Common use of TO THE STANDARD CONTRACTUAL CLAUSES Clause in Contracts

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with the Data Importer. The Data Importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data transferred concern the following categories of data (please specify): Categories of Personal Data, as determined by the Data Exporter, may include, among other information, personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data transferred concern the following special categories of data (please specify): None. The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is A hotel chain, who processes the legal entity that has executed categories of data below for the Master Agreement with purpose of processsing the Data Importerguests’ reservations the data exporter receives through the data importer’s booking system; and for web services, GMS, Media and Business intelligence services. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement A software as a service (with the Data ExporterSaaS) company providing web hosting services, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreementreservation/booking services, GMS, Media and business intelligence services to hotels. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data personal data transferred concern the following categories of data subjects (please specify): Categories Hotel guests; Employees of Personal Datadata exporter using the services The personal data transferred concern the following categories of data with respect to hotel guests (please specify): Guest information: salutation, as determined by the Data Exporter, may include, among other information, personal contact information such as last name, addressfirst mail, telephone or mobile title, email, company, address 1, xxxxxxx0, xxxx, xxxxx, postal code, country, phone, frequent guest id, initial_, phoneday, phoneevening, rawstreetaddr, lastupdate, users, unsubscribe, gsource, groupconame, birthdate, corpid, frequent_guestid, lastccno, contacttitle, contactfirstname, contactlastname, contactemail, airtravelerid, cartravelerid, guest profile, IP. Payment information: credit card type, credit card number, fax numberexpiration date, name on card, billing address 1, billing address 2, billing city, billing country, billing state, billing postal code, billing code The personal data transferred concern the following categories of data with respect to Data exporter employees (please specify): First and last name; email address, and passwords; employment details including employer name, job title and function, and business contact details. position The Personal Data personal data transferred concern the following special categories of data (please specify): None. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of As indicated on any agreement for Services from Amadeus involing the processing of Personal Data by Data Importer is the performance on behalf of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreementexporter.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Where Customer shares Personal Data Exporter is (please specify briefly your activities relevant relating to data subjects, Customer shall be serving as the transfer): data exporter of such Personal Data. Where WorkSpan directly receives Personal Data Exporter is from third party sources or data subjects and shares such Personal Data with Customer, WorkSpan shall be considered the legal entity that has executed data exporter with respect to such data. Where Customer shares Personal Data relating to data subjects, WorkSpan shall be serving as the Master Agreement data importer of such Personal Data. Where WorkSpan directly receives Personal Data from third party sources or data subjects and shares such Personal Data with Customer, Customer shall be considered the Data Importerdata importer with respect to such data. The Data Importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data personal data transferred concern the following categories of data subjects: Customer shall be the Controller (please specify): or “data exporter”) of the Personal Data for the Data Subjects listed below, except for those data types set forth under “Categories of Data” below. WorkSpan shall be the Processor (or “data importer”) of the Personal Data. Customer may submit Personal Data to the Services, as the extent of which is determined and controlled by the Data ExporterCustomer in its sole discretion, and which may include, among other informationbut is not limited to Personal Data relating to the following categories of data subjects: Prospects, customers, business partners and vendors of Customer (who are natural persons) Employees or contact persons of Customer’s prospects, customers, business partners and vendors Customer’s Users authorized by Customer to use the Services The personal contact information data transferred include the following categories of data: Information received directly from users of WorkSpan, including without limitation the following ● First and last name ● Email address ● Telephone number ● Profile picture ● IP Address ● User added content (which may include Personal Data if you include Personal Data in such as name, address, telephone content) Data processing is according to WorkSpan’s privacy policy. WorkSpan shall be the Controller (or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details“data exporter”) of the Personal Data listed above. The Personal Data personal data transferred concern the following special categories of data (please specify): data: None. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): activities: The objective of processing Processing of Customer Personal Data by Data Importer data importer is the performance of the Services pursuant to the Master Agreement in place between Agreement, which includes the Data Exporter and the Data Importer. This Appendix forms part collection, organization, structuring, storage, retrieval, consultation, use, disclosure by transmissions, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master AgreementData.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Subject Matter & Duration of the Processing The Data Exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement contracted with the Data ImporterImporter for certain software services. In its use of the software services the Data Exporter will upload certain personal data into the software’s database which may be stored at the Controller’s election either on servers outside of the EEA, at the time of writing on Amazon Web Services (AWS) in the United States or within the EEA (including the United Kingdom) at the time of writing on Amazon Web Services (AWS). The Data Importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with data may be accessed, on the Data Exporter’s request, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers Importer in order to provide technical support services. The personal data will be processed for the duration of the Customercontract for software services and for a further period of thirty (30) days to allow appropriate time for deletion and any requested return of the data to the Data Exporter. Data Subjects The Personal Data personal data transferred concern the following categories of data subjects (please specify): Categories End users of Personal Data, as determined by the PrinterLogic application which may include employees and other personnel of the Data Exporter or of the customers of the Data Exporter, solely at the discretion of the data exporter. Categories of Data The personal data transferred may include, among other information, personal contact information such as concern the following categories of data: First name, address, telephone or mobile number, fax numberlast name, email address, title of printed document, username and passwords; employment details including employer name, job title and function, and business contact detailspassword. Special Categories of Data (if appropriate) The Personal Data personal data that may be transferred would not normally concern the following any special categories of data, but data (please specify): Noneexporter is in control in this regard. It should be noted that in Pull Printing mode the software will capture and store the title of a document which will be produced in print reports accessible to the licensor’s IT personnel. The Personal Data transferred title of printed documents which may be reported [and stored] will be the title of the document as transmitted to the printer to be printed. This title may therefore contain special category data or personal data belonging to the data subject for which the data exporter may need to satisfy itself that it has obtained the express consent of the data subject to transfer in order to comply with its legal obligations under the following basic processing activities General Data Protection Regulation 2016/679 (please specify): The objective of processing of Personal Data by Data Importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the partiesGDPR). The Data Importer Exporter is in control and may turn this function on or off as it sees fit. If controller turns this function off, Pull Printing mode within the software will implement reasonable administrative, physical, managerial capture and technical controls safeguards for protection temporarily store the title of a document which will be encrypted and not accessible to the licensor's IT personnel and will be temporarily stored until released from the print queue by the transmittor of the security, confidentiality and integrity document or for a period of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed time elected by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master AgreementController until automatic expiry.).

