Data Protection Addendum

1. United States.

With respect to Users in the United States, the following provisions shall apply:

2. Definitions.

Capitalized words used in this Data Protection Addendum ("DPA") that are not expressly defined in this DPA have the meaning set forth in the Agreement.

a. "Customer Data" means information provided or made available by Customer to Ayasis Yazılım ve Bilişim Teknolojileri Anonim Şirketi ("Company") for Processing on Customer's behalf to provide the Platform.

b. "Controller" means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

c. "Data Protection Legislation" means the privacy, data protection and data security laws and regulations applicable to Company's Processing of Personal Data under the Agreement.

d. "Personal Data" means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" defined in Data Protection Legislation, except that Personal Data does not include such information received by Company directly or from other sources (such as its other customers) independent of Company's relationship with Customer.

e. "Process" or "Processing" means any operation or set of operations which is performed by Company on behalf of Customer under this Agreement, on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

f. "Processor" means the entity that Processes Personal Data on behalf of the Controller.

g. "Sub-processors" means third parties that Company engages to Process Personal Data in relation to the Services.

h. "Service Data" means any data relating to the use, support and/or operation of the Services, which is collected by Company from and/or about users of the Services and/or Customer's use of the Platform for use for Company's own purposes (certain of which may constitute Personal Data).

3. Compliance with Laws; Roles.

Each Party shall comply with all Data Protection Legislation applicable to it in its respective Processing of Personal Data under the Agreement. For purposes of this Agreement and as between the Parties, Customer is the Controller of the Personal Data and Company is the Processor of such data.

4. Notices and Consents.

Customer shall provide all notices and obtain all such consents required under applicable Data Protection Legislation from the Users to allow Company to Process the Personal Data to provide the Platform and as otherwise described in the Agreement, including in this DPA (the "Notices and Consents"). Customer represents and warrants that it has obtained and will maintain the Notices and Consents for all Users throughout the entire term of the Agreement.

5. Details of Processing.

Personal Data will be Processed for the purposes set forth in the Agreement, any applicable order form, and, with respect to Personal Data governed by GDPR (as defined in the European Annex 1), as further described in Appendix 1 to the European Annex 1.

6. Company Obligations.

a. Company shall implement and maintain reasonable administrative, technical, and organizational measures that are designed to preserve the confidentiality and availability of Personal Data Processed by Company via the Platform. Company shall implement the technical and organizational measures, as set forth in Annex 2 (Security Measures) ("Security Measures"). Customer has reviewed Security Measures and agrees that such measures are appropriate, taking into account the state of the art, the costs of implementation, nature, scope, context and purposes of the processing of Personal Data hereunder. Company may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Data.

b. Company shall take reasonable steps to ensure the reliability and integrity of any employees who have access to the Personal Data and ensure that employees are under a duty of confidentiality with respect to their Processing of the Personal Data.

c. Company shall enter into an agreement with each Sub-processor containing terms that offer substantially similar levels of data protection obligations and protection for Personal Data as those set out in this Section. Customer consents to Company engaging the Sub-processors for the purposes set forth in the Agreement and this DPA.

d. If Company becomes aware of a confirmed breach of its security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Personal Data in Company's possession, custody, or control (a "Security Incident"), Company shall inform Customer, within a reasonable amount of time, taking into account the timeframes required by Data Protection Legislation, with respect to the Security Incident. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Security Incident. Company will provide, to the extent available reasonable information, cooperation, and updates of material developments to enable Customer to fulfill any data breach reporting obligations it may have under Data Protection Legislation. However, Company provision of information and cooperation shall be at Customer's cost and expense to the extent any Security Incidents were caused by Customer or its Users or Data Subjects (as defined below). Company's notification of a Security Incident pursuant to this section shall not be considered an acknowledgement of any fault or liability with respect to the Security Incident. Company may take such other measures as it deems appropriate to mitigate the effects of the Security Incident. For the avoidance of doubt, Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems. If Customer determines that a Security Incident will be notified to any Supervisory Authority, any Data Subject(s), the public or others, to the extent such notice directly or indirectly refers to or identifies Company, where permitted by applicable laws, Customer agrees to (i) notify Company in advance, and (ii) in good faith, consult with Company and consider any clarifications or corrections Company may reasonably recommend or request to any such notification, which: (i) relate to Company's involvement in or relevance to such Security Incident; and (ii) are consistent with applicable laws.

