Common use of Sub-processing Clause in Contracts

Sub-processing. 2.1 Customer generally authorises Xxxxx to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by Xxxxx as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally authorises Xxxxx 6.1 Each Subscriber Group Member authorizes iCIMS and each iCIMS Affiliate to appoint (and permit each Sub- Processor appointed in accordance with this Section 6 to appoint) Sub-Processors in accordance with this Paragraph 2Section 6 and any restrictions in the Subscription Agreement. 2.2 Pryon 6.2 iCIMS and each iCIMS Affiliate may continue to use those Sub-Processors already engaged by Xxxxx iCIMS or any iCIMS Affiliate as at the date of this DPA (Addendum, subject to iCIMS and each iCIMS Affiliate in each case as those soon as practicable meeting the obligations set out in Section 6.4. The list of Sub-Processors are shown, together with used to provide the Subscription and their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written country or location of Processing may be accessed at xxxxx://xxxxx.xxxx/GDPR- subprocessors. iCIMS provides a mechanism which may be accessed at xxxxx://xxx.xxxxx.xxx/gc for Subscriber to subscribe to receive email notice of the appointment of any proposed when iCIMS intends to add or replace a Sub-Processor, including reasonable details and if Subscriber subscribes, iCIMS shall provide notification to Subscriber of the Processing such changes. 6.3 Subscriber may object to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the iCIMS’ proposed Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 changes by notifying iCIMS within thirty (European Annex)]. If, within [fourteen (14)] 30) days of receipt iCIMS’ notice in accordance with the mechanism set forth in Section 6.2 (the “Objection Period”) if Subscriber reasonably determines such Sub-Processor is unable to Process Subscriber Personal Data in accordance with the terms of that noticethis Addendum. Such notice shall explain the Subscriber’s good-faith, Customer notifies Pryon in writing of any objections (on reasonable grounds) to grounds for the proposed appointmentobjection. If iCIMS receives a Sub-Processor objection notice from Subscriber within the Objection Period: (a) Pryon 6.3.1 iCIMS shall use reasonable efforts work with Subscriber in good faith to make available a commercially reasonable change in the provision of the Services, Subscription or recommend a reasonable change to Subscriber’s configuration or use of the Subscription which avoids the use of that the proposed Sub-Processor; and (b) where: (i) and where such a change cannot be made within fourteen thirty (1430) days from Xxxxx’s iCIMS’ receipt of Customer’s Subscriber's objection notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear , notwithstanding anything in the cost of the proposed changeSubscription Agreement, then either Party Subscriber may by written notice to the other Party iCIMS within such 30-day period, with immediate effect effect, terminate the Agreementapplicable Order Form(s) with respect only to those Subscriptions (i.e., either in whole or to the extent that it relates to the Services product offering, portal, module, line item) which require cannot be provided by iCIMS without the use of the objected-to new Sub-Processor (the “Terminated Service Portion”). iCIMS will refund to Subscriber any prepaid fees covering the remainder of the Subscription Period for the Terminated Service Portion following the effective date of termination with respect to such Terminated Service Portion, without imposing a penalty for such termination on Subscriber. If Subscriber does not terminate the applicable Order Form(s) within such 30-day period, Subscriber’s objection shall be considered withdrawn and the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorapproved. 2.5 6.4 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and iCIMS or the relevant iCIMS Affiliate shall: 6.4.1 before the Sub-Processor first Processes Subscriber Personal Data (or, where relevant, in accordance with Section 6.2), carry out due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Subscriber Personal Data required by the Subscription Agreement; 6.4.2 ensure that the arrangement between on the one hand (a) iCIMS, or (b) the relevant iCIMS Affiliate, or (c) the relevant intermediate Sub-Processor; and on the other hand, the Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Subscriber Personal Data as those set out in this DPA Addendum and meet the requirements of Data Protection & Privacy Laws, which include Article 28(3) of the GDPR; and 6.4.3 if that arrangement involves a Restricted Transfer, ensure that appropriate safeguards (including e.g., the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a applicable Standard Contractual Clauses, binding corporate rules, etc.) are at all relevant times incorporated into the agreement between on the one hand (a) iCIMS, or (b) the relevant iCIMS Affiliate, or (c) the relevant intermediate Sub-Processor; and on the other hand, the Sub-Processor. 6.5 iCIMS shall be liable for the acts and omissions of its Sub-Processors to the same extent iCIMS would be liable if performing the services of each Sub-Processor directly under the terms of this Addendum. 6.6 The Parties agree that any copy of a Sub-Processor agreement that iCIMS must provide to Subscriber pursuant to the Standard Contractual Clauses may have all commercial, proprietary, and confidential information, and clauses unrelated to this Addendum and the Standard Contractual Clauses, removed or redacted by iCIMS beforehand; and, that such copy will be provided by iCIMS, in a manner mutually agreed upon by the Parties, only upon request by Subscriber. 