Common use of Customer Data Clause in Contracts

Customer Data. 8.1 You, not bookinglab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You6.1 The Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 6.2 iplicit shall follow its archiving procedures for Customer Data as set out in its Backup Policy (▇▇▇.▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇▇) or such other website address as may be notified to the Customer from time to time, as such document may be amended by iplicit in its sole discretion from time to time. bookinglab In the event of any loss or damage to Customer Data, the Customer’s sole and JRNI is exclusive remedy shall be for iplicit to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest backup of such Customer Data maintained by iplicit in accordance with the archiving procedure described in its Backup Policy. iplicit shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party. 6.3 Iplicit shall, in providing the Services, comply with its Privacy and Security Policy relating to the privacy and security of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of available at ▇▇▇.▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇▇ and the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards Data Protection Addendum attached to these terms or such other standards website address as are substantially equivalent may be notified to ISO 27001the Customer from time to time, as such document may be amended from time to time by Iplicit in its sole discretion. 8.3 6.4 If JRNI and/or bookinglab iplicit processes any Personal Data personal data on your the Customer’s behalf when performing its obligations under this Agreementagreement, the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller data controller and JRNI and/or bookinglab iplicit shall be a Data Processor data processor and in any such case: (a) you : Unless agreed otherwise in writing by the Company, the Customer acknowledges and agrees that the personal data may not be transferred or stored outside the EEA in order to carry out the Services and iplicit’s other obligations under this agreement; the Customer shall ensure that you are the Customer is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab iplicit so that they iplicit may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement agreement on your the Customer’s behalf; (b) you ; the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) data protection legislation; iplicit shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You22.2. Where either Party acquires, not bookinglab or JRNIby operation of Law, title to Intellectual Property Rights that is inconsistent with the allocation of title set out in Clause 22.1, 22.2 and 22.3, it shall assign in writing such Intellectual Property Rights as it has acquired to the other Party on the request of the other Party (whenever made). 22.3. Neither Party shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and any right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing other Party's names, logos or trade marks on any of its products or services without the other Party's prior written consent. 22.4. The Supplier if requested by the Customer will grant to the Customer or shall procure the direct grant to the Customer of, a 10 year, royalty-free, irrevocable, nonexclusive licence to use the Project Specific IPR including but not limited to the right to copy, adapt, publish and distribute such Project Specific IPR. 22.5. The Supplier if requested by the Customer will grant to the Customer a 10 year, royalty-free and nonexclusive licence to use the Supplier Background IPR for any purpose relating to the Services (or substantially equivalent services) or for any destructionpurpose relating to the exercise of the Customer’s (or, damageif the Customer is a Central Government Body, lossany other Central Government Body’s) business or function. 22.6. In the event the licence of the Supplier Background IPR is terminated for Default or expires, the Customer shall: 22.6.1 immediately cease all use of the Supplier Background IPR; 22.6.2 at the discretion of the Supplier, return or failure destroy documents and other tangible materials that contain any of the Supplier Background IPR, provided that if the Supplier has not made an election within six (6) Months of the termination of the licence, the Customer may destroy the documents and other tangible materials that contain any of the Supplier Background IPR; and 22.6.3 ensure, so far as reasonably practicable, that any Supplier Background IPR that is held in electronic, digital or other machine-readable form ceases to store any Customer Data beyond its reasonable control or resulting be readily accessible (other than by the information technology staff of the Customer) from any failure in data transmission computer, word processor, voicemail system or operation of the Booking Service by youany other device containing such Supplier Background IPR. 8.2 As of 22.7. The Customer shall be freely entitled to sub-license the MSA Start Date, JRNI is certified rights granted to it pursuant to Clause 22.4 (Licence granted by the Supplier: Project Specific IPR). 22.8. The Customer may sub-license: 22.8.1 the rights granted under ISO 27001 and shall maintain an information security program Clause 22.5 (Licence granted by the Supplier: Supplier Background IPR) to a third party (including for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes avoidance of doubt, any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such caseReplacement Supplier) provided that: (a) you shall ensure that you are entitled the sub-licence is on terms no broader than those granted to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf;Customer; and (b) you shall ensure that the relevant sub-licence only authorises the third parties have been informed of, and have given their consent to, such use, processing, and transfer as required party to use the rights licensed in Clause 22.5 (Licence granted by all applicable Data Protection Laws; the Supplier: Supplier Background IPR) for purposes relating to the Services (cor substantially equivalent services) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing for any purpose relating to the exercise of the personal data Customer’s (or, if the Customer is a Central Government Body, any other Central Government Body’s) business or its accidental loss, destruction or damagefunction; and 22.8.2 the rights granted under Clause 22.5 (dLicence granted by the Supplier: Supplier Background IPR) notwithstanding to any other provision of this Agreement, but subject always Approved Sub-Licensee to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as the extent necessary to provide use and/or obtain the Services in accordance with clause 3, and otherwise in order benefit of the Project Specific IPR provided that the sub-licence is on terms no broader than those granted to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authorityCustomer. 8.4 From the MSA Start Date the Parties 22.9. The Customer shall comply with Appendix B(1) Data Protection be freely entitled to assign, novate or otherwise transfer its rights and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Lawslicence granted to it pursuant to Clause 22.4 (Licence granted by the Supplier: Project Specific IPR). 22.10. The Customer may assign, novate or otherwise transfer its rights and obligations under the licence granted pursuant to Clause 22.5 (Licence granted by the Supplier: Supplier Background IPR) to: 22.10.1 a Central Government Body; or 22.10.2 to any body (including any private sector body) which performs or carries on any of the functions and/or activities that previously had been performed and/or carried on by the Customer. 22.11. Where the Customer is a Central Government Body, any change in the legal status of the Customer which means that it ceases to be a Central Government Body shall not affect the validity of any licence granted in Clause 22.4 (Licence granted by the Supplier: Project Specific IPR) and/or Clause 22.5 (Licences granted by the Supplier: Supplier Background IPR). If the Customer ceases to be a Central Government Body, the successor body to the Customer shall still be entitled to the benefit of the licences granted in Clause 22.4 (Licence granted by the Supplier: Project Specific IPR) and Clause 22.5 (Licence granted by the Supplier: Supplier Background IPR). 22.12. If a licence granted in Clause 22.4 (Licence granted by the Supplier: Project Specific IPR) and/or Clause

