providing the level of protection for the VWGoA Data or Systems as required by the DPSA and Applicable Law; • Execute a written contract detailing the terms of the sub-processing activities and providing for provisions which offer at least the same level of protection of VWGoA Data or VWGoA Systems as this DPSA and provide a copy to VWGoA; • Ensure no transfer outside the jurisdiction in which the Personal Information was collected without prior authorization from VWGoA; • Ensure that no Personal Information from the European Economic Area (EEA), Switzerland or the United Kingdom (UK) is transferred to countries and territories, which the EEA, Switzerland and the UK have not granted an adequacy status, without the execution between the Supplier and subcontractor of a valid transfer mechanism, such as the EU Standard Contractual Clauses (SCCs) Module 3 (Processor to Processor) and/or the UK International Transfer Addendum; • Ensure any subcontractor adheres to the terms of this DPSA as if it were a party to it; • Keep a list of subcontractor agreements, which shall be updated regularly and made available to VWGoA upon request; • Ensure that the subcontractor performs the obligations under this DPSA, as if it were a party to the DPSA in place of Supplier, except that Supplier will coordinate communication with VWGoA and is entitled to make and receive communication in relation to this DPSA on behalf of any subcontractors. Supplier shall obtain the necessary authorization from the subcontractors in this regard. • Ensure that Supplier notifies VWGoA of any subcontractors hired by its subcontractors and that such additional subcontractors are bound by written agreement to the terms of this DPSA, Applicable Law and offer the same level of protection to VWGoA Data or VWGoA Systems as Supplier and its subcontractors. 4.3 Supplier shall give Customer VWGoA prior written notice of the appointment of any proposed Sub-Processorsubcontractor, including reasonable full details of the Processing to be undertaken by the Sub-Processorsubcontractor, [by providing Customer with an updated copy the name and contact details of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]subcontractor and the date of the subcontracting agreement. If, within [fourteen (14)] days 4 weeks of receipt of that notice, Customer VWGoA notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon , Supplier shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of not appoint that proposed Subsubcontractor except with the prior written authorization of VWGoA. Should Supplier choose to retain the objected-Processor; and (b) where: (i) such a change cannot be made within to subcontractor, Supplier will notify VWGoA at least fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear before appointing the cost subcontractor and VWGoA may immediately discontinue using the relevant portion of the proposed change, then either Party Service and VWGoA may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use relevant portion of the proposed Sub-ProcessorService within thirty (30) days. Upon termination by VWGoA pursuant to this section, as its sole and exclusive remedySupplier shall refund VWGoA any prepaid fees for the terminated portions of the Service that were to be provided after the effective date of termination. 2.4 If Customer does not object 4.4 Where subcontractor fails to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With fulfil its obligations with respect to each Sub-ProcessorVWGoA Data or Systems, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon Supplier shall remain fully liable to VWGoA for any breach of this DPA caused by a Sub-Processorthat subcontractor.

Sub-processing. 2.1 Customer generally authorises Xxxxx to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those 6.1 You authorise our engagement of the Sub-Processors already engaged by Xxxxx as us at the date of this DPA (as those Sub-Processors DPA, which are shown, together with their respective functions and locations, in set out at Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”)2. 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed 6.2 Where we wish to engage a new Sub-Processor, including reasonable we agree to provide written notice to you of the details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy engagement of the Sub-Processor List via at least 14 days’ prior to engaging the new Sub-Processor (including details of the processing it will perform). You may object in writing to our appointment of a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, new Sub-Processor within [fourteen (14)] 7 days of receipt of that such notice, Customer notifies Pryon in writing of any objections (provided that such objection is based on reasonable grounds) grounds relating to data protection. In such event, the proposed appointmentParties will discuss such concerns in good faith with a view to achieving resolution. If the Parties are not able to achieve resolution, we may, at our election: (a) Pryon shall use reasonable efforts not appoint the proposed Sub-Processor; (b) not disclose any Customer Personal Data to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; andor (bc) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party inform you that we may by written notice to the other Party with immediate effect terminate the AgreementProcurePro SaaS Supply Terms (including this DPA) for convenience, either in whole or which case, clause Error! Reference source not found. will apply. 6.3 You agree that the remedies described above in clauses 6.2(a)-(c) are the only remedies available to the extent that it relates you if you object to the Services which require the use of the any proposed Sub-Processor, as its sole and exclusive remedyProcessor by us. 2.4 If Customer does not object to Xxxxx’s appointment of 6.4 Where we engage a Sub-Processor during to process Customer Personal Data, we agree to enter into a written agreement with the objection period Sub-Processor containing data protection obligations no less protective that those in this DPA with respect to the Customer Personal Data, and to remain responsible to you for the performance of such Sub-Processor’s data protection obligations under such terms. 6.5 Where the transfer of Customer Personal Data from us to a Sub-Processor is a Restricted Transfer, it will be subject to the UK Addendum (and documents or legislation referred to in Paragraph 2.3within it), Customer which shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processorbe incorporated into this DPA, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least UK Addendum is considered an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processorappropriate safeguard.