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with the Data Importer. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer XxxxxxxxxXxxxx.xxx, inc. is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of enterprise cloud computing solutions which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The data exporter may submit Personal Data transferred concern to the following categories Services, the extent of Data Subjects (please specify): Categories of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data transferred concern relating to the following categories of data subjects: • Prospects, customers, business partners, vendors and subcontractors of the data exporter (please specify): Categories who are natural persons) • Employees or contact persons of the data exporter’s customers, business partners, vendors and subcontractors • Employees, agents, advisors, freelancers of the data exporter (who are natural persons), and their family members • The data exporter’s Users authorized by the data exporter to use the Services The data exporter may submit Personal Data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: • First and last name • Title • Position • Employer • Contact information (company, as determined by the Data Exporteremail, may includephone, among other information, physical business address) • ID data • Professional life data • Professional skills information • Personal life data • Health and medical information • Employee compensation information • Connection data • Localisation data The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneThe data exporter may submit special categories of data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, trade-union membership, and the processing of data concerning health. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the SCC Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the partiesDATA EXPORTER Name: ……………………………………. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.Authorised Signature …………………….. DATA IMPORTER Name: Xxxx X. Xxxx Authorised Signature ……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with the Data Importer. The Data Importer data importer is (please specify briefly activities relevant to the transfer): Xxxxxxxxx.xxx is a SaaS provider of Customer Relationship Management and Marketing The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the Subscription Services, the extent of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data relating to the following categories of data subjects:  Prospects, customers, business partners and vendors of data exporter (who are natural persons)  Employees or contact persons of data exporter’s prospects, customers, business partners and vendors  Employees, agents, advisors, freelancers of data exporter (who are natural persons)  Data exporter’s Users authorized by data exporter to use the Subscription Services The personal data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the Subscription Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:  First and last name  Title  Position  Employer  Contact information (company, as determined by the Data Exporteremail, may includephone, among other information, physical business address)  ID data  Professional life data  Personal life data The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneData exporter should not transmit special categories of data to the Subscription Services. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the Subscription Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. DATA EXPORTER: Name or Organization: _ Authorized Signature: __ DATA IMPORTER: Name: Systematic Revenue, LLC dba Hatchbuck Authorized Signature: __ This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data Importer importer will implement reasonable maintain administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect uploaded to the Subscription Services, as described in the Security, Privacy and Architecture Documentation applicable to the specific Subscription Services in accordance with applicable legal requirementspurchased by data exporter, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as accessible via xxxxx://xxxxxxxxx.xxxxxxxxx.xxx/support/home or otherwise agreed made reasonably available by the parties in writingdata importer. Data Importer will not materially decrease the overall security of the Subscription Services during the term of the Master Agreementa subscription term.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed specified in Section 1.1 of Schedule 1 of the Master Agreement with the Data ImporterInt. DPA. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer ClassDojo, Inc. is the legal entity a provider of education technology and a school communication platform that has executed the Master Agreement (with the Data Exporterhelps bring teachers, school leaders, families, and students together, which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the SCC Services (or ClassDojo may collect and Process on behalf of the Data Subjectsexporter), as the extent of which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data relating to the following categories of data subjects: ● Employees, agents, advisors, freelancers of data exporter (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the Services (who are natural persons) The personal data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the SCC Services (or ClassDojo may collect and Process on behalf of the Data exporter), the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data, as determined by : ● Please see the Schedule of Data Exporter, may include, among other information, attached to the Agreement The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneData exporter shall not submit special categories of data to the SCC Services. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the SCC Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part Name: Authorised Signature Name: Xxxxxxxx Xxxxx on behalf of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrativeClassDojo, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.Inc. Authorised Signature

