Common use of Sub-processors Clause in Contracts

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by included in the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-Sub- processors authorised published at xxxxx://xxx.xxxxxx.xx.xx/subprocessing-list to process the Personal Data which shall include the identities of Sub-processors and their country of locationData. During the term of this DPA, the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) processor to process Personal DataData in connection with the provision of the Services. 6.4 The Controller may object to the use of a new or replacement Sub-processor, processor by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Sub-Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses the applicable SCCs with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the ServicesProducts. 6.2 All Sub-processors who process Personal Data in the provision of the Services Products to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement MSA and the Processor shall make makes available to the Controller a list of Sub-processors published at www.insert who are authorised to process the Personal Data which shall include ´includes the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) before authorising any new or replacement Sub-Sub- processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement MSA with respect to those Services Products which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement MSA following the effective date of termination with respect to such terminated ServicesProducts. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall shall: (i) prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: ; (iii) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (iiiii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services Products to the Controller in accordance with the Agreement MSA to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place, such as the EU-US Privacy Shield or Binding Corporate Rules.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall shall: (i) prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: ; (iii) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (iiiii) ensure each such Sub-Sub- Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place, such as the EU-US Privacy Shield or Binding Corporate Rules.

Sub-processors. 6.1 4.1. The Controller acknowledges and agrees that: (i) Affiliates Processor may use or replace a third party or several third parties for the Processing of Personal Data under this DPA if the Processor may be used as has entered into a written agreement with the Sub-processors; and (ii) processor for the Processing of Personal Data, in which the Sub-processor is imposed in all material respects similar obligations as the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in under this DPA. 6.3 4.2. The Processor shall ensure that the Controller authorises is aware of what Sub-processors Process Personal Data by, without undue delay upon the Processor to use Controller’s request, providing correct and updated information about all Sub-processors, where the following information is specified for each Sub-processor: a) definition of the Sub-Processors already engaged by processor, including its contact information, company form and geographical location; b) what kind of service the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process processor is performing; and c) where the Sub-processor is Processing the Personal Data which shall include the identities of covered by this DPA. 4.3. The Processor may not use a Sub-processors and their processor if that means that Personal Data will be transferred to a Third country of locationunless the provisions in section 5 are met. 4.4. During The Processor is fully responsible for the term of this DPASub-processor’s Processing in relation to the Controller. 4.5. When the Processor intends to hire a new Sub-processor or replace an existing one, the Processor shall provide verify the Sub-processor’s capacity and ability to meet their obligations in accordance with the Data Protection Legislation. The Processor shall notify the Controller with prior notification, via email, of any changes to in writing of a) the list of Sub-processor(sprocessor’s name, corporate identity number and head office (address and country),which type of data and categories of Data Subjects are being processed, and b) before authorising any new or replacement Sub-processor(s) to process where the Personal DataData will be processed. 6.4 4.6. The Controller may is entitled within thirty (30) days of the notice pursuant to item 4.5 to object to the use Processor’s hiring of a new or replacement Sub-processorprocessor and, by notifying due to such an objection, to cancel this Agreement to be terminated in accordance with the Processor promptly in writing within ten (10) Business Days after receipt provisions of the Processor’s noticeitem 4.7 of this Agreement. 4.7. If the Controller objects to the Processor using a new or replacement Sub-processor, pursuant to item 12.6 of this Agreement, the Controller may is entitled to terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement immediate effect. 4.8. Sub-processor. The Processor will refund processors are listed in the Controller any prepaid fees covering the remainder “List of the term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place” available at xxxxxxx.xx/xxxxx/xxx-xxxxxxxxxx.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of locationauthorised to process the Personal Data. During the term of this DPA, the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: ; (i) appoint each Sub- Processor processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor Sub- processor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processors: (i) processors are located in a third country or territory recognised recognized by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 7.1 The Data Controller acknowledges and agrees that: (i) : 7.1.1 Affiliates of the Data Processor may be used as Sub-processors; and (ii) and 7.1.2 the Data Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the Services. 6.2 7.2 All Sub-processors who process Personal Data in the provision of the Services to the Data Controller shall comply with the obligations of the Data Processor set out in this DPA. 6.3 7.3 The Data Controller authorises the Data Processor to use the Sub-Processors already engaged by included in the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of locationData. During the term of this DPA, the Data Processor shall provide the Data Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) Sub- processor to process Personal DataData in connection with provision of the Services. 6.4 7.4 The Data Controller may object to the use of a new or replacement Sub-processor, by notifying the Data Processor promptly in writing within ten (10) Business Days 14 days after receipt of the Data Processor’s notice. If the Data Controller objects to a new or replacement Sub-processor, the Data Controller may terminate the Agreement with respect to those Services which cannot be provided by the Data Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 7.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Data Processor set out in this DPA. The Data Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: (i) appoint : 7.5.1 Appoint each Sub- Processor Sub-processor under a written contract containing materially the same obligations to those of the Processor processor in this DPA enforceable by the Data Processor; and (ii) ensure ; 7.5.2 Ensure each such Sub-Processor processor complies with all such obligations. 6.6 7.6 The Data Controller agrees that the Processor and its Sub-Processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Data Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). Agreement.. The Data Processor confirms that such SubsuchSub-Processors: (i) are : 7.6.1 Are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have or 7.6.2 Have entered into Standard Contractual Clauses the applicable SCCs with the Data Processor; or (iii) have or 7.6.3 Have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of locationauthorised to process the Personal Data. During the term of this DPA, the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: ; (i) appoint each Sub- Processor Subprocessor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor Subprocessor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processors: (i) processors are located in a third country or territory recognised recognized by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the System and Services. 6.2 All Sub-processors who process Personal Data in the provision of the System and Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those System and Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated System or Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall shall: (i) prior to the relevant Sub-Sub- Processor carrying out any processing activities in respect of the Personal Data: ; (iii) appoint each Sub- Sub-Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.and