Customer Data. 8.1 You5.1 The Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 5.2 In the event of any loss or damage to Customer Data, the Customer’s sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier. bookinglab and JRNI is The Supplier shall not be responsible for any of the foregoing or for any loss, destruction, damage, loss, alteration or failure to store any disclosure of Customer Data beyond its reasonable control or resulting from caused by any failure in data transmission or operation of third party (except those third parties sub-contracted by the Booking Service by youSupplier to perform services related to Customer Data maintenance and back-up). 8.2 As of 5.3 The Customer acknowledges and agrees that its Customer Data (non-confidential Authorised User answers and Authorised User progress) may be utilised by the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program Supplier for the Services that complies with proper performance of, and improvement of, the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001Services, including analysis and research, general metrics and analytics and general promotional uses. 8.3 If JRNI and/or bookinglab 5.4 To the extent that the Customer Data comprises Personal Data and the Supplier processes any such Personal Data on your the Customer’s behalf when performing its obligations under this Agreementagreement (Customer Personal Data), the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller and JRNI and/or bookinglab the Supplier shall be a the Processor of such Customer Personal Data Processor and in any such casethe following provisions apply: (a) you both parties shall ensure comply with the Data Protection Laws in the performance of this agreement; (b) the Supplier shall process the Customer Personal Data only in accordance with this agreement and any lawful instructions reasonably given by the customer from time to time (unless the Supplier is required by the Data Protection Laws or any other applicable laws to otherwise process the Customer Personal Data, in which case the Supplier shall promptly notify the Customer of this before performing the processing unless those Applicable Laws prohibit the Supplier from doing so; (c) unless otherwise agreed, the Customer Personal Data shall not be transferred outside of the European Economic Area (EEA); (d) the Customer shall be responsible for ensuring that you are it is lawfully entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab the Supplier, including by giving all necessary notices and/ or obtaining necessary consents, so that they the Supplier may lawfully use, process and transfer the Customer Personal Data it in accordance with this Agreement on your behalfagreement; (be) you shall ensure that taking into account the relevant third parties have been informed of, state of technical development and have given their consent to, such use, the nature of processing, and transfer as required by all applicable Data Protection Laws; (c) each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data Customer Personal Data or its accidental loss, alteration, disclosure, destruction or damage; (f) the Supplier shall ensure that all persons acting for it with access to Customer Personal Data are informed of the confidential nature of the Customer Personal Data and are subject to a suitable binding obligation to keep the same confidential; (g) the Customer acknowledges and agrees that the Supplier may use third party sub-Processors for the purposes of providing the Services, provided that the Supplier shall remain fully responsible for the acts and omissions of such third parties. The Supplier shall inform the Customer of any intended changes concerning the addition or replacement of sub- Processors involved the processing of Customer Personal Data, thereby giving the Customer the opportunity to object to such changes; (h) the Supplier shall assist the Customer in providing Data Subject access and allowing Data Subjects to exercise their rights under the GDPR; (i) the Supplier shall notify the Customer without delay and in any case within seventy-two (72) hours on becoming aware of any breach of Customer Personal Data; (j) the Supplier must assist the Customer in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments; and (dk) notwithstanding any other provision of the Supplier shall maintain complete and accurate records to demonstrate its compliance with this Agreement, but subject always clause 5.4 and allow for audits by the Customer to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or verify the Supplier’s compliance with this clause 5.4. 5.5 All Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services will be handled in accordance with clause 3, and otherwise the privacy notice referred to in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authoritySchedule 1. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You, not bookinglab or JRNITAAP, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI bookinglab, or TAAP is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking TAAP Visitor Book Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and TAAP shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI TAAP and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI TAAP and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI TAAP and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI TAAP or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI TAAP or bookinglab at your request) from the Booking TAAP Visitor Book Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You, not bookinglab Bookinglab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab Bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab Bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab Bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab Bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab Bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab Bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You6.1 The Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 6.2 Where the Customer stores the Customer Data on its own systems, the Customer shall follow its own back-up procedures for such Customer Data and Protean shall have no responsibility for any loss, destruction, alteration or disclosure of Customer Data that is held on the Customer’s own systems. 6.3 Where Protean is hosting the Customer Data, Protean shall follow its back-up procedures for Customer Data (details of which are available on request from Protean) or such other website address as may be notified to the Customer from time to time, as such procedures may be amended by Protean in its sole discretion from time to time. bookinglab In the event of any loss or damage to Customer Data, the Customer’s sole and JRNI is exclusive remedy shall be for Protean to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Protean in accordance with the back-up procedure described above. Protean shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by Protean to perform services related to Customer Data maintenance and back-up). 6.4 Protean shall, in supplying the Software to the Customer comply with its Privacy and Security Policy relating to the privacy and security of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond available on request to the Customer and on such website address as may be notified to the Customer from time to time, as such document may be amended from time to time by Protean in its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by yousole discretion. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 6.5 If JRNI and/or bookinglab Protean processes any Personal Data personal data on your the Customer’s behalf when performing its obligations under this Agreementagreement, the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller data controller and JRNI and/or bookinglab Protean shall be a Data Processor data processor and in any such case: (a) you 6.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Cloud Service and ▇▇▇▇▇▇▇’s other obligations under this agreement; 6.5.2 the Customer shall ensure that you are the Customer is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab Protean so that they Protean may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement agreement on your the Customer’s behalf; (b) you 6.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Lawsdata protection legislation; (c) 6.5.4 Protean shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and 6.5.5 each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 6.6 Without prejudice to clause 4.2, the Customer acknowledges and agrees that: 6.6.1 Protean is reliant upon third party providers in order to supply the Cloud Service; and 6.6.2 Protean shall have no liability to the Customer for any loss (dincluding any loss arising from the loss or misuse of Customer Data) notwithstanding any other provision to the Customer which is caused by an act or omission of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and such third party service providers providers. 6.7 The Customer acknowledges and agrees that when using the Software: 6.7.1 it is able to integrate with third party software (such as necessary to provide the Services in accordance with clause 3, and otherwise accounting software) in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority.submit and exchange Customer Data; and 8.4 From the MSA Start Date the Parties 6.7.2 it shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable indemnify Protean for any transfer claim against Protean by such third party software suppliers arising from the Customer’s submission and exchange of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service pursuant to a third party clause 6.7.1. 6.8 The Customer hereby gives consent to Protean to allow Protean to collate and use its Customer Data for ensuring Protean’s own marketing and other commercial purposes, provided that such transfer Customer Data is in compliance with the Parties' anonymised by Protean prior to its use, and such use is subject to Protean’s obligations of confidentiality under the Data Protection Lawsclause 11.

