Common use of Transfers out of the EEA Clause in Contracts

Transfers out of the EEA. If Customer transfers Personal Data out of the EEA to Virsae in a country not deemed by the European Commission to have adequate data protection, such transfer will be governed by the Standard Contractual Clauses, the terms of which are hereby incorporated into this DPA. In furtherance of the foregoing, the parties agree that: 4.2.1 for purposes of the Standard Contractual Clauses, (a) Customer will act as the data exporter and (b) Virsae will act as the data importer; 4.2.2 for purposes of Appendix 1 to the Standard Contractual Clauses, the categories of data subjects, data, special categories of data (if appropriate), and the processing operations shall be as set out in Section 1.1 to this Annex 1 (Subject Matter and Details of Processing); 4.2.3 for purposes of Appendix 2 to the Standard Contractual Clauses, the technical and organizational measures shall be the Security Measures; 4.2.4 upon data exporter’s request under the Standard Contractual Clauses, data importer will provide the copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 5(j) of the Standard Contractual Clauses, and that data importer may remove or redact all commercial information or clauses unrelated the Standard Contractual Clauses or their equivalent beforehand; 4.2.5 the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be performed in accordance with Section 2.2 of this Annex 1 (Reviews and Audits of Compliance); 4.2.6 Customer’s authorizations in Section 5 of this Annex 1 (Subprocessors) will constitute Customer’s prior written consent to the subcontracting by Virsae of the processing of Personal Data if such consent is required under Clause 5(h) of the Standard Contractual Clauses; 4.2.7 certification of deletion of Personal Data as described in Clause 12(1) of the Standard Contractual Clauses shall be provided only upon Customer’s request; and

Transfers out of the EEA. If Customer Client transfers Personal Data out of the EEA to Virsae Cultivate in a country not deemed by the European Commission to have adequate data protection, such transfer will be governed by the Standard Contractual Clauses, the terms of which are hereby incorporated into this DPA. In furtherance of the foregoing, the parties agree that: 4.2.1 for purposes of the Standard Contractual Clauses, (a) Customer Client will act as the data exporter and (b) Virsae Cultivate will act as the data importer; 4.2.2 for purposes of Appendix 1 to the Standard Contractual Clauses, the categories of data subjects, data, special categories of data (if appropriate), and the processing operations shall be as set out in Section 1.1 to this Annex 1 (Subject Matter and Details of Processing); 4.2.3 for purposes of Appendix 2 to the Standard Contractual Clauses, the technical and organizational measures shall be the Security Measures; 4.2.4 upon data exporter’s request under the Standard Contractual Clauses, data importer will provide the copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 5(j) of the Standard Contractual Clauses, and that data importer may remove or redact all commercial information or clauses unrelated the Standard Contractual Clauses or their equivalent beforehand; 4.2.5 the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be performed in accordance with Section 2.2 of this Annex 1 (Reviews and Audits of Compliance); 4.2.6 CustomerClient’s authorizations in Section 5 of this Annex 1 (Subprocessors) will constitute CustomerClient’s prior written consent to the subcontracting by Virsae Cultivate of the processing of Personal Data if such consent is required under Clause 5(h) of the Standard Contractual Clauses; 4.2.7 certification of deletion of Personal Data as described in Clause 12(1) of the Standard Contractual Clauses shall be provided only upon CustomerClient’s request; and

Transfers out of the EEA. If Customer transfers Personal Data out of the EEA to Virsae Tx3 in a country not deemed by the European Commission to have adequate data protection, such transfer will be governed by the Standard Contractual Clauses, the terms of which are hereby incorporated into this DPA. In furtherance of the foregoing, the parties agree that: 4.2.1 i. for purposes of the Standard Contractual Clauses, (a) Customer will act as the data exporter and (b) Virsae Tx3 will act as the data importer; 4.2.2 ii. for purposes of Appendix 1 to the Standard Contractual Clauses, the categories of data subjects, data, special categories of data (if appropriate), and the processing operations shall be as set out in Section 1.1 1 to this Annex 1 (Subject Matter and Details of Processing); 4.2.3 iii. for purposes of Appendix 2 to the Standard Contractual Clauses, the technical and organizational measures shall be the Security Measures; 4.2.4 iv. upon data exporter’s request under the Standard Contractual Clauses, data importer will provide the copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 5(j) of the Standard Contractual Clauses, and that data importer may remove or redact all commercial information or clauses unrelated the Standard Contractual Clauses or their equivalent beforehandequivalent, before providing the copy to data exporter; 4.2.5 v. the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be performed in accordance with Section 2.2 2 of this Annex 1 (Reviews and Audits of Compliance); 4.2.6 vi. Customer’s authorizations in Section 5 of this Annex 1 (Subprocessors) will constitute Customer’s prior written consent to the subcontracting by Virsae Tx3 of the processing of Personal Data if such consent is required under Clause 5(h) of the Standard Contractual Clauses; 4.2.7 vii. certification of deletion of Personal Data as described in Clause 12(1) of the Standard Contractual Clauses shall be provided only upon Customer’s request; and