7. Data Subject Inquiries.

Customer shall be solely responsible for responding to and fulfilling any inquiries from Users and other data subjects, including parents and legal guardians of Users where the User is a student of Customer (collectively, "Data Subjects") regarding their Personal Data in connection with the Processing under the Agreement, including any requests to exercise their rights under applicable Data Protection Legislation, and Customer shall handle all Data Subject inquiries in accordance with applicable Data Protection Legislation. Customer understands that Company is not required to take any action in response to any requests from Data Subjects except to notify such Data Subjects to contact Customer. To the extent Customer cannot obtain a copy of, delete or amend the Personal Data directly within the Platform, Customer may contact Company and Company, with Customer's express written permission and provided Customer has obtained the appropriate consent from the applicable Data Subject, will provide a copy of, delete or amend such Data Subject's Personal Data in accordance with Customer's instructions. To the extent legally permitted, Customer shall be responsible for reasonable costs arising out of Company's provision of assistance with Customer's Data Subject requests. Customer shall indemnify, defend, and hold harmless Company and its affiliates, subsidiaries, successors and assigns (and the officers, directors, employees, sublicensees, customers, and agents of Company and its affiliates, subsidiaries, successors, and assigns), from and against any and all losses, demands, liabilities, damages, fines, settlements, expenses, and costs (including without limitation reasonable attorneys' fees and costs), arising from, in connection with, Company complying with Customer's instructions under this Agreement.

8. Authorized Disclosure of Personal Data.

a. Customer acknowledges and agrees that, at Customer's request and reasonable cost, Company may provide Personal Data to third-parties or other entities to whom Customer requests Company provide Personal Data (e.g., State Board of Education). Customer shall make such a request to disclose Personal Data in writing ("Authorization"). Customer acknowledges and agrees that each Authorization will result in Customer electing, in its sole discretion, to transfer the Personal Data to the recipients that Customer selects.

b. The entities identified in Section 8(a) are collectively defined as "Recipients."

c. Customer acknowledges that Content may contain Personal Data and may be subject to Data Protection Legislation. Customer will hold Company harmless, and not liable in any way, for Company's disclosure of Personal Data to the Recipients in accordance with an Authorization.

d. Company makes no warranty (a) that the use of the Personal Data by the Recipient is valid or in compliance with applicable Data Protection Legislation and Customer's organization's policies or (b) that Personal Data will remain secure upon transfer to the Recipient and disclaims any responsibility for the transfer. Customer acknowledges that the Personal Data will be provided on an "as is", "as available" basis.

9. Data Retention.

Company will delete Personal Data within a reasonable amount of time after the termination or expiration of the Agreement, except that Company may retain Personal Data as required by applicable legal requirements or as agreed by Customer. For the avoidance of doubt, the foregoing shall not apply to Anonymized Data (as defined below).

10. Company Data.

Customer acknowledges and agrees that Company may create and derive performance, system, and operational data, aggregated data, anonymized data and de-identified data from Processing related to the Agreement, including in connection with the Platform (collectively, "Anonymized Data"). In generating such data, Company shall (a) take reasonable measures to ensure that such data cannot be associated with a Data Subject, and (b) not attempt to reidentify such data, except as permitted under Data Protection Legislation.

11. Service Data.

a. Customer acknowledges that Provider may collect, use and disclose Service Data for its own business purposes, such as:

• (i) for accounting, tax, billing, audit, and compliance purposes;
• (ii) to provide, improve, develop, optimize, market and maintain the Services;
• (iii) to investigate fraud, spam, wrongful or unlawful use of the Services; and/or
• (iv) as otherwise permitted or required by applicable law.

b. In respect of any such Processing described in Section 11, Company:

• (i) independently determines the purposes and means of such Processing;
• (ii) shall comply with Data Protection Legislation (if and as applicable in the context);
• (iii) shall Process such Service Data as described in Company's relevant privacy notices/policies, as updated from time to time; and
• (iv) where possible, shall apply technical and organizational safeguards to any relevant Personal Data that are no less protective than the Security Measures.

12. Education Records.

As applicable, to the extent Company has access to "Education Records" and "Personally Identifiable Information" (as those terms are defined in Family Education Rights and Privacy Act, 20 U.S.C. § 1232g and its implementing regulations, 34 C.F.R. Part 99 (together, "FERPA")) in connection with its provision of the Platform that is not otherwise permitted under FERPA: (a) Customer agrees that Company has met the criteria for being a "School Official" with "Legitimate Educational Interests" (as those terms are used in FERPA) in such Education Records and Personally Identifiable Information; and (b) Company agrees that such Education Records and Personally Identifiable Information will be used only for authorized purposes under the Agreement, and it will not redisclose such Education Records or Personally Identifiable Information except with Authorization from Customer or where such redisclosure is otherwise permitted under FERPA.

13. State Specific Privacy Addenda.

If applicable, the Parties agree to the State Specific Data Protection Addenda for the applicable state(s).