Customer Data. 8.1 You, not bookinglab or JRNIJRNI or You.Smart.Thing, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and bookinglab, JRNI or You.Smart.Thing is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking taptravel Service by you. 8.2 As of the MSA Start Date, JRNI and You.Smart.Thing is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or You.Smart.Thing and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or You.Smart.Thing and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or You.Smart.Thing and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI JRNI, You.Smart.Thing or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI JRNI, You.Smart.Thing or bookinglab at your request) from the Booking taptravel Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You5.1 The Customer shall own all rights, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back- Up Policy; such document may be amended by the Supplier in its sole discretion from time to time. bookinglab In the event of any loss or damage to Customer Data, the Customer’s sole and JRNI is exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with the archiving procedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties subcontracted by the Supplier to perform services related to Customer Data maintenance and back-up). 5.3 The Supplier shall, in providing the Services, comply with its Privacy and Security Policy relating to the privacy and security of the foregoing or for any destruction, damage, loss, or failure Customer Data; such document may be amended from time to store any Customer Data beyond time by the Supplier in its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by yousole discretion. 8.2 As of 5.4 If the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab Supplier processes any Personal Data personal data on your the Customer’s behalf when performing its obligations under this Agreementagreement, the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller data controller and JRNI and/or bookinglab the Supplier shall be a Data Processor data processor and in any such case: (a) you the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that you are the Customer is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab the Supplier so that they the Supplier may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement agreement on your the Customer’s behalf; (bc) you the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Lawsdata protection legislation; (cd) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 YouFor the purposes of this clause, not bookinglab or JRNI“data controller”, have sole responsibility “data processor”, “data subject”, “personal data”, “process”, “processing” and “appropriate technical and organisational measures” shall be interpreted in accordance with applicable Data Protection Legislation. Qrew Up and the Partner each acknowledge that, for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any purposes of the foregoing Data Protection Legislation: ● in respect of Partner Customers’ personal data, the Partner is the data controller and Qrew Up is the data processor; and ● in respect of Qrew Up Customers’ personal data, the Partner and Qrew Up each act as independent data controllers Where Qrew Up and the Partner are independent controllers, each acknowledge and agree that: ● the Partner must promptly (and in any event within 24 hours of the Partner or for its employees becoming aware of the matter) notify Qrew Up of any accidental or intentional damage, alteration, destruction, damageunauthorised disclosure, loss, misuse or failure theft of or to store the personal data of any Customer Data beyond which the Partner has access to (“Security Incident”). Partner shall provide full cooperation and prompt assistance to Qrew Up in respect of its reasonable control or resulting from any failure in data transmission or operation efforts to (i) investigate, remediate, and mitigate the effects of the Booking Service by you. 8.2 As Security Incident, and (ii) comply with notification obligations to individuals, clients or regulatory authorities; ● Partner must not do, or omit to do, and must ensure that its personnel and other representatives do not do or omit to do, anything that would cause (or may be reasonably expected to cause) Qrew Up or its Affiliates to be in breach of any provision of any Data Protection Legislation and take all reasonable steps to ensure the reliability of its employees and agents who may have access to the personal data and ensure that such staff and agents are informed of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for confidential nature of the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, personal data and have given their consent to, such use, processing, undertaken training in the laws relating to handling personal data; ● Partner agrees to implement and transfer as required by all applicable Data Protection Laws; (c) each Party shall take maintain appropriate technical and organisational measures in respect of its processing of the personal data sufficient to comply with the Data Protection Legislation and to protect the personal data against unauthorised or unlawful processing and against accidental loss, destruction, damages, theft, alteration or disclosure; ● Partner agrees to only process personal data of Customers for the purpose of providing the Partner Services to such Customers and, in the case of Customers who have expressly agreed by way of opt-in consent to receiving email marketing from the Partner, for the purposes of email marketing and in all cases only whilst receiving the Partner Services; and The Partner acknowledges that ownership of all Intellectual Property Rights in Customer’s personal data in the Qrew Up Business Software shall vest in Qrew Up or its Affiliates, and Partner irrevocably and unconditionally assigns with full title guarantee all such rights to Qrew Up. Qrew Up grants the Partner a non-exclusive license to use such personal data to operate its business subject to Partner's ongoing compliance with the provisions of this Agreement. Where the Partner elects to use the Qrew Up Business Software’s marketing automation features, the Partner may send marketing or promotional communications to Customers whose details are stored in the Qrew Up Business Software and who have given their consent via an ‘opt-in’ box on signing up to receive the Qrew Up Services or when booking Partner Services via the Widget, to receive marketing or promotional communications from any Partner from whom they book Partner Services and/or specifically from the Partner with which they are booking. The Partner undertakes and warrants that it will only process the personal data of Partner Customers in compliance with Data Protection Legislation and in particular that it, its employees, its partners and its suppliers will only send marketing or promotional communications to Partner Customers who have given their consent to receive the same. The Partner’s use of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or Partner Customers is undertaken at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply Partner’s sole risk with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely Partner being responsible and liable for ensuring it, its employees’, its partners’ and its suppliers’ use fully complies with all applicable Data Protection Legislation. In the event that a Customer notifies the Partner or one of its employees that it does not wish to receive further marketing materials from Qrew Up and/or its Affiliates, the Partner shall promptly (and in any transfer event no later than 48 (forty-eight) hours from being so informed) notify Qrew Up with full details of Customer the same in writing so that Qrew Up can honour such request. In the event that a data subject makes a request to either party to exercise one or more of the rights afforded to data subjects under Data made by you (Protection Legislation then to the extent that either party reasonably requires input or made by JRNI or bookinglab at your request) assistance from the Booking Service other party in order to give effect to any of the rights afforded, that other party shall provide all such input or assistance within a third reasonable timeframe with each party meeting their own costs in doing so; In the event that either party receives a request from a data protection authority for information relating to this Agreement or the relationship between the parties, that party shall promptly notify the other unless prohibited by law. Any breach of this Section 12 by the Partner will be a Material Breach of this Agreement. The Partner will indemnify and for ensuring that such transfer is hold Qrew Up and its Affiliates harmless against all losses, claims, costs, damages or proceedings suffered or incurred by Qrew Up and/or its Affiliates arising out of or in compliance connection with the Parties' obligations under Partner's breach of this Section 12 This Clause in its entirety shall survive the Data Protection Lawstermination or expiry of this Agreement.