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is The data exporter is: (i) the legal entity that has executed the Master Agreement with Standard Contractual Clauses as a data exporter and, (ii) all Affiliates (as defined in the Data ImporterDPA into which these Standard Contractual Clauses are incorporated) of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic Area (EEA), Switzerland or the United Kingdom. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer importer is a provider of automated marketing services which may involve processing personal data provided by, and pursuant to the legal entity that has executed instructions and directions of, the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master DPA and the Subscription Services Agreement and all related orders between data exporter and data importer (the “Agreement”). The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specifyspecify briefly activities relevant to the transfer): Categories The categories of Data Subjects, as data subjects whose personal data may be processed in connection with the services are determined and controlled by the Data Exporter, data exporter in its sole discretion and may include Customer representatives but are not limited to: customer, contacts and (end) usersprospects of data exporter; employees or contractors of data exporter’s customers, such as employeescontacts and prospects, job applicants, contractors, collaborators, partners, suppliers and; employees and customers contractors of the Customerdata exporter. The Personal Data personal data transferred concern the following categories of data (please specify): Categories The categories of Personal Data, as personal data are determined by the Data Exporter, data exporter in its sole discretion and may include, among other information, personal include but are not limited to: first and last name; employer; business role; professional title; contact information such as name(e.g. email, phone, physical address); business network; business experience; business interests; localization data, telephone or mobile number, fax number, email address, and passwordsand; employment details including employer name, job title and function, and business contact detailsdevice identification data. The Personal Data personal data transferred concern the following special categories of data (please specify): None. None The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is importer will process personal data as necessary to perform the performance of the Services services pursuant to the Master Agreement in place between Agreement. The processing operations performed on the Data Exporter personal data will depend on the scope of data exporter’s services and data exporter’s configuration of its FunnelEnvy instance. Such processing operations of personal data as necessary for data importer to provide the Data Importerservices may include the following: collecting. recording, organizing, storage, use, alteration, transmission, retrieval, consultation, archiving and / or destruction. DATA EXPORTER: Name: Authorised Signature: DATA IMPORTER: Celerius Group, Inc. Name: Xxxx Xxxxxxxxxxxxx Authorised Signature This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter The data exporter is (i) the legal entity that has executed the Master Agreement attached Standard Contractual Clauses as a data exporter, and (ii) all Affiliates of Customer established within the European Economic Area (EEA) and Switzerland that have purchased SCC Services on the basis of one or more Order Forms or are using SCC Services in accordance with the Data ImporterAgreement. The Data Importer terms “Affiliate,” “Customer” and “Order Form” are defined in the Agreement, and the terms “Agreement” and “SCC Services” are defined in the attached DPA. The data importer is (please specify briefly activities relevant to the transfer): The Data Importer XxxxxxxxxXxxxx.xxx, inc. is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of enterprise cloud computing solutions which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the SCC Services, the extent of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data relating to the following categories of data subjects: ● Prospects, customers, business partners and vendors of data exporter (who are natural persons) ● Employees or contact persons of data exporters’ prospects, customers, business partners and vendors ● Employees, agents, advisors, freelancers of data exporter (who are natural persons) ● Data exporter’s Users authorised by data exporter to use the SCC Services The personal data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: ● First and last name ● Title ● Position ● Employer ● Contact information (company, as determined by the Data Exporteremail, may includephone, among other information, physical business address) ● ID data ● professional life data ● personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. life data ● connection data ● localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): NoneData exporter may submit special categories of data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade- union membership, and the processing of data concerning health or sex life. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the SCC Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.DATA EXPORTER Name:  Authorised Signature  DATA IMPORTER Name: Xxxxxx Xxxxx Authorised Signature ………………………..