14. Updates to this DPA.

Notwithstanding anything to the contrary in the Agreement, Company reserves the right to modify this DPA from time to time in its sole discretion and without Customer's prior consent except where required by applicable law ("Updated DPA"). Customer agrees that any Updated DPA will be effective immediately upon Company emailing the Updated DPA to Customer, unless Company is required by applicable law to obtain Customer's consent, in which case, such Updated DPA will be effective immediately upon the provision of such consent. Company will also endeavor to notify Customer of any material revision to this DPA at least ten (10) days prior to such revision coming into effect, using Customer's email address as set forth in the most recently executed Order Form.

State Specific Addenda

California

With respect to Pupil Records (as defined in Cal. Educ. Code § 49073.1) that Company processes on behalf of a Customer in California, the following provisions shall apply to the extent required by applicable law:

1. Pupil Records that Company processes on behalf of Customer are the property of and under the control of Customer, except a User may retain possession and control of User-Generated Content where the User opens a personal account.
2. Company shall limit its use of Pupil Records to those purposes specified in the Agreement, the DPA, and any notice of practices relating to children's privacy.
3. Procedures for the review and correction of Pupil Records shall be in accordance with the DPA.
4. Company shall implement, maintain, and use reasonable measures to ensure the security and confidentiality of Pupil Records as specified in the DPA.
5. Procedures for notification in the event of unauthorized disclosure of Pupil Records shall be in accordance with the terms of DPA.
6. Company certifies that retention of Pupil Records shall be limited in accordance with the terms of the DPA.
7. Company's and Customer's access to and use of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to the terms of the DPA.
8. Company shall not use Personal Data in Pupil Records to engage in targeted advertising.

Colorado

With respect to Student Personally Identifiable Information (as defined in Colo. Rev. Stat. Ann. § 22-16-103) that Company processes on behalf of a Customer in Colorado, the following provisions shall apply to the extent required by applicable law:

1. Company shall comply in all material respects with the requirements of Colo. Rev. Stat. § 22-16-108 with regard to the provision of clear information regarding collection, use, and disclosure of Student Personally Identifiable Information, as specified in the DPA and any notice of practices related to children's privacy.
2. Company shall comply in all material respects with Colo. Rev. Stat. § 22-16-109 with regard to the collection, use, and disclosure of Student Personally Identifiable Information, as specified in the DPA and any notice of practices related to children's privacy.
3. Company shall comply in all material respects with the requirements of Colo. Rev. Stat. § 22-16-110 with regard to data security and retention of Student Personally identifiable information, as specified in the DPA and any notice of practices related to children's privacy.

Connecticut

With respect to Student Information, Student Records, and Student-generated Content (as those terms are defined in Conn. Gen. Stat. § 10-234aa) (collectively, "CT Student Data") that Company processes on behalf of a Customer in Connecticut, the following provisions shall apply to the extent required by applicable law:

1. CT Student Data that Company processes on behalf of Customer are Customer Data and under the control of Customer.
2. Company retention of CT Student Data shall be in accordance with the DPA and any notice of practices related to children's privacy.
3. Company shall limit its use of CT Student Data to those purposes specified in the Agreement, DPA, and any notice of practices related to children's privacy.
4. Procedures for the review and correction of CT Student Data shall be in accordance with any notice of practices related to children's privacy.
5. Company shall implement, maintain, and use reasonable measures to ensure the security and confidentiality of CT Student Data as specified in the DPA.
6. Procedures for notification in the event of unauthorized disclosure of CT Student Data shall be in accordance with the terms of the DPA.
7. Company and Customer access to and use of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to the terms of the DPA.
8. Laws of the state of Connecticut shall govern rights and duties with regard to CT Student Data, as specified in the Agreement.
9. In the event that any provision or the application of the Agreement or DPA is held invalid by a court of competent jurisdiction, severability of terms shall be in accordance with the Agreement.

District of Columbia

With respect to Personally Identifiable Student Information (as defined in D.C. Code § 38-831.01(14)) that Company processes on behalf of a Customer in the District of Columbia, the following provisions shall apply to the extent required by applicable law:

1. Procedures for notification in the event of unauthorized disclosure of Personally Identifiable Student Information shall be in accordance with the terms of the DPA.
2. Personally Identifiable Student Information that Company processes on behalf of Customer are Customer Data and under the control of Customer.
3. Retention of Personally Identifiable Student Information shall be limited in accordance with the terms of the DPA.