Customer Data. 8.1 You, not bookinglab Field Dynamics or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab Field Dynamics and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab Field Dynamics processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab Field Dynamics shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab Field Dynamics so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab Field Dynamics from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab Field Dynamics at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You6.1 The Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 6.2 Smartway2 Ltd shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to time. bookinglab In the event of any loss or damage to Customer Data, the Customer's sole and JRNI is exclusive remedy shall be for Smartway2 Ltd to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Smartway2 Ltd. For the avoidance of doubt, back-up procedures do not form part of the Services and are offered to the Customer with no warranty or guarantee of their date, accuracy or integrity. Smartway2 Ltd shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party. 6.3 The Customer grants to the Supplier a non-exclusive, non-transferable licence to access and view the Customer Data for the purposes assessing and improving the Services during the Subscription Term. Smartway2 Ltd shall not modify the Customer Data and shall, in providing the Services, comply with commercially prudent practices relating to the privacy and security of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by youData. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 6.4 If JRNI and/or bookinglab Smartway2 Ltd processes any Personal Data personal data on your the Customer’s behalf when performing its obligations under this Agreementagreement, the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller data controller and JRNI and/or bookinglab Smartway2 Ltd shall be a Data Processor data processor and in any such case: (a) you the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Smartway2 Ltd’s other obligations under this agreement; (b) the Customer shall ensure that you are it is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab Smartway2 Ltd so that they Smartway2 Ltd may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement agreement on your the Customer's behalf; (bc) you the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws;data protection legislation; and (cd) each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You, not bookinglab or JRNITime Software, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI Time Software is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service Time Software – Low Code Development Platform for Bookings by you. 8.2 As of the MSA Start Date, JRNI Time Software is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI Time Software and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI Time Software and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI Time Software and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI Time Software or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI Time Software or bookinglab at your request) from the Booking Service Time Software – Low Code Development Platform for Bookings to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You5.1 You shall own all rights, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. bookinglab . 5.2 It shall be your responsibility to notify CANDDi when you require back-ups of the Customer Data to be created and JRNI is CANDDi's only obligation in this respect shall be to provide a copy of the Customer Data to the Customer within 7 Business Days of such a request. 5.3 In the event of any loss or damage to Customer Data, your sole and exclusive remedy shall be for CANDDi to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data provided to you by CANDDi. 5.4 CANDDi shall not be responsible for any of the foregoing or for any loss, destruction, damage, loss, alteration or failure to store any disclosure of Customer Data beyond its reasonable control or resulting from caused by any failure in data transmission or operation of the Booking Service third party (except those third parties sub-contracted by youCANDDi to perform services related to Customer Data maintenance and back-up). 8.2 As 5.5 In providing the Services, CANDDi shall process Personal Data of End Users or that Personal Data otherwise within the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Customer Data on your behalf when performing its obligations under this Agreementand the parties record their intention that in respect of such processing you, the Parties acknowledge that you Customer, shall be the Data Controller and JRNI and/or bookinglab CANDDi shall be a Data Processor and in any such case: (a) 5.5.1 you shall ensure that you are entitled to transfer the relevant Customer such Personal Data to JRNI and/or bookinglab CANDDi so that they CANDDi may lawfully use, process and transfer the Customer such Personal Data in accordance with this Agreement these Terms on your behalf; (b) 5.5.2 you shall ensure that the all relevant third parties including, but not limited to, the End Users have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Lawsdata protection legislation; (c) 5.5.3 CANDDi shall process such Personal Data only in accordance with these Terms and any lawful instructions reasonably given by the Customer from time to time; and 5.5.4 each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data such Personal Data or its accidental loss, destruction or damage. 5.6 Without prejudice to its obligations under condition 5.5, you shall: 5.6.1 include a privacy policy on each Customer Website(s) which includes the following: 5.6.1.1 the identity of the Data Controller; 5.6.1.2 the nature of the Personal Data processed; 5.6.1.3 the purposes for which such Personal Data will be used; 5.6.1.4 how that Personal Data is collected (and methods of seeking appropriate consents where necessary); 5.6.1.5 how and where the Personal Data is stored; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer 5.6.1.6 whether the Personal Data will be shared with any third parties and if so, identification those third parties and the purpose for which the Personal Data is being shared; and 5.6.1.7 details of how End Users may request a copy of their Personal Data being processed (a subject access request) and the correction or deletion of such Personal Data; 5.6.2 obtain the End User's consent to the use of Cookies on the Customer Website(s) for the purposes of allowing the Services to be provided; 5.6.3 not request any sensitive Personal Data to their Group Companies, Affiliates and third party service providers as necessary to provide be processed by CANDDi in providing the Services in accordance with clause 3, and otherwise in order to Services; 5.6.4 comply with Applicable Law the provisions of the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 with regards to the use of Cookies on the Customer Website(s); and 5.6.5 without delay deal with any requests made by CANDDi, whether automatically through the Software or at the request of a governmentalotherwise, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and for action to be taken in relation to any Personal Data deemed as a special category of Data under GDPR is not given to us collected by CANDDi in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from providing the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection LawsServices.

