Common use of Sub-processors Clause in Contracts

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("Sub-Processors") without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes wish to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten seven (107) business calendar days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 6.3 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.4 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-third parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization authorisation from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof thereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services Service by providing written notice to the Data ProcessorProcessor in accordance with the Service Agreement. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Sub-Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.B.

Sub-processors. 6.1 The Data Processor Thesaurus Software Ltd. is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization authorisation from the Data Controller, provided that the Data Processor Thesaurus Software Ltd. notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Thesaurus Software Ltd. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor Thesaurus Software Ltd. cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor.Thesaurus Software Ltd. 6.3 The Data Processor Thesaurus Software Ltd. shall complete a written sub-processor agreement with any Sub-Sub- Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data ProcessorThesaurus Software Ltd., including the obligations under this Data Processor Agreement. The Data Processor Thesaurus Software Ltd. shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor Thesaurus Software Ltd. is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor Thesaurus Software Ltd. is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor Thesaurus Software Ltd. initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.B.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("Sub-“Sub- Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization authorisa- tion from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Sub- Processor processes any of the Personal Data. If the Data Controller wishes wish to object to the relevant Sub- ProcessorSubProcessor, the Data Controller shall give notice hereof in writing within ten seven (107) business calendar days from receiving the notification from the Data Processor. Absence of any objections ob- jections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement with any Sub-ProcessorsPro- cessors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Pro- cessor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' SubProcessors’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 6.3 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.4 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors SubProcessors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization authorisation from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("Sub-Processors") to process the Personal Data without obtaining any further written, specific authorization authorisation from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Sub- Processor (and its processorsSub-Processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data). If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Main Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written subSub-processor Processing agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Processing Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Sub- Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Processing Agreement using the Sub- Sub-Processors listed in subSub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Sub- Processor shall be added to the list in subSub-appendix B under paragraph 22 as posted on the website of the Data Processor.

Sub-processors. 6.1 The following shall apply for the Data Processor is given general authorisation to engage third-Processor’s engagement of third parties to process the Personal Data ("“Sub-Processors") ”): The Data Processor has general authorisation to engage Sub- Processors without obtaining any further written, specific authorization written consent from the Data Controller, Controller provided that the Data Processor notifies informs the Data Controller in writing about of the identity of a the potential Sub-Processor (and its processors, if anyof any data processor of the SubProcessor) before any agreements are made at least 7 calendar days prior to entering into an agreement with the relevant concerned Sub-Processors and before Processor, thereby giving the relevant Sub-Processor processes any of Data Controller the Personal Dataopportunity to object to such changes. If the Data Controller wishes to object has not objected to the relevant named Sub- ProcessorProcessor within 7 calendar days of the Data Processors notification, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller non-objection shall be deemed consent to the relevant Sub-Processora tacit consent. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement with any Sub-ProcessorsSubProcessor. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under Processor in accordance with this Data Processor Agreement and the Main Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with such data protection obligations, and the Applicable Law. Documentation of such monitoring and control documentation hereof shall be provided to the Data Controller if so requested in writing. 6.4 6.3 The Data Processor is accountable to the Data Controller for any Sub-Processor Processor’s processing of the Personal Data in the same way as for its own actions and omissions. 6.5 6.4 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. Appendix C. If the Data Processor initiates sub-sub processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B Appendix C under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor AgreementRequirements. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so so, requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement Requirements using the Sub- Processors listed in sub-appendix B. A. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.A.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Sub- Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Sub-Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-sub- appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes wish to object to the relevant Sub- ProcessorSubProcessor, the Data Controller shall give notice hereof in writing within ten seven (107) business calendar days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement with any Sub-Sub- Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' SubProcessors’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 6.3 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.4 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors SubProcessors listed in sub-appendix B. If the Data Processor initiates sub-sub- processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 6.1. The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Sub- Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 6.2. In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services Service by providing written notice to the Data Processor. 6.3 6.3. The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Processing Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Data Protection Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 6.4. The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.5. The Data Processor is at the time of entering into this Data Processor Processing Agreement using the Sub- Sub-Processors listed in sub-appendix B. the SPA. If the Data Processor initiates sub-sub- processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2the SPA.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("Sub-“Sub- Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Sub- Processor processes any of the Personal Data. If the Data Controller wishes wish to object to the relevant Sub- ProcessorSubProcessor, the Data Controller shall give notice hereof in writing within ten seven (107) business calendar days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor.. Data Processor Agreement – FromOzz, January 2019 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' SubProcessors’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 6.3 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.4 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors SubProcessors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Sub- Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Controller provides Data Processor with consent to the use by Data Processor of the following Sub-processors to carry out Processing of the Client Personal Data, in each case based in the jurisdictions set out at Section 4.8.1, for the purposes of providing solutions to Data Processor: xxxxx://xxxxxxxxx.xx/legal/subprocessors. 6.2 If Data Processor appoints a new Sub-processor to Process Client Personal Data, Data Processor shall update the link above and provide Data Controller with twenty business days’ prior written notice, during which time Data Controller can object in writing to the appointment. If Data Controller does not object, Data Processor may proceed with the appointment. If Data Controller provides Data Processor with a timely objection and such objection is given general authorisation based on reasonable grounds relating to data protection, then the Parties shall engage thirdin a good-parties faith discussion of such objection. If it can be reasonably demonstrated by the Data Controller that the new Sub-processor is unable to process the Process Client Personal Data ("in compliance with the terms of this Addendum and Data Processor cannot provide an alternative Sub-Processors"processor, or the Parties are not otherwise able to achieve resolution, Data Processor shall, in its sole discretion, either: (i) without obtaining any further written, specific authorization from comply with such objection and not proceed with the appointment in respect of Data Controller; or (ii) proceed with the appointment and, provided as Data Processor’s sole liability and Data Controller’s sole and exclusive remedy, terminate the Agreement, or part thereof, which is affected by such change on written notice to Data Controller. Data Processor ensures that it has a written agreement in place with all Sub-processors which contains obligations on the Sub-processor which are no less onerous on the relevant Sub-processor than the obligations on Data Processor under this Addendum, save that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes is excepted from agreeing provisions equivalent to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-ProcessorSection 4.7. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Sub- Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Sub- Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Sub- Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Sub-Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-sub- appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is not accountable to the Data Controller for any direct dealings with the Pension Regulator or any Pension providers as it is the Data Controller responsibility to ensure all documents are dealt with and were applicable The Data Processor may be able to assist. 6.5 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 6.6 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation authorization to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from on the Data Controller, provided that Processor’s behalf. The Sub-Processors currently engaged by the Data Processor notifies and authorized by the Data Controller are available at: https:// xxxxxxxxxxxxxxxxx.xxx/xxxxx/xxxxx-xxx-xxxxxxxxxx/. The Data Controller shall be notified by the Data Processor in writing about the identity advance of a potential any new Sub-Processors in advance of any new Sub-Processor (and its processorsbeing appointed, if any) before any agreements are made with by changes to the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. aforementioned website. 6.2 If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof in writing within ten seven (107) business calendar days from receiving the notification from after receipt of the Data Processor’s notice in accordance with the mechanism set forth in section 6.1. Absence The absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete conclude a written sub-processor agreement Processing Agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Processing Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Sub-Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Sub- Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Sub-Processor, such new Sub-Processor shall be added to the list in sub-sub- appendix B under paragraph 2.