Idaho

With respect to Student Data (as defined in Idaho Code Ann. § 33-133) that Company processes on behalf of a Customer in Idaho, the following provisions shall apply to the extent required by applicable law:

1. Company is permitted to use Anonymized Data, as disclosed in the DPA and Privacy Policy, as applicable.
2. Company is permitted to use Student Data for secondary uses with consent of a student's parent or guardian and as disclosed in accordance with the DPA and Privacy Policy, as applicable.
3. Company shall not use (including for marketing or advertising purposes) or sell Student Data except as specified in the DPA or with express prior parental consent.

Illinois

With respect to Covered Information (as defined in 105 Ill. Comp. Stat. Ann § 85/5) that Company processes on behalf of a Customer in Illinois, the following provisions shall apply to the extent required by applicable law:

1. The types of Covered Information for which Company may act as a processor on behalf of Customer under the Agreement are specified in the DPA and any notice of practices related to children's privacy, as applicable.
2. The Services provided to Customer by Company are specified in the Agreement.
3. Company and Customer access to and use and disclosure of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to FERPA, in accordance with the terms of the DPA.
4. Procedures in the event of a security breach shall be in accordance with the terms of the DPA; provided that, if the security breach is attributed to Company, any costs and expenses incurred by the Customer in investigating and remediating the breach will be allocated between Company and the Customer.
5. Company's retention of Covered Information shall be in accordance with the DPA any notice of practices related to children's privacy, as applicable.
6. Company agrees that Customer may publish a redacted copy of the Agreement and DPA on its website and/or make the documents available for inspection by the general public at its administrative office, as applicable.

Louisiana

With respect to Personally Identifiable Information (as defined in La. Stat. Ann. § 17:3914(B)(1)) that Company processes on behalf of a Customer in Louisiana, the following provisions shall apply to the extent required by applicable law:

1. Company shall limit access to Personally Identifiable Information it processes on behalf of Customer in accordance with the DPA and any notice of children's privacy practices.
2. Company shall comply with the standards governing the privacy and security of Personally Identifiable Information as set forth in the DPA and any notice of children's privacy practices.
3. Privacy and security audits performed by Customer's superintendent shall be completed in accordance with the DPA.
4. Procedures for unauthorized disclosure of Personally Identifiable Information shall be in accordance with the terms of the DPA.
5. Company's retention of Personally Identifiable Information shall be limited in accordance with the terms of the Agreement, DPA, and any notice of children's privacy practices, as applicable.
6. Company's disposal of Personally Identifiable Information shall be done in accordance with the terms of the Agreement, DPA, and any notice of children's privacy practices, as applicable.

Minnesota

With respect to Educational Data (as defined in Minn. Stat. § 13.32) that Company processes on behalf of a Customer in Minnesota, the following provisions shall apply to the extent required by applicable law:

1. Company shall limit access to Educational Data it processes on behalf of Customer in accordance with the DPA and any notice of children's privacy practices.

Montana

With respect to Pupil Records (as defined in Mont. Code Ann § 20-7-1324(6)) that Company processes on behalf of a Customer in Montana, the following provisions shall apply to the extent required by applicable law:

1. Pupil Records that Company processes on behalf of Customer are the property of and under the control of Customer, except a User may retain possession and control of User-Generated Content where the User opens a personal account.
2. Company shall limit its use of Pupil Records to those purposes specified in the Agreement, the DPA, and any notice of children's privacy practices.
3. Procedures for the review and correction of Pupil Records shall be in accordance with the DPA.
4. Company shall implement, maintain, and use reasonable measures to ensure the security and confidentiality of Pupil Records as specified in the DPA.
5. Procedures for notification in the event of unauthorized disclosure of Pupil Records shall be in accordance with the terms of the DPA.
6. Company certifies that retention of Pupil Records shall be limited in accordance with the terms of the DPA.
7. Company's and Customer's access to and use of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to the terms of the DPA.
8. Company shall not use Personal Data in Pupil Records to engage in targeted advertising.

New York

With respect to personally identifiable information (as defined in N.Y. Comp. Codes R. & Regs. tit. 8, § 121.1(m)) ("NY PII") that Company processes on behalf of a Customer in New York, the following provisions shall apply to the extent required by applicable law (for the avoidance of doubt, NY PII is a subset of Personal Data as defined in the Agreement):

1. Company certifies that its technologies, safeguards and practices align with the NIST Cybersecurity Framework.
2. Company shall comply in all material respects with Customer's data security and privacy policy and applicable state and federal laws.
3. Company shall limit access to NY PII it processes on behalf of Customer in accordance with the DPA any notice of practices related to children's privacy.
4. Company shall limit its use of NY PII to those purposes specified in the Agreement, DPA, any notice of practices related to children's privacy.
5. Company shall not disclose NY PII except in accordance with the DPA any notice of practices related to children's privacy.
6. Company shall implement, maintain, and use reasonable measures that are designed to ensure the security and confidentiality of NY PII as specified in the DPA.
7. Company shall use encryption to protect electronic NY PII in transit or in storage.
8. Company shall not sell NY PII and shall limit its use and disclosure of NY PII in accordance with the DPA, and any notice of practices related to children's privacy.
9. Data Security and Privacy Plan

a. Company will implement applicable data security and privacy requirements as specified in the DPA.