Customer Data. 8.1 You, not bookinglab BookingLab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab BookingLab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab BookingLab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab BookingLab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab BookingLab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab BookingLab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab BookingLab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You, not bookinglab or JRNIJRNI or You.Smart.Thing, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and bookinglab, JRNI or You.Smart.Thing is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Pool Hire Booking Service Service by you. 8.2 As of the MSA Start Date, JRNI and You.Smart.Thing is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or You.Smart.Thing and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or You.Smart.Thing and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or You.Smart.Thing and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI JRNI, You.Smart.Thing or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI JRNI, You.Smart.Thing or bookinglab at your request) from the Pool Hire Booking Service Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You(a) Customer shall be solely responsible for maintaining the Original Data and Customer Networks, and Customer shall retain said data such that it can be promptly regenerated or duplicated as needed. Accordingly, Customer expressly agrees that Service Provider shall not bookinglab have any liability for any data loss, damage to, or JRNI, have sole responsibility corruption of the Original Data. Customer also agrees that it shall not provide any data to Service Provider unless that data is necessary for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessdelivery of the Services, and right even if necessary such data shall not be provided in violation of the following representations and warranties. i. All Customer Data was accumulated and collected in compliance with all relevant Data Protection Laws, rules and regulations; ii. The provision of Customer Data to use Service Provider and the processing of the Customer Data by the Service Provider in accordance with the terms of this Agreement will not cause Service Provider to be in breach of any laws or regulations applicable to the Customer Data; and iii. bookinglab Customer shall not deliver or otherwise provide Service Provider access to Customer Data that is subject to any statutory or regulatory data protection measures or restrictions without first securing Service Provider’s written approval for all such disclosures to be made. For clarity, and JRNI without limiting the applicability of this provision, data that is subject to the following may be impacted: (i) Export Administration Regulations (EAR); (ii) Gramm–▇▇▇▇▇–▇▇▇▇▇▇ Act (GLBA); (iii) Health Insurance Portability and Accountability Act (HIPAA); (iv) Health Information Technology for Economic and Clinical Health (HITECH) Act; and (v) International Traffic in Arms Regulations (ITAR). If Service Provider is not responsible for advised of what type of data will be provided, any of fines and penalties (including those imposed on Service Provider) related to a disclosure that violates the foregoing or for any destructionshall be at Customer’s sole cost and expense. Customer further warrants that no Customer Data shall be transferred to Service Provider via email, damage, lossthrough a third-party tool, or failure to store in any Customer Data beyond its reasonable control other unencrypted or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program unsecured manner. Except for the Services that complies with the ISO 27001 standards purpose of copying, imaging, or such other standards otherwise collecting data as are substantially equivalent requested hereunder, Customer shall not transfer custody of any Original Media to ISO 27001Service Provider. Service Provider disclaims all liability for a violation of this Section. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you Customer shall ensure that it acts in complete compliance with the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical Laws in respect of all personal data, and organisational measures against unauthorised or unlawful processing warrants to Service Provider that, in respect of the any and all personal data that it transfers, or its accidental lossotherwise makes available, destruction to Service Provider, it is lawfully able to transfer or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3make such personal data available, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection has any and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) all necessary consents from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Lawsrelevant data subjects.

Customer Data. 8.1 You, not bookinglab or JRNIbookinglab, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking TuGO Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 8.3 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 8.4 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 8.5 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking TuGO Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You, not bookinglab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible for the security and liable content of all of your data stored in our hosted environment and any data, applications or third party services run in or through our provided environment (”Customer Data”), and Customer Data is and at all times shall remain your exclusive property. You are solely responsible for determining if any Customer Data must comply with any law, standards, and policies, including without limitation, those related to data privacy and security (collectively referred to herein as the "Legal Requirements") and ensuring that the Customer Data does comply with all applicable Legal Requirements. You acknowledge and agree that we have no way of reviewing Customer Data. You shall encrypt at the application level all Sensitive Customer Data. “Sensitive Customer Data” means Customer Data that is required to be treated as confidential under state or federal law or under your contractual obligations to others. You shall promptly notify us upon becoming aware of any data breach or unauthorized access to our network or servers and accounts. You will take all commercially reasonable steps to cooperate with our investigation and resolution of the reported breach or unauthorized access. Notwithstanding the foregoing, you acknowledge and agree that we make no representation or warranty regarding the security of the Services. We are not responsible to you for unauthorized access to Customer Data or unauthorized use of the Services through authorized or unauthorized access you provide to third parties. You are responsible for the use of the Services by any of your employees, affiliates, officers, directors, shareholders, agents or representatives, or any other third party to whom you grant access to the Service, and any third party who gains access to Customer Data or Services as a result of your failure to use reasonable security precautions, even if such access was not authorized by you. You shall be responsible for maintaining all backups of all Customer Data on our servers. In the event we provide backup assistance on our servers, this is provided, without additional charge, as a courtesy (“Courtesy Support”) to you, and we have no liability for any transfer of lost or corrupted Customer Data made by you (or made by JRNI or bookinglab at your request) resulting from the Booking provision of Courtesy Support. Data Compliance. You shall immediately notify us if any Customer Data in the applicable Service to a third party environment includes Protected Health Information ("PHI"), as that term is defined Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, as amended. You are solely responsible for ensuring that you are utilizing HIPAA-compliance Services, and, if Customer Data includes PHI, the parties shall enter into a business associate agreement ("BAA") with respect to such transfer is in compliance with the Parties' PHI. If, as necessary to perform our obligations under the Agreement, we possess or otherwise store “cardholder data” (as that term is defined by the Payment Card Industry Data Security Council ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇) on your behalf, we and you each agree that we are each responsible, as may be designated in the applicable Service Description, for those certain PCI-DSS requirements as applicable. You shall notify us if you intent to use the Services with Customer Data that is subject to protection under General Data Protection LawsRegulation 2016/679 or its equivalent (“GDPR”). Such notification shall require the parties execute a Data Protection Addendum (“DPA”) under which we will be a Processor (as defined under the GDPR) on your behalf. You may not utilize any Services with Customer Data that is subject to GDPR protection until such time as the parties have executed a DPA. If, as necessary to perform our obligations under the Agreement, we possess or otherwise store “personal information” (as that term is defined by the California Consumer Privacy Act of 2018, as amended (“CCPA”)) you make available, we certify that we are acting as a “service provider” as defined under the CCPA. Accordingly, we will not retain, use, or disclose such personal information for any purpose other than the specific purpose of performing the Services under this Agreement or as otherwise permitted by the CCPA, including retaining, using, or disclosing such personal information for a commercial purpose other than providing the Services. Unless prohibited by applicable law, we shall, as soon as reasonably practicable, forward to you all requests received from individuals wishing to exercise their rights under the GDPR or CCPA. Our only response to individual requests shall be to inform the individual that such request has been passed along to the appropriate party, unless otherwise required by applicable law. If you request, we will reasonably assist you, at your expense, in complying with your obligations under the GDPR and CCPA.