6.7 For the avoidance of doubt, Subscriber is solely responsible for its integration and/or use of any Third-Party Product to Process Subscriber Personal Data pursuant to or in connection with the Subscription and ensuring that such Processing complies with Data Protection & Privacy Laws. Any Third-Party Product integrated and/or used shall not be deemed a Sub-Processor for any purpose under this Addendum.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer Citrix prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer Citrix notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of Citrix Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by Citrix in its objection(s) and proceed to use the Sub-Processor to process Citrix Personal Information; and/or or (iii) Customer declines Citrix may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of Citrix’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of Citrix's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or applicable ordering document and Citrix will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to Citrix for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as Citrix may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.

Sub-processing. 2.1 Customer generally authorises Xxxxx Distributor represents and warrants that (i) it authorizes the disclosure of Personal Data by Intermedia to appoint its Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue the context of the Service under the conditions set forth below and (ii) it has obtained Purchaser’s authorization for the disclosure of Personal Data by Intermedia to use those its Sub-Processors already engaged by Xxxxx as at in the date context of this DPA (as those the Service under the conditions set forth below, and Intermedia represents and warrants that: 9.1. When sub-processing the Processing of Personal Data in the context of the Service, Intermedia binds its Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (by way of an agreement which imposes on the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice the same or substantially similar data protection obligations as are imposed on Intermedia under this Addendum, in particular providing sufficient guarantees to implement appropriate technical and organizational measures to ensure the Processing will meet requirements under Data Protection Law, to the extent applicable to the nature of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken service provided by the Sub-ProcessorProcessors. Where the Sub-Processor fails to fulfill its data protection obligations under such agreement, [by providing Customer with an updated copy Intermedia shall remain fully liable towards Distributor for the performance of the Sub-Processor List via Processor’s obligations under such agreement. 9.2. Intermedia agrees to provide Distributor with a ‘mailshot’ list of Intermedia’s current Sub-Processors and shall notify Distributor of any addition or similar bulk distribution mechanism sent via replacement of Sub-Processors; provided that Distributor must subscribe to receive email notification(s) in such manner as shall be made available by Intermedia through Distributor’s administrative control panel for Intermedia services. Intermedia shall allow Distributor to Customer’s contact point as set out reasonably object to such changes by notifying Intermedia in Attachment 1 to Annex 1 writing within ten (European Annex)]. If, within [fourteen (14)] 10) business days of after receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision Intermedia’s notice of the Services, which avoids the use addition or replacement of that proposed a Sub-Processor; and (b) where: (i) . Distributor’s objection should be sent to xxxxxxx@xxxxxxxxxx.xxx and explain the reasonable grounds for the objection. If Distributor does not object within such a change cannot period, Distributor shall be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines deemed to bear the cost of the proposed change, then either Party may by written notice have consented to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use Processing of the proposed Personal Data by such Sub-Processor, as its sole and exclusive remedy. 2.4 . If Customer does not object Distributor reasonably objects to Xxxxx’s appointment the addition of a Sub-Processor during and Intermedia cannot reasonably accommodate Distributor’s objection, Intermedia will notify Distributor. Upon receipt of Intermedia’s notification, Distributor may terminate those applicable Services which cannot be provided by Intermedia without the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorsuch Sub- Processor by providing thirty (30) days written notice to Intermedia. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer Citrix prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer Citrix notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of Citrix Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by Citrix in its objection(s) and proceed to use the Sub-Processor to process Citrix Personal Information; and/or or (iii) Customer declines Citrix may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of Citrix’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of Citrix's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole applicable SOW or Order Form and Citrix will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to Citrix for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as Citrix may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.