b. Company shall implement, maintain, and use reasonable measures that are designed to ensure the security and confidentiality of NY PII as specified in the DPA.

c. Company shall train its officers and employees on applicable laws prior to granting access to User data as specified in the DPA.

d. Company shall require that Sub-processors protect NY PII and manage breaches and unauthorized disclosure as specified in the DPA.

e. Company shall manage data security and privacy incidents as specified in the DPA. Procedures for notification in the event of breaches and unauthorized disclosures shall be in accordance with the terms of the DPA.

f. Company retention of NY PII shall be limited in accordance with the DPA.

Ohio

With respect to Education Records (as defined in Ohio Rev. Code § 3319.325(A)) that Company processes on behalf of a Customer in Ohio, the following provisions shall apply to the extent required by applicable law:

1. Company shall limit access to Education Records it processes on behalf of Customer in accordance with the DPA and any notice of children's privacy practices.

Utah

With respect to Student Data (as defined in Utah Code Ann. § 53E-9-301(17)) that Company processes on behalf of a Customer in Utah, the following provisions shall apply to the extent required by applicable law:

1. Company shall limit its collection, use, storage, and sharing of Student Data to those purposes specified in the Agreement, DPA, any notice of practices related to children's privacy, as applicable.
2. Processing of Student Data by Sub-processors shall be in accordance with the DPA and any notice of children's privacy practices, as applicable.
3. Company's retention of Student Data shall be limited in accordance with the terms of the Agreement, DPA, any notice of children's privacy practices, as applicable.
4. Company shall not use Student Data for purposes other than those specified in the Agreement and DPA and except as permitted by Utah Code Ann. § 53E-9-309(4) or as requested by the Customer.
5. Company agrees that, at Customer's request, Customer or Customer's designee may conduct an audit of Company, in accordance with this DPA, to verify compliance with the Agreement and Data Processing Agreement to the extent required by Utah Code Ann. § 53E-9-309.

Virginia

With respect to Student Personal Information (as defined in Va. Code Ann. § 22.1-289.01) that Company processes on behalf of a Customer in Virginia, the following provisions shall apply to the extent required by applicable law:

1. The types of Student Personal Information for which Company may act as a processor on behalf of Customer shall be specified in the DPA and any notice of practices related to children's privacy, as applicable.
2. Privacy of Student Personal Information processed by Company on behalf of Customer shall be subject to the DPA and any notice of practices related to children's privacy, as applicable, and notification of material changes shall be in accordance with the DPA.
3. Company shall maintain reasonable measures to ensure the security, privacy, confidentiality, and integrity of Student Personal Information as specified in the DPA.
4. Procedures for access to and the review and correction of Student Personal Information shall be in accordance with the DPA and any notice of practices related to children's privacy, applicable.
5. Company shall not collect, maintain, use, or share Student Personal Information except for purposes specified in the Agreement, DPA, and/or any notice of practices related to children's privacy, except with consent of the Customer or student's parent or legal guardian, as applicable.
6. Company shall require that its Sub-processors of Student Personal Information on behalf of Customer comply with Company's policies and security measures in accordance with the DPA.
7. Company's retention of Student Personal Information shall be limited in accordance with the terms of the DPA any notice of practices related to children's privacy, as applicable.
8. Company shall not use Student Personal Information to engage in targeted advertising to students.
9. Company shall not use Student Personal Information to create a personal profile of a student, except for the purposes specified in the Agreement, DPA, any notice of practices related to children's privacy, as applicable.
10. Company shall not knowingly sell Student Personal Information except to the extent that Company is sold to or acquired by a successor entity that purchases, merges with, or otherwise acquires Company.