Sub-processing. 2.1 5.1 Customer generally authorises Xxxxx to appoint hereby acknowledges and agrees that Digital Realty may engage (i) Digital Reality affiliates as sub- processors; and (ii) the sub-processors set out at xxxxx://xxx.xxxxxxxxxxxxx.xxx/about/legal/privacy/sub-processors. Customer acknowledges and agrees that the other party may engage third-party Sub-Processors processors in accordance connection with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed . That other Party will enter into a written agreement with each Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt processor containing data protection obligations that provide at least the same level of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed changeprotection for Personal Data as those in this DPA, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates applicable to the Services which require the use nature of the proposed Services provided by such Sub-Processor, as its sole and exclusive remedyprocessor. 2.4 5.2 Customer hereby consents to this list of sub-processors, their locations, and processing activities as it pertains to its Personal Data. Digital Realty shall: (A) make available an up-to-date list of the sub-processors it has appointed upon written request from Customer; and (B) notify Customer if it adds any new sub-processors at least 14 days prior to allowing such sub-processor to process Customer Personal Data. Customer may request the current list of Sub- processors for the Services, including the identities of those Sub-processors and their country of location via email from Xxxxxxx@xxxxxxxxxxxxx.xxx. Customer will have 14 days from the date of receipt of the notice to approve or reject the change. If Customer does not object to Xxxxx’s appointment of a Subin this time period, the sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall processor will be deemed accepted. If Customer rejects the replacement sub-processor, Digital Realty may terminate the services relying on the replacement sub-processor with immediate effect on written notice to have approved the engagement and ongoing use of that Sub-ProcessorCustomer. 2.5 With respect 5.3 Digital Realty is responsible under the Applicable Data Protection Laws for the acts or omissions of its sub-processors to the same extent it would be liable if performing the Services of each Sub-Processor, Pryon shall maintain a written contract between Pryon and processor directly under the Subterms of this DPA. Digital Realty will impose data protection obligations upon any sub-Processor processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as are no less protective than those set out included in this DPA. This DPA (including may be executed electronically and in any number of counterparts, each of which is an original and all of which evidence the Security Measures)same agreement between the parties. Pryon Except for matters covered by this DPA, this DPA is subject to the terms of the Agreement. Except as specifically amended and modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. The exclusions and limitations on liability contained in the Agreement shall remain liable for apply to any breach liability arising under or in respect of this DPA. The terms of this DPA caused by a Sub-Processorwill control to the extent there is any conflict between terms of this DPA and the terms of the Agreement. If there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail with respect to Personal Data that is subject to EU GDPR or UK GDPR.