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the ServicesService. 6.2 All Sub-processors who process Personal Data in the provision of the Services Service to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by processors included in the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-Sub- processors authorised published at: xxxxx://xxxxxxxxxxxxx.xxx/gdpr/subprocessors/ to process the Personal Data which shall include the identities of Sub-processors and their country of locationData. During the term of this DPA, the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) processor to process Personal DataData in connection with provision of the Service. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten fifteen (1015) Business Days days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services Service which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated ServicesService. 6.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Processor Sub-processor under a written contract containing materially the same obligations to those of the Processor processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor processor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services Service to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses the applicable SCCs with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-Sub- processors; and (ii) the Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by processors included in the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-Sub- processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of locationData. During the term of this DPA, the The Processor shall provide notify the Controller with prior notification, via email, of any intended changes to concerning the list of Sub-processor(s) before authorising any new addition or replacement Sub-processor(s) of other processors, thereby giving the Controller the opportunity to process Personal Dataobject to such changes. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Processor Sub-processor under a written contract containing materially the same obligations to those of the Processor processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor processor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses the applicable SCCs with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a the current list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) who may process Personal Data before authorising any new or replacement Sub-processor(s) to process Personal DataData in connection with the provision of the Services. 6.4 The Controller may object to the use of a new or replacement Sub-processor, processor by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, and that objection is not unreasonable, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-Sub- processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall shall: (i) prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: ; (iii) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (iiiii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Solution and Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-ProcessorsSub- processors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place, such as the EU-US Privacy Shield or Binding Corporate Rules.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of location. During the term of this DPA, the Processor shall provide the Controller with prior notification, via email, of any changes to the list of Sub-processor(s) before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: ; (i) appoint each Sub- Sub-Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligations. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processors: : (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place, such as the EU-US Privacy Shield or Binding Corporate Rules.

Sub-processors. 6.1 The Controller acknowledges and agrees that: (i) Affiliates of the Processor may be used as Sub-processors; and (ii) the Processor and its Affiliates respectively may engage Sub- Sub-processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors processors already engaged by the Processor as at the date of the Agreement and the Processor shall make available to the Controller a list of Sub-processors authorised to process the Personal Data which shall include the identities of Sub-processors and their country of locationauthorised to process the Personal Data. During the term of this DPA, the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the list of Sub-processor(s) processors before authorising any new or replacement Sub-processor(s) to process Personal Data. 6.4 The Controller may object to the use of a new or replacement Sub-processor, by notifying the Processor promptly in writing within ten (10) Business Days after receipt of the Processor’s notice. If the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund the Controller any prepaid fees covering the remainder of the term Term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors processors who process Personal Data shall comply with the obligations of the Processor set out in this DPA. The Processor shall prior to the relevant Sub-Processor processor carrying out any processing activities in respect of the Personal Data: ; (i) appoint each Sub- Processor Sub-processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor processor complies with all such obligations. 6.6 The Controller agrees that the Processor and its Sub-Processors processors may transfer make Restricted Transfers of Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA)Agreement. The Processor confirms that such Sub-Processorsprocessors: (i) are located in a third country or territory recognised by the EU Commission or a Supervisory Authority, as applicable, to have an adequate level of protection; or (ii) have entered into the applicable Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.