Annex 1 - European Annex

1. Definitions.

In this Annex, the following terms have the meanings set out below:

a. "Annex Effective Date" means the effective date of the Agreement.

b. "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

c. "Data Subject Request" means the exercise by a Data Subject of its rights in accordance with applicable Data Protection Legislation in respect of Personal Data and the Processing thereof.

d. "GDPR" means, as and where applicable to the Processing concerned, and each as amended from time to time: (i) the General Data Protection Regulation (EU) 2016/679 ("EU GDPR"); and/or (ii) the EU GDPR as it forms part of UK law ("UK GDPR").

e. "Personal Data Breach" means a Security Incident affecting Personal Data subject to GDPR which leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Company's possession, custody or control.

f. "Restricted Transfer" means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) in the context of the EU GDPR, any country or territory outside the European Economic Area ("EEA") which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); and (ii) in the context of the UK GDPR, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a "UK Restricted Transfer"), which would be prohibited without a legal basis under Chapter V of the GDPR.

g. "SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.

h. "Supervisory Authority" (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; and (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner's Office (or its successor).

i. "UK Transfer Addendum" means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the UK Mandatory Clauses included in Part 2 thereof (the "UK Mandatory Clauses").

Unless otherwise defined in this European Annex, all capitalized terms in this European Annex shall have the meaning given to them in the DPA and/or the Agreement.

2. Scope and Prevalence.

a. This European Annex shall:

• (i) be incorporated into and form part of the DPA and the Agreement with effect on and from the Annex Effective Date.
• (ii) apply only if and to the extent GDPR governs Company's Processing of Personal Data in performance of the Service(s) as a 'processor' as defined under GDPR; and
• (iii) not apply to Company's Processing of any Personal Data for Company's own business/customer relationship administration purposes, its own marketing or service analytics, its own information and systems security purposes supporting the operation of the Services, nor its own legal, regulatory or compliance purposes.

b. In the event of any conflict or inconsistency between:

• (i) this European Annex and the Agreement and/or the DPA, this European Annex shall prevail solely with respect to Processing of Personal Data subject to GDPR;
• (ii) the SCCs and this European Annex, the DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply; or
• (iii) the UK Transfer Addendum and this European Annex and/or the Agreement, the UK Transfer Addendum, shall prevail in respect of the UK Restricted Transfer to which they apply.

3. Processing Instructions.

c. Company shall not Process Personal Data other than: (i) on Customer's instructions set out in the Agreement and this DPA; or (ii) as required by applicable laws, provided that in such circumstances, Company shall inform Customer in advance of the relevant legal requirement requiring such Processing if and to the extent Company is: (i) required to do so by Data Protection Legislation; and (ii) permitted to do so in the circumstances.

d. Customer instructs and authorizes Company to Process Personal Data for the purposes set out in the Agreement (as further described in Appendix 1 (Data Processing Details) to this European Annex).

e. Where required by Data Protection Legislation, if Company receives instruction from Customer that, in its reasonable opinion, infringes Data Protection Legislation, Company shall notify Customer.

4. Data Subject Rights.

Company, taking into account the nature of the Processing of Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests.

5. DPIAs and Consultations.

If and to the extent expressly required by GDPR in relation to any given Processing of Personal Data, Company shall, taking into account the nature of the Processing and the information available to it, provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with Supervisory Authorities, which are required by GDPR (including, where applicable, Article 35 or Article 36 of the GDPR (as applicable)), in each case solely in relation to such Processing of Personal Data by Company.

6. Personal Data Breaches.

Company shall notify Customer without undue delay upon Company's confirmation of a Personal Data Breach affecting Personal Data. Company shall provide Customer with information (insofar as such information is within Company's possession and knowledge and does not otherwise compromise the security of any other personal data processed by Company) to allow Customer to meet its obligations under the GDPR to report the Personal Data Breach. To the extent available, this notification will include Company's then-current assessment of the following, which may be based on incomplete information: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) measures taken or proposed to be taken by Company to address the Personal Data Breach, including, where applicable, measures to mitigate its possible adverse effects. Nothing in this DPA or in the SCCs shall be construed to require Company to violate, or delay compliance with, any legal obligation it may have with respect to a Personal Data Breach or other security incidents generally.

7. Sub-processors.

a. Company shall give Customer prior written notice of the appointment of any proposed Sub-processor, including reasonable details of the Processing to be undertaken by the Sub-processor, by posting here and providing written notice to Customer. Customer agrees that Customer is solely responsible for ensuring that it subscribes to email updates to the list of Sub-processors, and it shall do so. If, within ten (10) business days of receipt of that notice, Customer notifies Company in writing of any objections to the proposed appointment (made in good faith based upon evidenced concerns that the use of that proposed Sub-processor would cause Customer to be in material and unavoidable breach of applicable Data Protection Legislation): (a) Company shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-processor; and (b) where: (i) such a change cannot be made within thirty (30) days from Company's receipt of Customer's notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may terminate without penalty the Processing of Personal Data and/or the Agreement with respect only to those services which cannot be provided by Company without the use of the objected-to new Sub-processor by providing written notice to the other Party. If Customer does not object to Company's appointment of a Sub-processor during the objection period referred to in this Section 6 (European Annex), Customer shall be deemed to have approved the engagement and ongoing use of that Sub-processor.

b. With respect to each Sub-processor, Company shall maintain a written contract between Company and the Sub-processor that includes terms which offer at least an equivalent level of protection for Personal Data as those set out in this DPA (including the Security Measures). As between the Parties, Company shall remain liable for any breach of this European Annex caused by a Sub-processor.

