Common use of Use of sub-processors Clause in Contracts

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer Vendor engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer Vendor under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer Vendor fulfils its obligations under Clause 8.8. The data importer Vendor shall ensure that the sub-processor complies with the obligations to which the data importer Vendor is subject pursuant to these Clauses. (c) The data importer Vendor shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer Vendor may redact the text of the agreement prior to sharing a copy. (d) The data importer Vendor shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importerVendor. The data importer Vendor shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer Vendor shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer Vendor has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exportercontroller’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter controller in writing of any intended changes to that list through the addition or replacement of sub-sub- processors at least 30 business thirty (30) days in advance, thereby giving the data exporter controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter controller with the information necessary to enable the data exporter controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s). (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exportercontroller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. subjects.4 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The 4 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporteramendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exportercontroller’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business twenty (20) days in advance, thereby giving the data exporter controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter controller with the information necessary to enable the data exporter controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s). (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exportercontroller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporteramendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) 1. The data importer has the data exportercontroller’s general authorisation for the engagement of sub- sub-processor(s) from an agreed listlist in Annex 3. The data importer shall specifically inform the data exporter controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days in advance, thereby giving the data exporter controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter controller with the information necessary to enable the data exporter controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s). (b) 2. Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exportercontroller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjectssubjects9. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor subprocessor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) 3. The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor subprocessor agreement and any subsequent amendments to the data exporteramendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) 4. The data importer shall remain fully responsible to the data exporter for the performance of the sub-processorsubprocessor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) 5. The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor subprocessor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exportercontroller’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days Two Weeks in advance, thereby giving the data exporter controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter controller with the information necessary to enable the data exporter controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s). (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exportercontroller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporteramendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils fulfills its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil fulfill its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer Partner agrees that companies listed in the Annex I of this DPA are used as sub-processors under this DPA. (b) The Partner has the data exporterAppXite’s general authorisation authorization for the engagement of sub- processor(s) sub-processors from an agreed list. The data importer When the AppXite engages a new subcontractor, AppXite shall specifically inform the data exporter in writing of any intended changes give Partner notice by updating this DPA or otherwise making this information available to that list through the addition or replacement of sub-processors Partner at least 30 business days one (1) month in advance, thereby giving the data exporter Partner sufficient time to be able to object to such changes prior to the engagement of the sub-concerned sub- processor(s). The data importer AppXite shall provide the data exporter Partner with the information necessary to enable the data exporter Partner to exercise its the right to object. (bc) Where the data importer AppXite engages a sub-processor to carry for carrying out specific processing activities (on behalf of the data exporterPartner), it shall do so by way of a written contract that provides forwhich imposes on the sub-processor, in substance, the same data protection obligations as those binding the data importer under these Clauses, including ones imposed on the AppXite in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying accordance with this Clause, the data importer fulfils its obligations under Clause 8.8DPA. The data importer AppXite shall ensure that the sub-sub- processor complies with the obligations to which the data importer AppXite is subject pursuant to these Clausesthis DPA and the Applicable Data Protection Law. The AppXite shall remain fully responsible to the Partner for the performance of the sub- processor’s obligations in accordance with its contract with the AppXite. AppXite shall notify the Partner of any failure by the sub-processor to fulfil its contractual obligations. (cd) The data importer shall provide, at At the data exporterPartner’s request, AppXite shall provide a copy of such a sub-processor agreement and any subsequent amendments to the data exporterPartner. To the extent necessary to protect business secrets secret or other confidential information, including personal data, the data importer AppXite may redact the text of the agreement prior to sharing a the copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer AppXite shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer AppXite has factually disappeared, ceased to exist in law or has become insolvent - the data exporter Partner shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed listprior specific written authorisation. The data importer shall specifically inform submit the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors request for specific authorisation at least 30 business 15 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter processor, together with the information necessary to enable the data exporter to exercise its right decide on the authorisation. The list of sub-processors already authorised by the data exporter can be found in Annex III. The Parties shall keep Xxxxx XXX up to objectdate. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.contract.‌ (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data. (a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.‌ (b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required. (c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter. Clause 11‌

Use of sub-processors. (a) 9.1. The data importer has the data exporter’s general authorisation authorization for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-sub- processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) 9.2. Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) 9.3. The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) 9.4. The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) 9.5. The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.whereby

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-sub- processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. subjects.2 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations 2 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-sub- processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party third -party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed listprior specific written authorisation. The data importer shall specifically inform submit the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors request for specific authorisation at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter processor, together with the information necessary to enable the data exporter to exercise its right decide on the authorisation. The list of sub-processors already authorised by the data exporter can be found in Annex III. The Parties shall keep Xxxxx XXX up to objectdate. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. subjects.2 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data 2 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-sub- processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business 3 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. subjects.3 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure 3 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-sub- processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-sub- processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. MODULE TWO: Transfer controller to processor (a) GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation authorization for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.88.83. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-sub- processor contract and to instruct the sub-processor to erase or return the personal data. (a) GENERAL WRITTEN AUTHORISATION The data importer has the controller’s general authorization for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s). (b) the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects.5 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Xxxxxx 8.

Use of sub-processors. (a) SPECIFIC PRIOR AUTHORISATION The data importer has shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed listprior specific written authorisation. The data importer shall specifically inform submit the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors request for specific authorisation at least 30 business days in advance, thereby giving the data exporter sufficient [Specify time to be able to object to such changes period] prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter processor, together with the information necessary to enable the data exporter to exercise its right decide on the authorisation. The list of sub-processors already authorised by the data exporter can be found in Annex III. The Parties shall keep Xxxxx XXX up to objectdate. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. subjects.3 The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the 3 This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-sub- processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-sub- processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-sub- processors at least 30 business thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.87.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business ten (10) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjectssubjects3. The Parties agree that, by complying with this Clause, the data importer fulfils fulfills its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The the data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect project business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The the data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil fulfill its obligations under that contract. (e) The the data importer shall agree [to] a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-sub- processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Use of sub-processors. (a) The data importer has the data exporter’s general authorisation for the engagement of sub- sub-processor(s) from an agreed list. The data importer shall specifically inform inf orm the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 business thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-sub- processor(s). The data importer shall provide the data exporter with the information inf ormation necessary to enable the data exporter to exercise its right to object. (b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils f ulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses. (c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential conf idential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy. (d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure f ailure by the sub-processor to fulfil its obligations under that contract. (e) The data importer shall agree to a third-party beneficiary clause with the sub-processor whereby - – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.