Sub-processors. 6.1 The Data Processor is given general authorisation to engage third-parties to process the Personal Data ("“Sub-Processors"”) without obtaining any further written, specific authorization authorisation from the Data Controller, provided that the Data Processor notifies the Data Controller in writing about the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Sub-Processor, the Data Controller shall give notice hereof in writing within ten (10) business days from receiving the notification from the Data Processor. Absence of any objections from the Data Controller shall be deemed a consent to the relevant Sub-Processor. 6.2 In the event the Data Controller objects to a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's ’s objection, the Data Controller may terminate the some Membership Services by providing written notice to the Data Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Sub-Processors' ’ compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.

Sub-processors. 6.1 7.1 The Data Processor is given general authorisation to may engage third-third parties to process the Personal Data on its behalf ("“Sub-Processors") without obtaining any further writtenProcessor”), specific authorization from if the Data Controller, provided that Processor has informed the Data Processor notifies the Data Controller thereof in writing about and the identity of a potential Sub-Processor (and its processors, if any) before any agreements are made with the relevant Sub-Processors and before the relevant Sub-Processor processes any of the Personal Data. If the Data Controller wishes to object to the relevant Sub- Processor, the Data Controller shall give notice hereof has not objected in writing within ten days after the Processor provided such information to the Controller. In such event the Sub-Processor becomes approved by the Controller (10“Approved Sub-Processor”). Approved Sub-Processors are listed in Appendix 3 hereto (which shall be updated in the event of changes to the Approved Sub-Processors). Appendix 3 shall list the following information regarding each Approved Sub-Processor: (i) business name, contact information, company form and geographical location, (ii) a description of the services provided, (iii) the location of the Data that the Approved Sub-Processor processes. 7.2 The Processor shall enter into a written agreement with every Sub-Processor, in which the Sub- Processor undertakes obligations at least reflecting those undertaken by the Processor under this Agreement. 7.3 In the event the Controller objects to a Sub-Processor becoming an Approved Sub-Processor in accordance with in Section 7.1 above, then the Processor shall refrain from using such Sub- Processor for processing the Data. The Processor shall in such event use reasonable efforts to make a reasonable change in the services to the Controller to avoid that the Sub-Processor at hand processes the Data. In the event the Processor finds that such change is not practically or commercially reasonable the Processor shall be entitled to terminate the Agreement on 45 days’ notice. The Processor must provide notification of termination to the Controller within 45 days from receiving the notification from day the Data Processor. Absence Controller notified the Processor of any objections from the Data Controller shall be deemed consent its objection to the relevant new Sub-Processor. 6.2 In 7.4 When the event the Data Controller objects to has approved a new Sub-Processor and the Data Processor cannot accommodate the Data Controller's objectionProcessor, the Data Controller may terminate the some Membership Services by providing written notice is not entitled to the Data object to such Sub-Processor. 6.3 The Data Processor shall complete a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub- Processors' compliance with the Applicable Law. Documentation of such monitoring and control shall be provided to the Data Controller if so requested in writing. 6.4 The Data Processor is accountable to the Data Controller for any Sub-Processor in the same way as for its own actions and omissions. 6.5 The Data Processor is at the time of entering into this Data Processor Agreement using the Sub- Processors listed in sub-appendix B. If the Data Processor initiates sub-processing with a new Sub- Processor, such new Sub-Processor shall be added to the list in sub-appendix B under paragraph 2.