Sub-processors. 6.1 8.1. The Controller acknowledges agrees and agrees that: hereby authorizes the Processor to engage third parties for the processing of the Personal Data (the "Sub-processors") and change Sub-processors subject to the rules set our herein. Sub-processors will be subject to the same confidentiality obligations and adequate guarantees for the security of Personal Data as those provided for the Processor in this DPA. The Controller acknowledges, agrees, and xxxxxx gives a written authorization under Article 28 of the GDPR to the Processor to engage its Affiliates as Sub- processors. A list of its Affiliates will be maintained on its website xxxxx://xxxxxxx.xxx/ (or successor page). 8.2. Changes to the Sub-processors will be subject to sending a written notice to the Controller, at the e-mail address available in the Processor’s records. Subject to having a legitimate reason under Data Protection Law, Controller will have 30 (thirty) days from the notice to send a written notice to the Processor exercising its right to object to the change and terminate the applicable Service or requesting Kubeark that the Parties discuss in good faith a resolution to the objection no later than the end of the 30-day period. The objection notice will contain at least the following to be valid (i) Affiliates the name of the Processor may Service to be used as Sub-processors; terminated and (ii) the Processor and its Affiliates respectively may engage Sub- processors in connection with the provision of the Services. 6.2 All Sub-processors who process Personal Data in the provision of the Services to the Controller shall comply with the obligations of the Processor set out in this DPA. 6.3 The Controller authorises the Processor to use the Sub-Processors already engaged by the Processor as at termination date, which will be no later than 30 (thirty) days from the date of the Agreement and the Processor shall make available Processor’s notice to the Controller a list of Controller. The Company acknowledges its sole and exclusive remedy for objecting to any change in Sub-processors authorised is the termination of the Main Agreement, but only limited to process the Personal Data Service for which shall include the identities of new Sub-processors and their country of locationprocessor is intended to be used. During After the 30 (thirty) days term of this DPAwith no written notice received from the Controller, Kubeark will deem in good faith that the Processor shall provide Company has accepted the Controller with prior notification, via email, of any changes to the list of change in Sub-processor(s) before authorising any new or replacement processors. 8.3. Notwithstanding the foregoing rules setting out the procedure for changes in Sub-processor(s) to process Personal Data. 6.4 The Controller processors, Processor may object to the use of replace a new or replacement Sub-processor, by notifying processor without advance notice to Controller where the Processor promptly in writing within ten (10) Business Days after receipt reason for the change is outside of the Processor’s noticereasonable control and prompt replacement is required for regulatory, security, system integrity, business continuity purposes or other urgent reasons. If Processor will inform the Controller objects to a new or replacement Sub-processor, the Controller may terminate the Agreement with respect to those Services which cannot be provided by the Processor without the use of the new or replacement Sub-processor. The Processor will refund as soon as possible following such change, and the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated Services. 6.5 All Sub-Processors who process Personal Data shall comply with the obligations of the Processor procedure set out in this DPA. The Processor shall prior to the relevant Sub-Processor carrying out any processing activities in respect of the Personal Data: (i) appoint each Sub- Processor under a written contract containing materially the same obligations to those of the Processor in this DPA enforceable by the Processor; and (ii) ensure each such Sub-Processor complies with all such obligationsabove will apply accordingly. 6.6 The Controller agrees that the Sub-Processors may transfer Personal Data for the purpose of providing the Services to the Controller in accordance with the Agreement to countries outside the European Economic Area (EEA). The Processor confirms that such Sub-Processors: (i) are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or (ii) have entered into Standard Contractual Clauses with the Processor; or (iii) have other legally recognised appropriate safeguards in place.