8. International Data Transfers.

a. Entry into SCCs. In respect of any Restricted Transfer of Personal Data from Customer to Company under this DPA that is: (a) an EU Restricted Transfer, the Parties hereby enter into and agree to comply with their respective obligations set out in the SCCs; and/or (b) a UK Restricted Transfer, the Parties hereby enter into and agree to comply with their respective obligations set out in the SCCs as varied by the UK Transfer Addendum.

b. Population of SCCs. In respect of any SCCs entered into pursuant to Section 7(a) of this European Annex, the Parties agree as follows: (a) each of the Parties is hereby deemed to have signed the SCCs at the relevant signature block in Annex I to the Appendix to the SCCs; (b) as applicable: (i) Module Two of the SCCs applies to any relevant Restricted Transfer involving Processing of Personal Data in respect of which Customer is a Controller; (c) as and where applicable to the relevant Module of the SCCs and the Clauses thereof: (i) in Clause 7: the 'Docking Clause' is not used; (ii) in Clause 9: 'Option 2: General Written Authorisation' applies, and the minimum time period for advance notice of the addition or replacement of Sub-processors shall be the advance notice period set out in Section 6(a) of this European Annex; (iii) in Clause 11: the optional language is not used; (iv) in Clause 13: all square brackets are removed and all text therein is retained; (v) in Clause 17: 'Option 1' applies, and the Parties agree that the SCCs shall be governed by the laws of Ireland; and (vi) in Clause 18(b): the Parties agree that any dispute arising from the SCCs shall be resolved by the courts of Ireland; and (d) in respect of the Annexes to the Appendix to the SCCs: (i) Annex I is populated with the corresponding information detailed in Appendix 1 (Data Processing Details) to this European Annex; and (ii) Annex II is populated with reference to the information contained in and determined by Section 6(a) of the DPA (including the Security Measures).

c. Population of UK Transfer Addendum. Where relevant in accordance with Section 7.1(b) of this European Annex, the SCCs apply to any UK Restricted Transfers as varied by the UK Transfer Addendum in the following manner: (i) 'Part 1 to the UK Transfer Addendum': (A) Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details set out in Appendix 1 (Data Processing Details) and Section 7(b) to this European Annex; and (B) Table 4 to the UK Transfer Addendum is completed by the box labelled 'Data Importer' being deemed to have been ticked; and (ii) 'Part 2 to the UK Transfer Addendum': the Parties agree to be bound by the UK Mandatory Clauses and that the SCCs shall apply to any UK Restricted Transfers as varied in accordance with those Mandatory Clauses.

d. Operational Clarifications. In relation to any SCCs entered into pursuant to Section 7(a) of this European Annex, the Parties agree as follows: (a) when complying with its transparency obligations under Clause 8.3 of the SCCs, Customer shall not provide or otherwise make available, and shall take all appropriate steps to protect, Company's and its licensors' trade secrets, business secrets, confidential information and/or other commercially sensitive information; (b) for the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required; (c) the terms and conditions of Section 6(c)-(d) of the DPA and Section 6 of this European Annex apply in relation to Company's appointment and use of Sub-processors under the SCCs; (d) any approval by Customer of Company's appointment of a Sub-processor that is given expressly or deemed pursuant to Section 6 of this European Annex constitutes Customer's documented instructions to effect disclosures and onward transfers to any relevant Sub-processors if and as required under Clause 8.8 of the SCCs; (e) the audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any relevant terms and conditions detailed in Section 6; (f) certification of deletion of Personal Data as described in Clauses 8.5 and 16(d) of the SCCs shall be provided only upon Customer's written request; (g) in relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the DPA to the SCCs, shall be read as a reference to those SCCs as varied by Section 7(c) of this European Annex; and (h) in respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) – on specific written request; accompanied by suitable supporting evidence of the relevant request – Company shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with relevant provisions of this DPA in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer's compliance with Data Protection Legislation.