Sub-processing. 2.1 Customer generally authorises Xxxxx ‌ 6.1 Each Subscriber Group Member authorizes iCIMS and each iCIMS Affiliate to appoint (and permit each Sub- Processor appointed in accordance with this Section 6 to appoint) Sub-Processors in accordance with this Paragraph 2Section 6 and any restrictions in the Subscription Agreement. 2.2 Pryon 6.2 iCIMS and each iCIMS Affiliate may continue to use those Sub-Processors already engaged by Xxxxx iCIMS or any iCIMS Affiliate as at the date of this DPA (Addendum, subject to iCIMS and each iCIMS Affiliate in each case as those soon as practicable meeting the obligations set out in Section 6.4. The list of Sub-Processors are shown, together with used to provide the Subscription and their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written country or location of Processing may be accessed at xxxxx://xxxxx.xxxx/GDPR- subprocessors. iCIMS provides a mechanism which may be accessed at xxxxx://xxx.xxxxx.xxx/gc for Subscriber to subscribe to receive email notice of the appointment of any proposed when iCIMS intends to add or replace a Sub-Processor, including reasonable details and if Subscriber subscribes, iCIMS shall provide notification to Subscriber of the Processing such changes.‌ 6.3 Subscriber may object to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the iCIMS’ proposed Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 changes by notifying iCIMS within thirty (European Annex)]. If, within [fourteen (14)] 30) days of receipt iCIMS’ notice in accordance with the mechanism set forth in Section 6.2 (the “Objection Period”) if Subscriber reasonably determines such Sub-Processor is unable to Process Subscriber Personal Data in accordance with the terms of that noticethis Addendum. Such notice shall explain the Subscriber’s good-faith, Customer notifies Pryon in writing of any objections (on reasonable grounds) to grounds for the proposed appointmentobjection. If iCIMS receives a Sub-Processor objection notice from Subscriber within the Objection Period: (a) Pryon 6.3.1 iCIMS shall use reasonable efforts work with Subscriber in good faith to make available a commercially reasonable change in the provision of the Services, Subscription or recommend a reasonable change to Subscriber’s configuration or use of the Subscription which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy.; and 2.4 If Customer does not object to Xxxxx’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 6.4 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and iCIMS or the relevant iCIMS Affiliate shall:‌ 6.4.1 before the Sub-Processor first Processes Subscriber Personal Data (or, where relevant, in accordance with Section 6.2), carry out due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Subscriber Personal Data required by the Subscription Agreement; 6.4.2 ensure that the arrangement between on the one hand (a) iCIMS, or (b) the relevant iCIMS Affiliate, or (c) the relevant intermediate Sub-Processor; and on the other hand, the Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Subscriber Personal Data as those set out in this DPA Addendum and meet the requirements of Data Protection & Privacy Laws, which include Article 28(3) of the GDPR; and 6.4.3 if that arrangement involves a Restricted Transfer, ensure that appropriate safeguards (including e.g., the Security Measures). Pryon applicable Standard Contractual Clauses, binding corporate rules, etc.) are at all relevant times‌ 6.5 iCIMS shall remain be liable for any breach the acts and omissions of its Sub-Processors to the same extent iCIMS would be liable if performing the services of each Sub-Processor directly under the terms of this DPA caused by Addendum. 6.6 The Parties agree that any copy of a Sub-ProcessorProcessor agreement that iCIMS must provide to Subscriber pursuant to the Standard Contractual Clauses may have all commercial, proprietary, and confidential information, and clauses unrelated to this Addendum and the Standard Contractual Clauses, removed or redacted by iCIMS beforehand; and, that such copy will be provided by iCIMS, in a manner mutually agreed upon by the Parties, only upon request by Subscriber. 6.7 For the avoidance of doubt, Subscriber is solely responsible for its integration and/or use of any Third-Party Product to Process Subscriber Personal Data pursuant to or in connection with the Subscription and ensuring that such Processing complies with Data Protection & Privacy Laws. Any Third-Party Product integrated and/or used shall not be deemed a Sub-Processor for any purpose under this Addendum.