Sub-processing. 2.1 7.1 The Customer hereby specifically authorises the engagement of any VIPRE Affiliate as a sub-Processor. 7.2 Customer also generally authorises Xxxxx to appoint Subthe use of third party sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shownVIPRE, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointmentprovided that: (a) Pryon VIPRE shall use reasonable efforts to make available a commercially reasonable change in restrict the provision sub-Processor’s processing of the Customer Personal Data to processing that is necessary to provide or maintain the Services, which avoids ; (b) VIPRE shall enter into contractual arrangements with such sub-Processors requiring them to guarantee a similar level of data protection compliance and information security to that provided for herein to the use of that proposed Subextent applicable to the processing activities being provided by such sub-Processor; and (c) if a sub-Processor fails to comply with its data protection obligations, VIPRE shall remain fully liable to the Customer for the performance (or failure of performance) of the sub-Processor’s data protection obligations. 7.3 VIPRE shall maintain an up to date list of its sub-Processors relating to any Services it provides to the Customer. VIPRE shall provide the list to the Customer upon written request. 7.4 VIPRE will, by email notification to the Customer Representative, notify the Customer if any new sub- Processor is appointed during the Term and Customer shall have the opportunity to object to the use of such sub-Processor. If the Customer: (a) does not respond (in writing) within 30 days from the date of the notification, it will deemed to have given its authorisation to the use of such sub-Processor; (b) where: responds by refusing (iin writing) its authorisation and a mutually acceptable resolution to such a change refusal cannot be made within fourteen (14) days from Xxxxx’s receipt agreed, it may terminate the service or that part of the service which is provided by VIPRE using the relevant sub-Processor. This termination right is Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyremedy if Customer objects to any new third party Sub-processor. 2.4 If Customer does 7.5 Notwithstanding sub-sections 7.1 to 7.4 above, and subject to applicable law, VIPRE may freely use sub- contractors or suppliers that do not object qualify as processors under the Data Protection Legislation, including but not limited to Xxxxx’s appointment of a Sub-Processor during energy suppliers, equipment suppliers, transport suppliers, technical service providers, hardware vendors etc.) without having to inform or seek prior authorisation from the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-ProcessorCustomer. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 a. In accordance with the structure of the Services as described in Section 2 of this DPA, Customer generally authorises Xxxxx consents to appoint Xxxxxxx Xxxxx'x use of Sub-Processors (which shall be understood as potentially any Rosetta Stone affiliates or subsidiaries, as defined in this DPA) in the performance of Xxxxxxx Xxxxx'x obligations under the Agreement in accordance with the terms of the this Paragraph 2DPA. 2.2 Pryon may continue b. In addition to the possible use those Sub-Processors already engaged by Xxxxx of Xxxxxxx Xxxxx’x affiliates or subsidiaries as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) , Customer authorizes Rosetta Stone to engage, as third parties Sub-Processors, the entities listed at xxxxx://xxxxxxx.xxxxxxxxxxxx.xxx/s/article/Enterpris e-and-Education-Subprocessors?language=en_US (the “as may be updated by Rosetta Stone from time to time). i. If Customer subscribes to such webpage, Rosetta Stone shall inform Customer of any Sub-Processor List”)additions or replacements by updating such webpage at least ten (10) days prior to the addition or replacement. 2.3 Pryon c. Customer may object to a Sub-Processor addition or replacement solely on reasonable grounds by notifying Rosetta Stone of its objection and the grounds within ten (10) days after receipt of Xxxxxxx Xxxxx'x notice. In the event of such an objection, Rosetta Stone may elect to not engage such Sub-Processor. If Rosetta Stone continues use of such Sub-Processor after Customer’s reasonable objection, then Customer may elect to immediately (without prejudice to accrued fees or other rights under the Agreement) suspend or terminate the Agreement upon notice to Rosetta Stone. d. Notwithstanding the foregoing, Rosetta Stone may replace a Sub-Processor if the need for the change is urgent and necessary to provide the Services and continuity thereof. In such instance, Rosetta Stone shall give notify Customer prior written notice of the appointment replacement as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-Processor pursuant to this paragraph. e. Rosetta Stone shall remain at all times responsible for and fully liable to Customer for the Sub-Processors' performance of any proposed its obligations. Rosetta Stone shall also enter into a binding written agreement with each authorized Sub-Processor that imposes, for the concerned processing, the same or greater obligations as Xxxxxxx Xxxxx’x obligations as set forth under this DPA. i. When Rosetta Stone LLC acts as a Sub-Processor, including reasonable details where applicable, Rosetta Stone LLC shall comply with the obligations imposed on "data importers" under Module THREE of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy EU Model Clauses ("P2P Model Clauses"). ii. For purposes of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. IfP2P Model Clauses, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon Sections 6 and 7 below shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedyapply. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer Citrix prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer Citrix notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of Citrix Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by Citrix in its objection(s) and proceed to use the Sub-Processor to process Citrix Personal Information; and/or or (iii) Customer declines Citrix may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of Citrix’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of Citrix's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole applicable SOW or Order Form and Citrix will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to Citrix for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as Citrix may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.