9. Audits.

a. Information provision and audits. Company shall make available to Customer, upon a reasonable request by Customer or its authorized designee, such information as Company (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this European Annex. Subject to Sections 8(b)-(d) of this European Annex, in the event that Customer (acting reasonably) is able to provide documentary evidence that such information is not sufficient in the circumstances to demonstrate Company's compliance with this European Annex, Company shall allow for and contribute to audits by Customer or an auditor mandated by Customer in relation to the Processing of Personal Data by Company.

b. Customer responsibilities. Customer shall give Company reasonable notice of any audit to be conducted under Section 8(a) of this European Annex (which shall in no event be less than thirty (30) days' notice, unless a shorter notice period is specifically required under Data Protection Legislation relevant to the audit concerned) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Company's premises, equipment, personnel, data, and business (including any interference with the confidentiality or security of the data of Company's other customers or the availability of Company's services to such other customers).

c. Audit plans. Prior to conducting any audit, Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Company will review the proposed audit plan and provide Customer with any feedback, concerns or questions (for example, any request for information that could compromise Company security, privacy, employment or other relevant policies). Company will work cooperatively with Customer to agree on a final audit plan.

d. Limitations. Company need not give access to its premises for the purposes of any audit under this Section 8 of the European Annex: (a) where a third party audit report or certification (e.g., SOC 2 Type 2, ISO 2700x, NIST or similar audit report or certification) is provided in lieu of such access (acceptance of which for this purpose not to be unreasonably withheld, delayed or conditioned by Customer); (b) to any individual unless they produce reasonable evidence of their identity; (c) to any auditor whom Company has not approved in advance (acting reasonably); (d) to any individual who has not entered into a non-disclosure agreement with Company on terms acceptable to Company (acting reasonably); (e) outside normal business hours at those premises; or (f) on more than one occasion in any calendar year during the term of the Agreement, except for any audits which Customer is required to carry out under Data Protection Legislation or by a Supervisory Authority. Nothing in this DPA shall require Company to furnish more information about its Sub-processors in connection with such audits than such Sub-processors make generally available to their customers. Nothing in this Section 8 of the European Annex shall be construed to obligate Company to breach any duty of confidentiality.

10. Return and Deletion.

a. General. Upon expiration or earlier termination of the Agreement, Company shall return and/or delete all Personal Data in Company's care, custody or control in accordance Customer's instructions as to the post termination return and deletion of Personal Data expressed in the Agreement. To the extent that deletion of any Personal Data contained in any back ups' maintained by or on behalf of Company is not technically feasible within the timeframe set out in Customer's instructions, Company shall (a) securely delete such Personal Data in accordance with any relevant scheduled back up deletion routines (e.g., those contained within relevant business continuity and disaster recovery procedures); and (b) pending such deletion, put such Personal Data beyond use.

b. Permitted retention. Notwithstanding the foregoing, Company may retain Personal Data where required by applicable laws, provided that Company shall (a) maintain the confidentiality of all such Personal Data and (b) Process the Personal Data only as necessary for the purpose(s) and duration specified in the applicable law requiring such retention.

11. Liability.

The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this european annex and the sccs (if and as they apply) will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement; provided that, nothing in this section 10 of the european annex will affect any person's liability to data subjects under the third Party beneficiary provisions of the sccs (if and as they apply).

12. Required Updates.

Each Party shall act in good faith to agree variations to this European Annex that are reasonably necessary to address the requirements of GDPR from time to time (including to apply a new transfer mechanism if required).

Appendix 1 Data Processing Details

Note: this Appendix 1 (Data Processing Details) to the European Annex includes certain details of the Processing of Personal Data as required: (a) by GDPR; and (b) to populate the Appendix to the SCCs in the manner described in Section 8(b) of the European Annex.

Vendor / 'Data Importer' Details

Customer / 'Data Exporter' Details

Details of Processing

Annex 2 Security Measures

As from the Effective Date, Company will implement and maintain the Security Measures as set out in this Annex.

1. Dedicated staff responsible for the Provider's information security program.
2. Data security controls which include, at a minimum, logical segregation of data, restricted (e.g., role-based) access and monitoring, and utilization of commercially available industry standard encryption technologies for Personal Data that is transmitted over public networks (i.e., the Internet).
3. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.
4. Password controls designed to manage and control password strength, expiration and usage including prohibiting users from sharing passwords.
5. System audit or event logging and related monitoring procedures to proactively record user access and system activity.
6. Monitoring and maintenance of technology and information systems, including secure disposal of systems and media prior to final disposal or release from the Company's possession.
7. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to the Company's technology and information assets.
8. Incident management procedures designed to allow Company to investigate, respond to, mitigate and notify of events related to the Company's technology and information assets.
9. Network security controls that provide for the use of enterprise firewalls and intrusion detection systems designed to protect systems from intrusion and limit the scope of any successful attack.
10. Business resiliency/continuity and/or disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergencies or disasters.