Customer Data. 8.1 You, not bookinglab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you Customer shall ensure that you are entitled to transfer be solely responsible for, and shall hold T2, its third party suppliers, and their respective Representatives harmless from any loss, damage or liability arising in connection with Customer’s inputs, selection and use of the relevant Services, and all data (including Customer Personal Data to JRNI and/or bookinglab so that they may lawfully useData), process reports, statements and transfer other content transmitted, posted, received or created on the Customer Personal Data in accordance with this Agreement on your behalf;T2 System through Customer’s account, even if transmitted, posted, received or created by a third party. (b) you shall ensure The Software may create and store databases of personal information of end-users and data relating to Customer on the computer system on which the Software is accessed or installed. Customer agrees to take all steps which it deems are appropriate to provide adequate security for that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws;information. (c) each Party The parties acknowledge that at all times Customer will remain the owner of Customer Data. Except as otherwise set forth herein or in the applicable Addenda, T2 shall take appropriate technical not at any time use Customer Data or disclose Customer’s data to any third parties, except that T2 may use Customer Data for the purpose of meeting its obligations under an Addendum and organisational measures against unauthorised or unlawful processing of providing the personal data or its accidental lossServices, destruction or damage; andand may store, back-up and archive Customer Data. (d) notwithstanding any other provision T2 will comply with all applicable laws governing the collection, access, use, disclosure of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Data. All Customer Data which is submitted by Customer to their Group CompaniesT2 pursuant to this Agreement will be safeguarded by T2 to the same extent that T2 safeguards data relating to its own business; provided, Affiliates however, if Customer Data is publicly available, is already in T2’s possession from a source other than Customer or otherwise known to it, or was rightfully obtained by T2 from third parties, T2 shall bear no responsibility for its disclosure, inadvertent or otherwise. T2 has implemented and third party service providers as necessary will maintain administrative, physical and technical safeguards to provide protect Customer Data from unauthorized access, acquisition or disclosure, destruction, alteration, accidental loss, misuse or damage that are no less rigorous than accepted industry practices. In the Services in accordance with clause 3event of unauthorized access to Customer Data which has been verified by T2, T2 shall promptly i) take action to stop the unauthorized access, and otherwise in order ii) notify Customer, provide Customer with relevant details of the unauthorized access and an explanation of steps that T2 took or is taking to comply stop the unauthorized access. T2 maintains Payment Card Industry (PCI) Level One compliance and upon request (no more than once annually), T2 will provide Customer with Applicable Law or at the request a copy of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure its third-party audit certification demonstrating that appropriate information security standards to protect Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us are in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Lawsplace.

Customer Data. 8.1 YouThe Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. bookinglab Subject to clause Error: Reference source not found, the Supplier shall ensure that the Customer Data is backed up each Business Day. In the event of any loss of or damage to Customer Data, the Customer's sole and JRNI is exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to retrieve the back-up from the previous Business Day. The Supplier shall not be responsible for any of the foregoing or for any loss, destruction, damage, loss, alteration or failure to store any disclosure of Customer Data beyond its reasonable control or resulting from caused by any failure in data transmission or operation of third party except those third parties sub-contracted by the Booking Service by you. 8.2 As of Supplier to perform services related to Customer Data maintenance and back-up. If the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab Supplier processes any Personal Data personal data on your the Customer’s behalf when performing its obligations under this Agreement, unless otherwise agreed by the Parties acknowledge that you parties, the Customer shall be the Data Controller data controller and JRNI and/or bookinglab the Supplier shall be a Data Processor data processor and in any such case: (a) you : the Customer acknowledges and agrees that the personal data may be transferred or stored outside of the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this Agreement; the Customer shall ensure that you are the Customer is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab the Supplier so that they the Supplier may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement on your the Customer's behalf; (b) you ; the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required transfer; the Supplier shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by all applicable Data Protection Laws; (c) the Customer from time to time; and each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. For the purposes of this clause 4, the terms "data processor", "data controller", "personal data" and "process" shall have the meaning given to them in the Data Protection ▇▇▇ ▇▇▇▇. The Customer acknowledges that the Services may enable or assist it to access the website content of third parties via third-party websites and that it does so solely at its own risk. The Supplier makes no representation or commitment and shall have no liability or obligation whatsoever in relation to the content or use of, or correspondence with, any such third-party website, or any transactions completed, and any contract entered into by the Customer, with any such third party. Any contract entered into and any transaction completed via any third-party website is between the Customer and the relevant third party, and not the Supplier. The Supplier recommends that the Customer refers to the third party’s website terms and conditions and privacy policy prior to using the relevant third-party website. The Supplier does not endorse or approve any third-party website nor the content of any of the third-party website made available via the Services. The Customer shall and shall procure that all Authorised Users shall: provide the Supplier with all necessary access to such information as may be required by the Supplier in connection with the Services, including but not limited to Customer Data and security access information; and (d) notwithstanding comply with all applicable laws and regulations with respect to its activities under this Agreement; carry out all other Customer responsibilities set out in this Agreement in a timely and efficient manner. In the event of any other delays in the Customer’s provision of this Agreementsuch assistance as agreed by the parties, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI the Supplier may adjust any agreed timetable or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers delivery schedule as necessary to provide reasonably necessary; ensure that the Authorised Users use the Services in accordance with clause 3the terms and conditions of this Agreement and shall be responsible for any Authorised User’s breach of this Agreement; obtain and maintain all necessary licences, consents and permissions necessary for the Supplier, its Suppliers and agents to perform their obligations under this Agreement, including without limitation the Services; use as its web browser Microsoft Internet Explorer version 6 (or such other web browser as the Supplier from time to time recommends to the Customer) and comply with any request to upgrade its web browser made by the Supplier within 60 days of receiving such request; be solely responsible for procuring and maintaining its network connections and telecommunications links from its systems to the Supplier’s data centres, and otherwise in order for all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to comply with Applicable Law the Customer's network connections or at telecommunications links or caused by the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection internet; and Appendix B(2) Data Processing Activities 8.5 ensure that its network and systems comply in all other respects with such specifications as the Supplier shall provide from time to time. The Customer Data shall use all reasonable endeavours to not, and Personal Data deemed as a special category shall ensure any Authorised User uses all reasonable endeavours to not: access, store, distribute or transmit any Viruses, or any material during the course of Data under GDPR its use of the Services that: is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive; facilitates illegal activity; depicts sexually explicit images; promotes unlawful violence; is discriminatory based on race, gender, colour, religious belief, sexual orientation, disability, or any other illegal activity; or causes damage or injury to any person or property, and the Supplier reserves the right, without liability to the Customer, to disable the Customer’s access to any material that breaches the provisions of this clause; The Customer shall not, and shall not given to us in allow any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.Authorised User to:

Customer Data. 8.1 You5.1 The Customer shall own all right, not bookinglab or JRNI, title and interest in and to all of the Customer Data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and right to use quality of the Customer Data. 5.2 ODS shall follow its standard archiving procedures for Customer Data in force from time to time. bookinglab In the event of any loss or damage to Customer Data, the Customer's sole and JRNI is exclusive remedy shall be for ODS to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by ODS in accordance with those archiving procedures. ODS shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by SAP or any other third party (except those third parties sub-contracted by ODS to perform maintenance services related specifically to the Customer Data of the foregoing or for any destructionCustomer). 5.3 ODS shall, damagein providing the Services, loss, or failure comply with its Privacy Policy relating to store any the privacy and security of the Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards available at [INSERT WEB ADDRESS] or such other standards website address as are substantially equivalent may be notified to ISO 27001the Customer from time to time, as such document may be amended from time to time by ODS in its sole discretion. 8.3 5.4 If JRNI and/or bookinglab ODS processes any Personal Data personal data on your the Customer's behalf when performing its obligations under this Agreementagreement, the Parties acknowledge parties record their intention that you the Customer shall be the Data Controller data controller and JRNI and/or bookinglab ODS shall be a Data Processor data processor and in any such case: (a) you the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and ODS's other obligations under this agreement; (b) the Customer shall ensure that you are the Customer is entitled to transfer the relevant Customer Personal Data personal data to JRNI and/or bookinglab ODS so that they ODS may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement agreement on your the Customer's behalf; (bc) you the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Lawsdata protection legislation; (cd) ODS shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each Party party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and. (d) notwithstanding 5.5 To the extent that SAP processes any other provision of this AgreementCustomer Data, but subject always to Appendix B(1) Data Protection the Customer acknowledges and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates agrees that such processing is undertaken by SAP and third party service providers as necessary to provide the Services its subcontractors in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) its SAP Personal Data Processing Activities 8.5 ensure Agreement and that Customer Data shall be bound by and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed abide by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Lawssame.

Customer Data. 8.1 You, not bookinglab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities. 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing. 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.

Customer Data. 8.1 You16.1 The Supplier acknowledges that the Customer Data is the property of the Customer and the Customer hereby reserves all Intellectual Property Rights which may subsist in the Customer Data. 16.2 For the avoidance of doubt, the Supplier shall not bookinglab acquire any right in, or JRNItitle to, have sole responsibility for any part of the entryCustomer Data, deletionwhether existing prior to the date of this Contract or created after such date. 16.3 The Supplier shall not delete or remove any proprietary notices contained within or relating to the Customer Data. 16.4 The Supplier shall not and shall procure that the Sub-Contractors and Employees shall not store, correctioncopy, accuracydisclose, quality, integrity, legality, reliability, appropriateness, and right to or use the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program except as strictly necessary for the Services that complies with performance by the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when performing Supplier of its obligations under this AgreementContract or as otherwise expressly authorised in writing by the Customer. 16.5 The Supplier shall take responsibility for preserving the integrity of that Customer Data and preventing the corruption or loss of that Customer Data. 16.6 The Supplier shall ensure that any system on which the Supplier holds any Customer Data, including back-up data, is a secure system. 16.7 The Supplier shall ensure that, when disposing of any hardware during the course of performing the Software and Services, it shall erase from any computers, storage devices and storage media any software containing all Customer Data. 16.8 If the Customer Data is corrupted, lost or sufficiently degraded as a result of the Supplier’s Default so as to be unusable, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such caseCustomer may: (a) you require the Supplier (at the Supplier's expense) to restore or procure the restoration of Customer Data and the Supplier shall ensure that you are entitled to transfer do so as soon as practicable but not later than 24 hours from the relevant Customer Personal Data to JRNI and/or bookinglab so that they may lawfully useoccurrence of the corruption, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf;loss or degradation; and/or (b) you shall ensure that itself restore or procure the relevant third parties have been informed ofrestoration of Customer Data, and have given their consent to, such use, processing, and transfer as required shall be repaid by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding Supplier any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services reasonable expenses incurred in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authoritydoing so. 8.4 From 16.9 If at any time the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure Supplier suspects or has reason to believe that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us has or may become corrupted, lost or sufficiently degraded in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable way for any transfer reason or has or may have been subject to unauthorised disclosure, then the Supplier shall notify the Customer immediately and inform the Customer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service remedial action the Supplier proposes to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Lawstake.