Sub-processing. 2.1 Customer generally 5.1 The Parties acknowledge that Data Protection Laws permit the Partner to provide the Company a written authorization to Sub Processing. Under the DPA, Partner authorises Xxxxx Company to appoint Sub-(and permit each Sub Processor appointed in accordance with this section 5) Sub Processors in accordance with this Paragraph 2section and any restrictions in the Agreement. 2.2 Pryon may continue to use those 5.2 A list of Company’s current Sub-Processors already engaged by Xxxxx as is available upon demand at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”)xxxxxxx@XXXX.XXX.XXX. 2.3 Pryon 5.3 Company shall give Customer prior written provide Partner with advance notice of the appointment of before a new Sub Processor processes any proposed Sub-ProcessorPersonal Data, including reasonable full details of the Processing processing to be undertaken by the Sub-Sub Processor. Partner may object to the new Sub Processor within fifteen (15) days of such notice on reasonable grounds relating to the protection of Personal Data In such case, [by providing Customer with an updated copy Company shall have the right to cure the objection through one of the Subfollowing options: (1) Company will cancel its plans to use the Sub Processor with regards to processing of Personal Data or will offer an alternative to provide the Services without such Sub Processor; or (2) Company will take the corrective steps requested by Partner in its objection notice and proceed to use the Sub processor or (3) Company may elect to proceed with its use of the new sub-Processor List via a ‘mailshot’ processor in which case Partner or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: may decide (a) Pryon shall not to use, whether temporarily or permanently, the particular aspect or feature of the Services that would involve the use reasonable efforts of such Sub Processor (b) in case (a) is not feasible to make available a commercially reasonable change in the provision terminate its use of the Services, which avoids the use of . 5.4 Company shall: (a) enter into a written agreement in accordance with same requirements as set forth on Data Protection Laws with any Sub Processor that proposed Sub-Processor; and (will process Personal Data and b) where: (i) ensure that each such a change cannot be made within fourteen (14) days from Xxxxx’s receipt written agreement contains terms that are no less protective of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as than those set out contained in this DPA and (including the Security Measures). Pryon shall remain c) be liable for any breach the acts and omissions of its Sub Processors to the same extent that Company would be liable if it were performing the Services of each of those Sub Processors directly under the terms of this DPA caused by a Sub-ProcessorDPA. 5.5 The Company, in providing the Services shall transfer Personal Data outside of EEA. Company ensures that Company will comply with any requirements (such as Standard Contractual Clauses and any other legal transfer mechanism) under Data Protection Laws with regard to such Personal Data Transfers.

Sub-processing. 2.1 7.1. The Customer generally authorises Xxxxx to appoint acknowledges and agrees that SureCloud may use the following third parties (each a “DP Sub-Processors in accordance processor”) to process any Personal Data on behalf of the Customer pursuant to this Agreement: • Rackspace Ltd with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together Company number 03897010; • Armor Defense Ltd with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall Company number 07827728; • 2nd Quadrant Ltd with Company number 04075460. SureCloud will give Customer not less than thirty days’ prior written notice of the proposed appointment of any proposed replacement or additional DP Sub-Processor, including reasonable details processor. Customer must notify SureCloud of any objection to such appointment within five days after receiving notice of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to proposed appointment from SureCloud; if Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) objection to the proposed appointment: appointment is reasonable, XxxxXxxxx will re- arrange the processing arrangements so that proposed appointee is not used to process Personal Data or make such other amendment to the terms of the Agreement as the parties (aacting reasonably and in good faith) Pryon shall use reasonable efforts agree is appropriate to make available a commercially reasonable reflect the change in the provision sub-processing arrangements or, if neither of these options is practicable, SureCloud will so notify Customer which shall be entitled to terminate this Agreement by giving SureCloud not less than thirty days’ notice, such notice being given within thirty days following Customer’s receipt of SureCloud’s notice that it is not practicable to either re-arrange the Servicesprocessing to avoid the need to use the proposed sub-processor or to agree appropriate amendments to the terms of this Agreement. 7.2. If SureCloud proposes to sub-contract the processing of any Personal Data on behalf (directly or indirectly) of Customer, which avoids SureCloud will ensure that the use proposed sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures in such a way that its processing will comply with the Data Protection Legislation. 7.3. If SureCloud sub-contracts the processing of that proposed any Personal Data to any third party on behalf (directly or indirectly) of Customer including any replacement or additional sub-contractor pursuant to Clause 7.1 (each a “DP Sub-Processorprocessor”), SureCloud will enter into a written agreement with such DP Sub- processor and include in that agreement at least: 7.3.1. obligations on the DP Sub-processor which are equivalent to the obligations on SureCloud in relation to Personal Data under this Agreement; 7.3.2. obligations on the DP Sub-processor not to sub-contract the processing of any Personal Data on behalf (directly or indirectly) of Customer to any third party without ensuring that each Sub- processor is bound by equivalent obligations to the obligations on SureCloud under this agreement; and 7.3.3. provisions in favour of Customer equivalent to those in this Schedule 1; 7.4. If SureCloud sub-contracts the processing of any Personal Data on behalf (bdirectly or indirectly) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; , SureCloud will not consent to any such DP Sub-processor further sub-contracting the processing of any Personal Data on behalf (iidirectly or indirectly) no commercially reasonable change is available; and/or (iii) of Customer declines without ensuring that such DP Sub-processor enters into a written agreement with its sub-sub-processor including provisions equivalent to bear the cost of the proposed change, then either Party may by written notice those in Clauses 7.3.1 to 7.3.3 inclusive; 7.5. SureCloud remains fully liable to the other Party with immediate effect terminate Customer for the Agreement, either in whole or to the extent that it relates to the Services which require the use performance of the proposed each of its DP Sub-Processor, as its sole processors and exclusive remedytheir sub-contractors in relation to processing Personal Data. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 5.1 To the extent required under Applicable Laws, Customer generally authorises Xxxxx to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue specifically authorizes CrowdStrike to use those Sub-Processors Subprocessors already engaged by Xxxxx as at of the date of this DPA and listed at: CrowdStrike Subprocessors. In addition, and subject to Section 5.3, Customer generally authorizes CrowdStrike’s engagement of other third parties as Subprocessors (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor ListNew Subprocessor(s)”). 2.3 Pryon 5.2 CrowdStrike shall give Customer prior written provide notice of a New Subprocessor to the appointment Customer at least 30 days prior to CrowdStrike’s use of any proposed Sub-Processorthe New Subprocessor to Process Customer Personal Data, through the applicable CrowdStrike Offering or platform, where Customer may elect to subscribe to such notices. Customers may also sign up for email notifications at xxxxx://xxx.xxxxxxxxxxx.xxx/Subprocessor-notification/. Customer is responsible for ensuring that its notification email addresses remain current. During the notice period, Customer may object to a New Subprocessor in writing and CrowdStrike may, in its sole discretion, attempt to resolve Customer’s objection, including reasonable details providing the Offerings without use of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]New Subprocessor. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: If (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the ServicesCrowdStrike provides Customer written notice that it will not pursue an alternative, which avoids the use of that proposed Sub-Processor; and or (b) where: (i) such a change an alternative cannot be made available by CrowdStrike to Customer within fourteen (14) 90 days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost providing notice of the proposed changeits objection, then in either Party may by written notice case, and notwithstanding anything to the other Party with immediate effect contrary in the Agreement or Order, Customer may terminate the Agreement, either in whole Agreement or Order to the extent that it relates to the Services Offerings which require the use of the proposed Sub-Processor, as its sole and exclusive remedyNew Subprocessor. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 5.3 With respect to each Sub-ProcessorSubprocessor, Pryon shall maintain to the extent required under Applicable Laws, CrowdStrike shall: 5.3.1 Carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Customer Personal Data required by Applicable Laws, this DPA and the Agreement; 5.3.2 Have a written contract between Pryon CrowdStrike and Subprocessor with that obligates the Sub-Processor that includes terms which offer at least an equivalent Subprocessor to provide substantially the same level of protection for Customer Personal Data as those required by this DPA and Applicable Laws, including Customer’s ability to protect the rights of Data Subjects in the event CrowdStrike is insolvent, liquidated or otherwise ceases to exist; 5.3.3 Apply an adequacy mechanism recognized by Customer’s Supervisory Authority as ensuring an adequate level of data protection under Applicable Laws where Subprocessor’s Processing of Customer Personal Data involves a Restricted Transfer; 5.3.4 Maintain copies of the agreements with Subprocessors and make these reasonably available upon Customer’s written request. To the extent necessary to protect Confidential Information, CrowdStrike may redact the copies prior to sharing with Customer; and 5.3.5 Notify Customer of Subprocessor’s relevant failure to comply with obligations set out in by Applicable Laws and this DPA (including the Security Measures). Pryon shall remain liable for any breach where CrowdStrike has received notice of this DPA caused by a Sub-Processorsuch.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer Citrix prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer Citrix notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of Citrix Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by Citrix in its objection(s) and proceed to use the Sub-Processor to process Citrix Personal Information; and/or or (iii) Customer declines Citrix may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of Citrix’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of Citrix's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or applicable ordering document and Citrix will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to Citrix for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as Citrix may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer CSG prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer CSG notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of CSG Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by CSG in its objection(s) and proceed to use the Sub-Processor to process CSG Personal Information; and/or or (iii) Customer declines CSG may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of CSG’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of CSG's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole applicable SOW or Order Form and CSG will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to CSG for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as CSG may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.

Sub-processing. 2.1 Customer generally authorises Xxxxx 4.1 VWGoA on its own behalf grants Supplier a general consent to appoint Sub-Processors in accordance with this Paragraph 2engage Authorized Persons, including subcontractors, to perform the Services as needed. 2.2 Pryon may continue 4.2 If Supplier uses subcontractors to use those Subfulfill its obligations under the Agreement, it will: • Conduct reasonable due diligence to ensure that the subcontractor is capable of providing the level of protection for the VWGoA Data or Systems as required by the DPSA and Applicable Law; • Execute a written contract detailing the terms of the sub-Processors already engaged by Xxxxx processing activities and providing for provisions which offer at least the same level of protection of VWGoA Data or VWGoA Systems as at this DPSA and provide a copy to VWGoA; • Ensure no transfer outside the date jurisdiction in which the Personal Information was collected without prior authorization from VWGoA; • Ensure any subcontractor adheres to the terms of this DPA (DPSA as those Sub-Processors if it were a party to it; • Keep a list of subcontractor agreements, which shall be updated regularly and made available to VWGoA upon request; • Ensure that the subcontractor performs the obligations under this DPSA, as if it were a party to the DPSA in place of Supplier, except that Supplier will coordinate communication with VWGoA and is entitled to make and receive communication in relation to this DPSA on behalf of any subcontractors. Supplier shall obtain the necessary authorization from the subcontractors in this regard. • Ensure that Supplier notifies VWGoA of any subcontractors hired by its subcontractors and that such additional subcontractors are shownbound by written agreement to the terms of this DPSA, together with their respective functions Applicable Law and locations, in Annex 4 (Authorised Sub-Processors) (offer the “Sub-Processor List”)same level of protection to VWGoA Data or VWGoA Systems as Supplier and its subcontractors. 2.3 Pryon 4.3 Supplier shall give Customer VWGoA prior written notice of the appointment of any proposed Sub-Processorsubcontractor, including reasonable full details of the Processing to be undertaken by the Sub-Processorsubcontractor, [by providing Customer with an updated copy the name and contact details of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]subcontractor and the date of the subcontracting agreement. If, within [fourteen (14)] days 4 weeks of receipt of that notice, Customer VWGoA notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon , Supplier shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of not appoint that proposed Subsubcontractor except with the prior written authorization of VWGoA. Should Supplier choose to retain the objected-Processor; and (b) where: (i) such a change cannot be made within to subcontractor, Supplier will notify VWGoA at least fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear before appointing the cost subcontractor and VWGoA may immediately discontinue using the relevant portion of the proposed change, then either Party Service and VWGoA may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use relevant portion of the proposed Sub-ProcessorService within thirty (30) days. Upon termination by VWGoA pursuant to this section, as its sole and exclusive remedySupplier shall refund VWGoA any prepaid fees for the terminated portions of the Service that were to be provided after the effective date of termination. 2.4 If Customer does not object 4.4 Where subcontractor fails to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With fulfil its obligations with respect to each Sub-ProcessorVWGoA Data or Systems, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon Supplier shall remain fully liable to VWGoA for any breach of this DPA caused by a Sub-Processorthat subcontractor.

Sub-processing. 2.1 8.1. Customer generally authorises Xxxxx to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use expressly authorizes the engagement of those Sub-Processors already engaged by Xxxxx as listed at the date xxxxx.xxx/xxxxxxx. Veeva will update its list of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, on its website at least ten (10) days in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice advance of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of allowing the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 Process Personal Data (“Notice Period”); Customer can subscribe to Annex 1 (European Annex)]. If, within [fourteen (14)] days receive notifications of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed new Sub-Processor; and (b) where: Processors at xxxxx.xxx/xxxxxxx. If Customer has a good faith belief that the new Sub-Processor will be unable to comply with (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; Applicable Law, or (ii) no commercially reasonable change is available; and/or (iii) and appropriate privacy or security standards, Customer declines may object to bear the cost Veeva’s appointment of the proposed changenew Sub-Processor by sending written notification to Veeva documenting, then either Party with specificity, its objection and its good faith basis therefor (the “Objection”). Veeva’s engagement of such new Sub-Processor will be deemed authorized by Customer unless Veeva receives an Objection during the Notice Period. Upon receipt of an Objection, the parties will investigate the basis of the Objection and work together in good faith to seek a mutually agreeable solution. If after thirty (30) days, the parties are unable to agree upon an alternative solution, Customer may by written notice to terminate its order for the other Party with immediate effect terminate the Agreement, either in whole or to the extent applicable Service(s) that it relates to the Services which require the makes use of the proposed Sub-Processor; such notice must be received within forty-five (45) days of the original Objection, as its sole and exclusive remedyunless an extension is agreed to in writing by the parties. 2.4 If Customer does not object 8.2. Veeva shall require all Sub-Processors to Xxxxx’s appointment of agree, in writing, to substantively the same data protection obligations as apply to Veeva under this Addendum. Veeva shall agree to a third party beneficiary clause with each Sub-Processor during whereby, in the objection period referred event Veeva has factually disappeared, ceased to exist in Paragraph 2.3law or has become insolvent, Customer shall be deemed may terminate the Sub- Processor contract, but only as it relates to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Services provided by the Sub-Processor that includes terms which offer at least an equivalent level to Customer under the relevant agreement. Veeva is solely responsible for the acts and omissions of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a its Sub-ProcessorProcessors as such acts and omissions relate to this Addendum and the Services under the Agreement.

Sub-processing. 2.1 Customer generally authorises Xxxxx Distributor represents and warrants that (i) it authorizes the disclosure of Personal Data by Intermedia to appoint its Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue the context of the Service under the conditions set forth below and (ii) it has obtained Purchaser’s authorization for the disclosure of Personal Data by Intermedia to use those its Sub-Processors already engaged by Xxxxx as at in the date context of this DPA (as those the Service under the conditions set forth below, and Intermedia represents and warrants that: 9.1. When sub-processing the Processing of Personal Data in the context of the Service, Intermedia binds its Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (by way of an agreement which imposes on the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice the same or substantially similar data protection obligations as are imposed on Intermedia under this Addendum, in particular providing sufficient guarantees to implement appropriate technical and organizational measures to ensure the Processing will meet requirements under Data Protection Law, to the extent applicable to the nature of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken service provided by the Sub-ProcessorProcessors. Where the Sub-Processor fails to fulfill its data protection obligations under such agreement, [by providing Customer with an updated copy Intermedia shall remain fully liable towards Distributor for the performance of the Sub-Processor List via Processor’s obligations under such agreement. 9.2. Intermedia agrees to provide Distributor with a ‘mailshot’ list of Intermedia’s current Sub-Processors and shall notify Distributor of any addition or similar bulk distribution mechanism sent via replacement of Sub-Processors; provided that Distributor must subscribe to receive email notification(s) in such manner as shall be made available by Intermedia through Distributor’s administrative control panel for Intermedia services. Intermedia shall allow Distributor to Customer’s contact point as set out reasonably object to such changes by notifying Intermedia in Attachment 1 to Annex 1 writing within ten (European Annex)]. If, within [fourteen (14)] 10) business days of after receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision Intermedia’s notice of the Services, which avoids the use addition or replacement of that proposed a Sub-Processor; and (b) where: (i) . Distributor’s objection should be sent to xxxxxxx@xxxxxxxxxx.xxx and explain the reasonable grounds for the objection. If Distributor does not object within such a change cannot period, Distributor shall be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines deemed to bear the cost of the proposed change, then either Party may by written notice have consented to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use Processing of the proposed Personal Data by such Sub-Processor, as its sole and exclusive remedy. 2.4 . If Customer does not object Distributor reasonably objects to Xxxxx’s appointment the addition of a Sub-Processor during and Intermedia cannot reasonably accommodate Distributor’s objection, Intermedia will notify Distributor. Upon receipt of Intermedia’s notification, Distributor may terminate those applicable Services which cannot be provided by Intermedia without the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorsuch Sub- Processor by providing thirty (30) days written notice to Intermedia. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 6.1. Customer generally authorises Xxxxx authorizes AppsFlyer and each AppsFlyer Affiliate to appoint Sub-(and permit each Sub Processor appointed in accordance with this Section 6 to appoint) Sub Processors in accordance with this Paragraph 2Section 6 and any restrictions in the Agreement. 2.2 Pryon may continue to use those Sub-6.2. The Sub Processors already engaged used by Xxxxx as at the date of this DPA AppsFlyer are specified at: xxxxx://xxx.xxxxxxxxx.xxx/subprocessors (as those Sub-“Sub Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor ListWebsite”). 2.3 Pryon 6.3. AppsFlyer may appoint new Sub Processors at any time and shall give update the Sub Processors Website upon such appointments. If Customer prior written wishes to receive notice of any new Sub Processors, it may request to receive such notice by subscribing at the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Sub Processors Website. If, within [fourteen ten (14)] 10) days of receipt of that such notice, Customer notifies Pryon AppsFlyer in writing of any reasonable objections (on reasonable grounds) to the proposed appointment: (a) Pryon , AppsFlyer shall not utilize such Sub Processor to Process Customer Personal Data until reasonable steps have been taken to address the objections raised by Customer, such as a change to Customer’s configuration or use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids Services to avoid Processing of Personal Data by the use of that proposed objected-to new Sub-Processor; and processor. Where such steps are not sufficient to relieve Customer’s reasonable objections and a solution has not been found within reasonable period of time which shall not exceed twenty (b) where: (i) such a change cannot be made within fourteen (1420) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed changeobjection notification, then either Party may Customer or AppsFlyer may, by written notice to the other Party Party, with immediate effect effect, terminate the Agreement, either in whole or Agreement to the extent that it relates to the Services which require the use of the proposed Sub-Sub Processor, as its sole and exclusive remedywithout bearing liability for such termination. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 6.4. With respect to each Sub-Sub Processor, Pryon shall maintain a written contract between Pryon and AppsFlyer shall: (a) take reasonable steps to ensure that the Sub-Sub Processor that includes terms which offer at least an equivalent is committed to provide the level of protection for Customer Personal Data as those required by the Agreement; (b) ensure that the arrangement between AppsFlyer and the Sub Processor is governed by a written contract, including terms which, to the extent applicable to the nature of services provided by the Sub Processor, offer a level of protection that, in all material respects, are consistent with the levels set out in this DPA and the Agreement; and (including c) remain fully liable to the Security Measures). Pryon shall remain liable Customer for any breach the performance of this DPA caused by a Sub-the Sub Processor’s data protection obligations where the Sub Processor fails to fulfill such obligations.