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter exporter is the legal entity that has executed the Master Agreement with Data Processing Addendum based on the Standard Contractual Clauses as a Data ImporterExporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order(s). The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer importer, PasswordBoss, LLC, is the legal entity that has executed the Master Agreement (with the Data Exporteran identity and password management cloud service provider which Processes Personal Data, which processes Personal Data where such data is Company Data, upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master AgreementAgreement and the Data Processing Addendum. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the Service, the extent of Data Subjects, as which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data Exporterrelating to the following categories of data subjects: • Company’s, may include Customer representatives business partners, and vendors of the data exporter (endwho are natural persons) users• Employees or contact persons of data exporter customer’s, such as employeesbusiness partners, job applicantsand vendors • Employees, agents, advisors, contractors, collaborators, partners, suppliers and customers of or any user authorized by the Customer. data exporter to use the Service (who are natural persons) The Personal Data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the Service, the extent of Personal Data, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include, among other information, but is not limited to the following categories of personal data: • First and last name • Business contact information such as name(company, email, phone, physical business address) • Personal contact information (email, telephone or mobile number, fax number, email address, cell phone) • Title • Position Employer ID data • Professional life data • Personal life data (in the form of security questions and passwords; employment details including employer name, job title and function, and business contact details. answers) • Connection data • Localization data The Personal Data transferred concern the following special categories of data (please specify): NoneData exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer the data importer is the performance of the Services Service pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrativeName: Authorised Signature: Name: Xxxxx Xxxx, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.CEO Authorised Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix The Data Exporter is (please specify briefly your activities relevant data exporter will export the personal data contained in the client’s documentation to the transfer): Data Exporter is responders via the legal entity that has executed the Master Agreement Xxxxxxxxxxxx.xxx platform. Exported data will concern personal data of data exporter’s employees with the Data Importer. The Data Importer is (please specify briefly activities relevant access given to the transfer): online platform handled by the data importer. Also, data exporter’s client data for the purposes of forwarding data exporter’s audit requests to responders by the data importer. Capital Confirmation Inc. The data importer provides an online venue for digital transaction management, including but not limited to, audit confirmations, accounts receivable/accounts payable confirmations, credit inquiries, employee benefit plan audits and confirmations, and legal confirmations for accounting firms, law firms, banks, and other users. Processed data will concern data exporter’s employees for which accounts in the platform handled by the data importer will be created. Also, data exporter’s client data for the purposes of forwarding data exporter’s audit requests to responders by the data importer. Data Importer is exporter’s employees and personal data of data exporter’s client’s representatives and other subjects mentioned in the legal entity that has executed the Master Agreement (with the Data Exporterdocumentation, which processes Personal Data upon is sent to the instruction responder The categories of data are: names, surnames, addresses, account numbers, financial information, PESEL number and other personal data of the Data Exporter subjects mentioned in accordance with the terms of documentation sent to the Master Agreementresponder. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaboratorsEmployees, partners, suppliers principals, directors, former employees, former partners, former principals, former directors, new hires, individual contractors and customers temporary staff of the Customerdata exporter, as well as applicants, dependants, contractors / subcontractors, clients, suppliers/vendors of the data exporter Not applicable The platform Xxxxxxxxxxxx.xxx is internet-based system, that allows the data exporter to send documentation to auditors for the needs of the audit. The Personal Data transferred concern the following categories of data (please specify): Categories of Personal Data, as determined documentation will be encrypted by the Data Exporter, may include, among other information, personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data transferred concern the following special categories of data (please specify): None. The Personal Data transferred will be subject importer while uploading it to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is platform, so the performance data importer should not get access to the contents of the Services pursuant documentation and personal data contained in the documentation beyond the scope necessary to perform the Master Agreement in place between the Data Exporter and the Data Importerencryption process. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.DATA EXPORTER Name: ................................................................................................................................................................

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter Each data exporter is (please specify briefly your activities relevant to either a member of the transfer): Data Exporter Customer group of companies whose ultimate parent company is the legal entity that has executed the Master Agreement with the Data ImporterCustomer, Inc, or a subscriber of Customer's Service. The Data Importer Customer group of companies provides and operates the Service. Each data exporter wishes to appoint the data importer to provide it with data processing services. The role of the data importer, the nature of the data processing services it will provide, the categories of data that it will process, and the protections it will apply to protect those data are set out in the Appendices 1 and 2 to these Clauses. The data importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, A service provider which processes Personal Data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreementagreement between Customer and data importer relating to the provision of services by data importer to Customer. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may transfer Personal Data to data importer, the extent of which is determined and controlled by data exporter in its sole discretion, and which may include, but is not limited to Personal Data Subjectsrelating to the following categories of data subjects: • Prospects, as determined by the Data Exportercustomers, may include Customer representatives business partners and vendors of data exporter (end) userswho are natural persons); • Employees or contact persons of data exporter’s prospects, such as employeescustomers, job applicantsbusiness partners and vendors; and • Employees, contractorsagents, collaboratorsadvisors, partners, suppliers and customers freelancers of the Customerdata exporter (who are natural persons). The Personal Data personal data transferred concern the following categories of data (please specify): Categories Data exporter may transfer Personal Data to data importer, the extent of which is determined and controlled by data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: • First and last name • Title • Position • Employer • Contact information (company, as determined by the Data Exporteremail, may includephone, among other informationphysical business address) • ID data • Professional life data • Personal life data (including but not limited to home addressed, personal contact information such as namephone numbers, addressresumes, telephone or mobile numberattendance records, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact bank details. ) • Connection data • Localisation data The Personal Data personal data transferred concern the following special categories of data (please specify): None. N/A The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer the data importer is the performance of the Services data importer’s services pursuant to the Master Agreement in place agreement between the Data Exporter Customer and the Data Importerdata importer relating to the provision of services by the data importer to Customer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed specified in Section 2.1 of Schedule 1 of the Master Agreement with the Data ImporterDPA. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer Xxxxxxxxxx.xxx, inc. is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of enterprise cloud computing solutions which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the SCC Services, the extent of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data relating to the following categories of data subjects: ● Prospects, customers, business partners and vendors of data exporter (who are natural persons) ● Employees or contact persons of data exporter’s prospects, customers, business partners and vendors ● Employees, agents, advisors, freelancers of data exporter (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services The personal data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: ● First and last name ● Title ● Position ● Employer ● Contact information (company, as determined by the Data Exporteremail, may includephone, among other information, physical business address) ● ID data ● Professional life data ● Personal life data ● Localisation data The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneData exporter may submit special categories of data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the SCC Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master AgreementDATA EXPORTER Name:………………………………….… Authorised Signature …………………… DATA IMPORTER Xxxxx Xxxxxxx Name:………………………………….… Authorised Signature ……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is , (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that “Customer”) who has executed the Master Principal Agreement with the Data ImporterHevo. The Data Importer data importer is Hevo Data, Inc. (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement“Hevo”). The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data personal data transferred concern the following categories of data (please specify): Categories of subjects: Data exporter may submit or share Personal Data, as the extent of which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include, among other informationbut is not limited to Personal Data relating to the following categories of Data Subjects: ● Prospects, personal customers, business partners and vendors of data exporter. ● Employees or contact information such as namepersons of data exporter’s prospects, addressexporter’s customers, telephone or mobile numberexporter’s business partners and exporter’s vendors. ● Employees, fax numberagents, email addressadvisors, and passwords; employment details including employer name, job title and function, and business contact detailsfreelancers of data exporter. ● Data exporter’s affiliates authorized by data exporter to use the Service. The Personal Data personal data transferred concern the following categories of data: Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by data exporter in its sole discretion, and which may include but is not limited to the following categories of Personal Data: ● First and Last Name; ● Contact Information including email address, phone number, social media profiles; ● Professional life data including employer, designation; ● Personal life data including salutation, marital status, family details etc.; ● Locational data; ● Data available on social media (e.g., Facebook, Twitter, etc.) profiles, status and information; ● Event and survey registration, attendance, and response data; ● Engagement data, namely, articles, posts, and the like that is “followed”, “liked” or “disliked”; ● Internet cookies; ● Communication data like emails, chat, voicemail etc. Also, includes feedback and support related communication data; and ● Comments and posts submitted to websites, mobile apps, and online communities The Customer may submit special categories of data (please specify): Noneon the platform operated by Hevo. However, Hevo does not have access to this, as it is always in encrypted form. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal activities: Data by Data Importer is importer will process personal data as necessary to provide the performance of the Services Service pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirementsPrincipal Agreement, and as set forth further instructed by data exporter in Data Importerits use of the Service. This includes automated extraction of data from data exporter’s Section 6 data sources, transformation of this Privacy Addendumdata as per data exporter’s requirement, and as otherwise agreed by loading data into data exporter’s destination database/data warehouse. DATA EXPORTER [Populated with details of, and deemed to be signed on behalf of, the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.data exporter:] Name:……………………………… Signed by: Position: Authorised Signature …………………… Date: DATA IMPORTER Name: Hevo Data, Inc. Signed by: Position: Authorised Signature …………………… Date:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with the Data Importerlisted above. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction a service provider who performs employment screening and verifications of the Data Exporter in accordance with the terms personal information of the Master Agreementapplicants for the purposes of ensuring an applicant’s capabilities with regard to a particular position and avoiding additional liability for data exporter with regards to improper hiring. With such information data exporter can evaluate if they will hire the applicant or not and if findings align with contractual and regulatory requirements. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data personal data transferred concern the following categories of data subjects: job applicants, and potentially contractors, subcontractors and/or temporary employees. The personal data transferred concern the following categories of data: - Identification data - name, internal ID number, government-issued identification numbers (please specify): Categories of Personal Data, as determined where authorized by the Data Exporterlaw of the data exporter); - Contact information - home and business addresses, may includephone number, among other informationfax, personal contact mobile devices and email addresses; - Personal information such as name- birth date; - Criminal record - file number, file date, charges, level of charge, disposition and sentence (if any); - Social Security Number (or equivalent); - Driver's history - driver's license and state of issuance (or equivalent); - Credit history information - places of employment and prior address, telephone or mobile numbercredit account types, fax numberterms, email addressamounts past due, loan types, balances, public records, high credit, dates opened and passwordsclosed, payment patterns, credit limits and modes of payment; employment details including employer name- Education information - diploma earned, job title major, degree(s) earned and functiongraduation; dates related to attendance; and - Employment information - previous and current employers, dates of employment, position held, salary and business contact detailseligibility to rehire. DocuSign Envelope ID: 51738651-7D4F-49F6-92BC-819839070612 The Personal Data personal data transferred concern the following special categories of data: - Criminal record - file number, file date, charges, level of charge, disposition and sentence (if any) The personal data (please specify): None. The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is importer receives information from third parties and assembles the performance of the Services pursuant relevant data into employment screening reports for data exporter to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writingevaluate applicant. Data Importer importer will not materially decrease securely store data for the overall security length of time it is needed. …………………………………………………………………………………………………… Other information necessary in order for the Services during the term of the Master Agreement.contract to be binding (if any): Address: 0000 Xxxxxx Xxxxxx Xxxxx, Xxxxxx, XX 00000 DocuSign Envelope ID: 51738651-7D4F-49F6-92BC-819839070612

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. Service Subscription Agreement dated The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with Clauses as a Data Exporter (Subscriber as defined in the Data ImporterAgreement) established within the [European Economic Area (EEA)] and [Switzerland] that have purchased OneLogin Services. The Data Importer is (please specify briefly activities relevant to the transfer): The Data Importer OneLogin, Inc. is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of a cloud identity and access management solution which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data Exporter may submit personal data to the OneLogin Services, the extent of Data Subjects, as which is determined and controlled by the Data ExporterExporter in its sole discretion, may include Customer representatives and (end) userswhich includes, such as employeespersonal data relating to the following categories of data subjects: • Prospects, job applicantscustomers, contractors, collaborators, business partners, suppliers and customers resellers • Employees or contractors of prospects, customers, business partners, or resellers • Data Exporter’s Users authorized by the Customer. Data Exporter to use the OneLogin Services The Personal Data personal data transferred concern the following categories of data (please specify): Categories Data Exporter may submit personal data to the OneLogin Services, the extent of Personal Data, as which is determined and controlled by the Data Exporter, may include, among other information, personal contact information such as name, address, telephone or mobile number, fax number, email addressExporter at their sole discretion, and passwords; employment details including employer namewhich includes, job title the following categories of personal data: • First name and functionlast name • Contact information (company, and business contact details. email, phone) • ID data • Connection data • Localisation data The Personal Data personal data transferred concern the following special categories of data (please specify): None. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter exporter is the legal entity that has executed the Master Agreement with Standard Contractual Clauses as a data exporter and all clients and affiliates thereof who process personal data of subjects located in the Data ImporterEEA, Switzerland, and the United Kingdom. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer is Developer and publisher of online marketing information, services and automation software which involves processing personal and customer data provided by the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master AgreementStandard Contractual Clauses (SCC) and the SA including all related orders between the data exporter and data importer. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories The categories and types of Data Subjects, as data subjects who may be processed in accordance with the client agreement are determined and controlled by the Data Exporter, data exporter and may include Customer representatives but are not limited to: Prospects (leads), customers, contacts, website visitors, and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers contractors of the Customerdata exporter; and Prospects (leads), website visitors, employees or contractors of the data exporters’ customers and clients. The Personal Data personal data transferred concern the following categories of data (please specify): Categories The categories of Personal Data, as personal data are determined by the Data Exporterdata exporter at its sole discretion, in accordance with the SA, and may includeinclude but are not limited to: First and last name, among other information, personal contact information such as name, address, telephone or mobile number, fax number, (e.g. email address, phone number, physical address) localization data, geographical data, device identification data, business network and passwords; employment details including employer nameexperience, job title and functionfinancial data, educational data, interests, information collected through cookies (as denoted on our Cookie Policy xxxxx://xxxxxxxxxxx.xxx/legal/sharpspring-cookie-policy/), data from exporters’ connected social media accounts as authorized by the exporter, and business contact detailsinformation received from third parties (as applicable). The Personal Data personal data transferred concern the following special categories of data (please specify): NoneThe data exporter and data importer do not anticipate the transfer of special categories of data. The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data by Data Importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data Importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 Restrictions of this Privacy Addendum, and as otherwise agreed by type of data are defined in the parties in writing. Data Importer will not materially decrease the overall security SA and/or Terms of the Services during the term of the Master AgreementService.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix The Data Exporter is (please specify briefly your activities relevant to the transfer): Data Exporter data exporter is the legal entity identified as “Customer” in the DPA The data importer is Lotame Solutions, Inc., a provider of enterprise software-as-a-service computing solutions that has executed the Master Agreement with the Data Importer. The Data Importer is (please specify briefly activities relevant to the transfer): The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master AgreementAgreement for the management of personal data and use in online interest- based behavioral advertising. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories • The extent of Data Subjects, as the personal data transferred to the data exporter is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to personal data relating to the following categories of data subjects: • Prospects, customers, business partners and vendors of data exporter (who are natural persons) • Employees and agents of data exporter (who are natural persons) that may use the data importer’s services for the benefit of data exporter • Data Exporterexporter’s customers that engage with data exporter online (e.g., may include Customer representatives through a web browser, mobile application, or direct marketing and (endadvertising activities) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. or through its services The Personal Data personal data transferred concern the following categories of data (please specify): Categories • The extent of Personal Data, as the personal data transferred to the data exporter is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include, among other information, but is not limited to personal contact data relating to the following categories of data: • Business contract information • Demographic Information • Online Behavioral Information • Technical Identifiers (such as name, IP address, telephone Lotame cookie ID, or mobile numberdevice IDFA or AAID) • Event-level data (such as http headers, fax numberuser agent string, email address, and passwords; employment details including employer name, job title and function, and business contact details. time date stamp) The Personal Data personal data transferred concern the following special categories of data (please specify): None• The data exporter will not send special categories of data to the data importer. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal • Data by Data Importer is importer will process personal data as necessary to perform the performance of the Lotame Services pursuant to the Master Agreement and as may be further instructed by data exporter in place between the Data Exporter and the Data Importer. This Appendix forms part its use of the Standard Contractual Clauses Lotame Services. Additionally, data importer processes personal data for the following purposes for data exporter: • Interest based advertising • Cross device matching • Personalized content delivery • Campaign analytics and must be completed insights • ID syncing • Market research Description of the technical and signed organisational security measures implemented by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services data importer in accordance with applicable legal requirements, Clauses 4(d) and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.5(c) (or document/legislation attached):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is the legal entity that has executed the Master Agreement with the Data Importer. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer XxxxxxxxxXxxxx.xxx, Inc. is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of enterprise cloud computing solutions which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The data exporter may submit Personal Data transferred concern to the following categories Services, the extent of Data Subjects (please specify): Categories of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data transferred concern relating to the following categories of data subjects:  Prospects, customers, business partners, vendors and subcontractors of the data exporter (please specify): Categories who are natural persons)  Employees or contact persons of the data exporter’s customers, business partners, vendors and subcontractors  Employees, agents, advisors, freelancers of the data exporter (who are natural persons), and their family members  The data exporter’s Users authorized by the data exporter to use the Services The data exporter may submit Personal Data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:  First and last name  Title  Position  Employer  Contact information (company, as determined by the Data Exporteremail, may includephone, among other information, physical business address)  ID data  Professional life data  Professional skills information  Personal life data  Health and medical information  Employee compensation information  Connection data  Localisation data The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneThe data exporter may submit special categories of data to the SCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, trade-union membership, and the processing of data concerning health. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the SCC Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the partiesDATA EXPORTER Name: ……………………………………. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.Authorised Signature …………………….. DATA IMPORTER Name: Xxxx X. Xxxx Authorised Signature ……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter The data exporter is the legal entity that has executed the Master Agreement with the Data ImporterStandard Contractual Clauses as a data exporter. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer data importer is the legal entity that has executed the Master Agreement (with the Data ExporterSentropy Technologies, Inc., a provider of a web-based content classification service which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories of Data Subjects, as exporter’s end-users. The data importer will receive any personal data that the data exporter instructs it to process through the Services. The precise personal data that the data exporter will transfer to the data importer is necessarily determined and controlled solely by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customerdata exporter. The Personal Data personal data transferred concern the following categories of data (please specify): Categories Personal data exchanged by means of Personal Datause of the Services, as determined by the Data Exporter, may include, among other information, personal contact information such as nametext, addressmessage bodies, telephone or mobile numbervoice and video media, fax numberimages, email addressbodies, email recipients, and passwords; employment details including employer name, job title and functionsound, and business contact details(b) data stored on Customer’s behalf such as communication logs within the Services. The Personal Data personal data transferred concern the following special categories of data (please specify): NoneThe data importer does not intentionally collect any special categories of data (as defined in accordance with Data Protection Law) in the provision of the Services. However, in the event data exporter or its end users choose to include special categories of data within the communications it transmits using the Services, the data exporter is solely responsible for ensuring the legality of any special categories of data it or its end users choose to process using the Services, including the legality of data importer’s processing activities through provision of the Services. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. Name Signature Name Xxxxxx Xxxxx Signature This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection Description of the security, confidentiality technical and integrity of Personal Data with respect to organisational security measures implemented by the Services data importer in accordance with applicable legal requirements, Clauses 4(d) and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.5(c) (or document/legislation attached):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter is (i) the legal entity that has executed the Master Agreement with Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Data Importer. Agreement) of Customer established within the European Economic Area (EEA) and the United Kingdom that have purchased Services on the basis of one or more Service Order Form(s) The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer MapAnything is the legal entity that has executed the Master Agreement (with the Data Exporter, a provider of enterprise cloud computing solutions which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. Processing on data exporter’s behalf will include data storage and user usage analytics in the new platform. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories Data exporter may submit Personal Data to the Services, the extent of Data Subjects, as which is determined and controlled by the Data Exporterdata exporter in its sole discretion, and which may include Customer representatives and (end) usersinclude, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The but is not limited to Personal Data relating to the following categories of data subjects: ● Prospects, customers, business partners and vendors of Customer (who are natural persons) ● Employees or contact persons of Customer’s prospects, customers, business partners and vendors ● Employees, agents, advisors, freelancers of Customer (who are natural persons) ● Customer’s Authorized Users authorized by Customer to use the Services The personal data transferred concern the following categories of data (please specify): Categories Data exporter may submit Personal Data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Personal Data, as determined by the Data Exporter, may include, among other information, : ● First and last name ● Title ● Position ● Employer ● Contact information ● Account information ● Device information ● Personal life data ● Professional life date ● Usage and preference information ● Geolocation data ● Driver and vehicle information The personal contact information such as name, address, telephone or mobile number, fax number, email address, and passwords; employment details including employer name, job title and function, and business contact details. The Personal Data data transferred concern the following special categories of data (please specify): NoneData exporter may submit special categories of data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data by Data Importer data importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter and the Data ImporterAgreement. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the partiesDATA EXPORTER Name:………………………………….… Authorised Signature …………………… DATA IRMicPhOaRrTdERJ. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master AgreementXxxxxx Name:………………………………….… Authorised Signature ……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter data exporter is (please specify briefly your activities relevant to the transfer): Data Exporter The data exporter is the legal entity that has executed the Master Agreement with Standard Contractual Clauses as a data exporter, which has purchased Services from data importer pursuant to the Data ImporterAgreement. The Data Importer data importer is (please specify briefly activities relevant to the transfer): The Data Importer data importer is the legal entity that has executed the Master Agreement (with the Data ExporterStandard Contractual Clauses as a data importer, which processes Personal Data personal data upon the instruction of the Data Exporter data exporter in accordance with the terms of the Master Agreement. The Personal Data personal data transferred concern the following categories of Data Subjects data subjects (please specify): Categories of Data Subjects, as The data exporter may submit personal data to the data importer’s Service to the extent determined and controlled by the Data Exporterdata exporter, may include Customer representatives which shall be limited to personal data relating to the following categories of data subjects: Employees, agents, advisors, contractors and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers freelancers of the Customer. data exporter who are Users of the Service (who are natural persons) The Personal Data personal data transferred concern the following categories of data (please specify): Categories of Personal Data, as The data exporter may submit personal data to the data importer’s Service to the extent determined and controlled by the Data Exporterdata exporter, may includewhich shall be limited to User names, among other information, personal contact information such and e-mail addresses, solely as name, address, telephone or mobile number, fax number, email address, required to access and passwords; employment details including employer name, job title and function, and business contact detailsuse the Services of the data importer. The Personal Data personal data transferred concern the following special categories of data (please specify): None. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing Processing of Personal Data personal data by Data Importer the data importer is the performance of the Services pursuant to the Master Agreement in place between the Data Exporter data exporter and the Data Importerdata importer. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.DATA EXPORTER Name:……………………………… Authorised Signature …………………… DATA IMPORTER Name: ……………………………… Authorised Signature ……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. The Data Exporter is (please specify briefly your activities relevant to the transfer): Data Exporter data exporter is the legal entity that has executed party named on the Master Agreement with the Data Importersignature page hereto. The Data Importer data importer is (please specify briefly activities relevant to the transfer): Tracking Time, LLC The Data Importer is the legal entity that has executed the Master Agreement (with the Data Exporter, which processes Personal Data upon the instruction of the Data Exporter in accordance with the terms of the Master Agreement. The Personal Data transferred concern the following categories of Data Subjects (please specify): Categories of Data Subjects, as determined by the Data Exporter, may include Customer representatives and (end) users, such as employees, job applicants, contractors, collaborators, partners, suppliers and customers of the Customer. The Personal Data personal data transferred concern the following categories of data (please specify): Categories subjects: employees or contractors of Personal Data, the Data Exporter; other persons named or identified by the employees or contractors of the data exporter in connection with their use of the Services. The personal data transferred concern the following categories of data: • TrackingTime maintains Log-in credentials for Service Users as determined created by the Data ExporterExporter or Service User. • Additional types and categories of Personal Data and Data Subjects which the Customer may process within the Services are as follows: • Time entries (date, may includestart time, among other informationend time, personal contact information such as user, task, notes) • Tasks and Subtasks, Task Lists and Task Comments • Projects • Customers • Services • Work schedules • Users (given name, address, telephone or mobile number, fax numberfamily name, email address, and passwords; employment password (encrypted), role, status, employer organization, details including employer nameof use of the Services). • Miscellaneous Personal Data entered by a user in connection with their use of the Services (for example, job title and function, and business contact detailsnaming a third party in a time entry). The Personal Data Importer does not seek to identify this type of personal data. The personal data transferred concern the following special categories of data (please specify): Nonedata: none. The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of processing of Personal Data activities: • TrackingTime verifies that only credentials authorized by Data Importer is the performance Customer are authenticated for access to the Services • Storing, indexing, retrieving, searching and distributing time entries and associated information generated in the course of the Services pursuant to Data Exporter’s business for the Master Agreement in place between purpose of providing the Data Exporter with a time tracking system • Encrypting data in transit and decrypting the Data Importer. This Appendix forms part data to render underlying files in their original machine and human readable format upon the instructions of the Standard Contractual Clauses and must be completed and signed by the parties. Service users The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection data importer has subcontracted some processing of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and personal data as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.follows: