Common use of Sub-processing Clause in Contracts

Sub-processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit though CCH OneClick or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after publication receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the Services S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit though CCH OneClick or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after publication receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (ab) The Controller hereby authorizes controller gives permission for the appointment and use of Sub-processor(s) that are engaged in by the Processor for the provision of the Services. The Controller approves gives his approval for the Sub- processor(s) as specified on the website of Processor under "Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees thatProcessors": (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services.xxxxx://xxxxxxxx.xxx/privacy-conditions/ (c) In case the event that the Processor intends to engage enable new or additional more Sub-processors, the Processor shall ensure that the Sub-Processor page on the website is updated. Controller will be informed by Processor about changes in the Sub-Processor list on the website. lf the Controller has reasonable grounds to object to the use of new or more Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall must immediately notify the Processor promptly this in writing within 14 days after publication of receipt of the Sub-Sub- processor NoticeNotification. In the event that the Controller objects to a new or additional Sub-different Sub- processor, and that objection is not unreasonable, the Processor will use make reasonable efforts to make changes to the Services available to the Controller a change in the Services Controller, or to recommend a commercially reasonable change to in the Controller’s configuration or use of the Services to avoid Controller or the use by the Controller of the Services, for the prevention of Processing of Personal Data by the objected-to new or additional other Sub-processor against whom has been objected, without unreasonably burdening the Controller. If the Processor is unable to cannot make this change available such change within a reasonable period of timeperiod, which period shall not exceed ninety sixty (9060) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect Agreement, however only to regarding those Services which that cannot be provided by the Processor without the use of the objected-to new or additional other Sub-processor objected to by providing means of written notice notification to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose processor chooses the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between with the necessary care. (e) lf such a Sub-processor is in a Third Country, at the written request of the Controller,the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant will enter an EU model contract (Controller> Processor) for the services provided by Controller (in the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms name of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries Controller), pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by EU. In this case, theController instructs and authorizes the UK or European Commission (as applicable) and valid from time Processor to time. (e) The Processor and/or Wolters Kluwer Group shall choose instruct the Sub-processor(s) diligentlyprocessors on behalf of the Controller, and to use all the rights of the Controller towards the Sub- processors based on the EU model contract. (f) The Without prejudice to the contents of clause 6 of the DPA, the Processor shall remain remains liable to the Controller for compliance with the performance obligations of the Sub-processor’s obligations, should processor if the Sub-processor fail to does not fulfil its obligations. However, the Processor shall is not be liable for damages damage and claims that ensue arising from instructions from the Controller’s instructions Controller to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by processors can be found at xxxxx://xxx.xxxx xxxx.xxx/xxxxxxxxxxxxx. The Processor shall notify the Processor for the provision Controller in writing of the Services. The Controller approves identity of new sub-processors before entering into an agreement with the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint respective sub-processors) in connection with , allowingthe Controller to reasonably object to the provision appointment of the Servicessub-processor in question within 2weeks after having received notice. (c) In case the Processor intends 8.2 With respect to engage new or additional SubForecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller hereby provides general written authorization for has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor to do so, provided that the Processor shall inform will deem the Controller of any intended changes concerning to have au- thorized the addition or replacement of any Subnew sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to timeprocessor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appoint- ment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this DPA (and any other agreement between the Parties relating to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by sub-processor commence processing personal data, the Processor without shall en- ter into a written agreement with the use of sub-processor, making the objected-to new or additional Subsub-processor by providing written notice subject as a minimum to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between which the Processor and is subject to under the Sub- processor shall in particular provide sufficient guarantees DPA, including the obli- gation to implement adequate technical and organisational measures to ensure that the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect require- ments of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to timeLaw be satisfied. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by processors can be found at xxxxx://xxx.xxxxxxxx.xxx/subprocessors. The Processor shall notify the Processor for the provision Controller in writing of the Services. The Controller approves identity of new sub-processors before entering into an agreement with the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint respective sub-processors) in connection with , allowing the provision Controller to reasonably object to the appointment of the Servicessub-processor in question within 2 weeks after having received notice. (c) In case the Processor intends 8.2 With respect to engage new or additional SubForecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller hereby provides general written authorization for has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor to do so, provided that the Processor shall inform will deem the Controller of any intended changes concerning to have authorized the addition or replacement of any Subnew sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to timeprocessor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appointment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alternative solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this Agreement (and any other agreement between the Parties relating to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Subsub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Lawcommence processing personal data, the Processor shall secure enter into a written agreement with the transfer sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the terms DPA, including the obligation to implement adequate technical and organisational measures to ensure that the requirements of the Standard Contractual Clauses for the Transfer of Personal General Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to timeProtection Regulation be satisfied. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by processors can be found at h ttps://xxx.xxxxxxxx.xxx/subprocessors. The Processor shall notify the Processor for the provision Controller in writing of the Services. The Controller approves identity of new sub-processors before entering into an agreement with the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint respective sub-processors) in connection with , allowing the provision Controller to reasonably object to the appointment of the Servicessub-processor in question within 2 weeks after having received notice. (c) In case the Processor intends 8.2 With respect to engage new or additional SubForecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller hereby provides general written authorization for has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor to do so, provided that the Processor shall inform will deem the Controller of any intended changes concerning to have authorized the addition or replacement of any Subnew sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to timeprocessor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appointment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alternative solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this Agreement (and any other agreement between the Parties relating to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Subsub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Lawcommence processing personal data, the Processor shall secure enter into a written agreement with the transfer sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the terms DPA, including the obligation to implement adequate technical and organisational measures to ensure that the requirements of the Standard Contractual Clauses for the Transfer of Personal General Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to timeProtection Regulation be satisfied. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by processors can be found at xxxxx://xxx.xxxx- xxxx.xxx/xxxxxxxxxxxxx. The Processor shall notify the Processor for the provision Controller in writing of the Services. The Controller approves identity of new sub-processors before entering into an agreement with the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint respective sub-processors) in connection with , allowing the provision Controller to reasonably object to the appointment of the Servicessub-processor in question within 2 weeks after having received notice. (c) In case the Processor intends 8.2 With respect to engage new or additional SubForecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller hereby provides general written authorization for has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor to do so, provided that the Processor shall inform will deem the Controller of any intended changes concerning to have au- thorized the addition or replacement of any Subnew sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to timeprocessor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appoint- ment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between the Parties Last update: 8th November 2021 concerning the appointment, then either party has the right to make available suspend or terminate this DPA (and any other agreement between the Parties relating to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by sub-processor commence processing personal data, the Processor without shall en- ter into a written agreement with the use of sub-processor, making the objected-to new or additional Subsub-processor by providing written notice subject as a minimum to the Processor. (d) The Processor and/or Wolters Kluwer Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between which the Processor and is subject to under the Sub- processor shall in particular provide sufficient guarantees DPA, including the obli- gation to implement adequate technical and organisational measures to ensure that the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect require- ments of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to timeLaw be satisfied. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group group may be retained as Sub- Sub-processors; and (ii) the Processor and Wolters Kluwer Group group respectively may engage third-party Sub- Sub-processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit though CCH OneClick or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-Sub- processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after publication receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer Group group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- Sub-processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-processing. (a) The Controller hereby authorizes As of the appointment and use Effective Date, the list of Supplier’s authorized Sub-processor(sprocessors is set forth in the Service Guidelines, Exhibit B, Attachment B (“Authorized Sub-processors and Locations of Processing”) engaged by the Processor for the provision of the ServicesAgreement, to which SFDC hereby consents. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general Supplier shall request SFDC’s written authorization for the Processor to do so, provided that the Processor shall inform the Controller of consent by emailing xxxxxxx@xxxxxxxxxx.xxx 120 days’ before permitting any intended changes concerning the addition or replacement of any other Sub-processor ("to Process Personal Data. Should SFDC not object to that notification within 120 days, subject to the terms of the Agreement and this Privacy Exhibit, then Supplier may add the new Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at xxxxx://xxx.xxx.xx.xx/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to timeprocessor. If the Controller has SFDC objects to a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller Supplier shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use make reasonable efforts to make available to change the Controller a change in the affected Services or recommend a commercially reasonable change to the ControllerSFDC’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the ControllerSFDC. If the Processor Supplier is unable to make available such change or recommendation within a reasonable period of time, which shall not exceed ninety thirty (9030) days, the Controller SFDC may terminate (notwithstanding any contrary provision in the order form(s) or statement(s) of work relating to Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which that cannot be provided by the Processor Supplier or used by SFDC without the use of Processing by the objected-to new or additional Sub- processor, and Supplier agrees that the objected-to Sub-processor by providing written notice to will not process Personal Data. SFDC shall receive a refund of any prepaid fees for the Processor. (d) The Processor and/or Wolters Kluwer Group period following the effective date of termination in respect of such terminated Services. Supplier shall impose be fully responsible for the same data protection obligations as set out in this DPA on performance of any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement compliance with all of the Technical and Organizational Security Measures as specified in Annex 4, to obligations of the extent such Technical and Organizational Security Measures are relevant for the services provided Agreement by the any Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor processors retained by Supplier to provide Services for SFDC shall remain liable to the Controller for the performance of the at all times be deemed Sub-processor’s obligations, should processors of Supplier and shall not under any circumstance be construed or deemed to be employees or Sub-processors of SFDC. Supplier shall ensure that it has a written contract in place with the relevant Sub-processor fail to fulfil its obligations. However, that contains data protection obligations no less protective than those in the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processorsAgreement. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.