Sub-processing. 2.1 Customer generally Each Group Member authorises Xxxxx Supplier and each Supplier Affiliate to appoint (and permit each Sub-Processor appointed in accordance with this Section 4 to appoint) Sub-Processors in accordance with any restrictions in the Principal Agreement and this Paragraph 2. 2.2 Pryon Addendum. Supplier and each Supplier Affiliate may continue to use those Sub-Processors already engaged by Xxxxx Supplier or any Supplier Affiliate as at the date of this DPA (as those Addendum, subject to Supplier and each Supplier Affiliate meeting the obligations set out in this Section and Supplier providing a list of any such Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (prior to the “Sub-Processor List”). 2.3 Pryon performance of Services. Supplier shall give Customer CSG prior written notice of the appointment of any proposed new Sub-Processor, including reasonable full details of the location and Processing to be undertaken by the Sub-Processor, [by providing Customer Processor prior to or concurrent with an updated copy the appointment of the such Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]Processor. If, within [fourteen 30 (14)] days thirty) calendar days' of receipt of that notice, Customer CSG notifies Pryon Supplier in writing of any objections (on reasonable grounds) to the proposed appointment: : (ai) Pryon shall Supplier will cancel its plan to use reasonable efforts the Sub-Processor for the processing of CSG Personal Information and will offer an alternative to make available a commercially reasonable change in provide the provision of the Services, which avoids the use of that proposed Services without such Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from Xxxxx’s receipt of Customer’s notice; or (ii) no commercially reasonable change is availableSupplier will take the corrective steps requested by CSG in its objection(s) and proceed to use the Sub-Processor to process CSG Personal Information; and/or or (iii) Customer declines CSG may choose not to bear use the cost Services that would involve the use of such Sub-Processor with regard to Personal Information, subject to adjustment of the proposed changeremuneration for the Services considering the reduced scope of the Services. If none of the above options are reasonably available and all of CSG’s objections have not been resolved to the mutual satisfaction of the Parties within 30 (thirty) calendar days of the Supplier's receipt of CSG's objection, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole applicable SOW or Order Form and CSG will be entitled to the extent that it relates to the a pro-rata refund for prepaid fees for Services which require the use not performed as of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to Xxxxx’s appointment date of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 termination. With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and Supplier or the relevant Supplier Affiliate shall: • before the Sub-Processor begins Processing Personal Information, carry out adequate due diligence to ensure that includes the Sub-Processor is capable of providing the level of protection for Personal Information required by this Addendum; • ensure that the arrangement between (a) Supplier or the relevant Supplier Affiliate, and (b) the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data Information as those set out in this DPA Addendum; • provide to CSG for review such copies of the Contracted Processors' agreements with Sub-Processors (including which may be redacted to remove confidential commercial information not relevant to the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Addendum) as CSG may request from time to time. Supplier and each Supplier Affiliate shall be responsible for each such Sub-Processor’s performance of its obligations and compliance with the terms of the Principal Agreement, this Addendum and Applicable Law.