Customer Data. 8.1 YouThe Customer hereby grants to Tech Data a non-exclusive, not bookinglab or JRNIfully paid-up, have sole responsibility royalty free licence for the entryTerm to use, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, copy and right to use modify the Customer Data provided or made available by the Customer to Tech Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with purposes of providing the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab processes any Personal Data on your behalf when Service and Deliverables and performing its other obligations under this Agreement. The Customer must indemnify Tech Data against all Loss sustained, incurred or suffered by any Tech Data as a result of any claim, action or proceeding by a third party alleging that the use, copying, modification, possession or receipt by Tech Data of any materials or information provided or made available by the Customer to Tech Data infringes the Intellectual Property Rights or other rights of any third party. Title and risk Tech Data retains legal and beneficial title in the Deliverables, or any physical medium on which Deliverables or Third Party Products (including software) are stored (which for the purposes of this clause 11 is collectively referred to as “Collateral”) until full payment by the Customer for such Deliverables or Third Party Product (as applicable) at which time that title passes to the Customer. Risk in the Collateral passes to the Customer upon delivery of the Deliverables or Third Party Product to the delivery address specified in the Order, or at another site agreed by the Parties in writing. The Customer acknowledges that Tech Data may register a financing statement in relation to its security interest in the Collateral. The Customer waives its right under section 157 of the Personal Property Securities ▇▇▇ ▇▇▇▇ (Cth) to receive notice of any verification statement relating to the registration of any such financing statement or any related financing change statement. The Customer acknowledges and agrees that, in the event of non-payment by the Customer or other relevant dispute, Tech Data may retake possession of, and otherwise enforce its security interest in the, Collateral where title has not passed to the Customer in accordance with clause 11.1 and to that extent, enter any premises of the Customer to repossess such Collateral. To the extent that Chapter 4 of the PPS Act would otherwise apply to an enforcement by the Tech Data of its security interest in the Collateral, the Parties acknowledge agree that you shall the following provisions of the PPS Act do not apply, to the extent the PPS Act allows them to be the excluded: (enforcement methods) ss 118 (Enforcing security interests in accordance with land law decisions), 125 (Obligation to dispose of or retain collateral), 129(2) and (3) (Disposal by purchase), 134(2) (Proposal of secured party to retain collateral), 137 (Persons entitled to notice may object to proposal) and 138B(4) (Seizure and disposal or retention of crops); (notices) ss 95 (Secured party must give notice of removal of accession), 121(4) (Enforcement of security interests in liquid assets – notice to higher priority parties and grantor), 127 (Seizure by higher priority parties – notice), 130 (Notice of disposal of collateral), 132 (Secured party to give statement of account), and 135 (Notice of retention of collateral) and 136(5) (Retaining collateral free of interests); and (rights to remedy) ss 142 (Entitled persons may redeem collateral) and 143 (Entitled persons may reinstate security agreement). The Customer must promptly do anything Tech Data Controller and JRNI and/or bookinglab shall be a Data Processor and in any such case: (a) you shall requires to ensure that you are entitled its security interest is a perfected security interest and has priority over all other security interests. Nothing in this clause is limited by any other provision of any other agreement between Tech Data and the Customer. Nothing in this clause limits Tech Data’s rights or the Customer's obligations apart from under this clause. Suspension and security If in the reasonable opinion of Tech Data that the Customer has breached this Agreement, Tech Data may upon seven (7) Business Days’ notice suspend access to transfer or provision of the relevant Service, Deliverables or Third Party Product until such time as the Customer has remedied the breach to Tech Data’s reasonable satisfaction. The Customer will comply with all applicable the Privacy Legislation and all applicable Laws with respect to the collection, use, disclosure and storage of Personal Information. The Customer represents and warrants it has obtained all necessary consents to enable Tech Data to JRNI and/or bookinglab so that they may lawfully useaccess and use Personal Information necessary to provide the Service, process and transfer the Customer Personal Data Deliverables or Third Party Product in accordance with this Agreement and from any location. Fees and Payment Terms The Customer agrees to pay all applicable Fees for any Service, Deliverables and Third Party Product specified in an Order . Tech Data will issue invoices on your behalf; a monthly basis in advance unless otherwise specified in an Order. If the parties have agreed on a Payment Plan or if a Payment Plan is specified in an Order, then Tech Data will issue invoices in accordance with such Payment Plan. Tech Data will send the invoice to the address specified in an Order or as otherwise agreed by the Parties in writing. The Customer must pay each invoice issued by Tech Data within thirty (b30) you shall ensure days of the date of the relevant invoice by the Customer in the manner specified by Tech Data in the relevant invoice or other notified to the Customer by Tech Data in writing. If the Customer acting reasonably and in good faith, disputes the correctness of any invoice, then it may, without prejudice to its other rights and remedies, after notifying Tech Data, withhold payment of the disputed sum but must pay any undisputed amount of such invoice. If Tech Data disputes that the relevant third parties have been informed ofCustomer is entitled to withhold the disputed sum, then: the matter must be resolved by the procedure specified in clause 17; and have given their consent to, such use, processing, and transfer as required by the Customer remains liable to pay all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of future invoices in accordance with the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision terms of this Agreement, but subject always . Tech Data may charge the Customer interest on any invoices paid late at a rate equal to Appendix B(1three per cent (3%) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide above the Services rate set by the Commonwealth Bank of Australia on overdrafts in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request excess of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR $100,000 per annum compounded daily. Interest is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) calculated on outstanding amounts from the Booking Service due date of the invoice up to a third party and for ensuring that such transfer is in compliance with including the Parties' obligations under the Data Protection Lawsday of payment.

Customer Data. 8.1 You5.1 The Customer shall own all right, title and interest in and to all of the Customer Data that is not bookinglab or JRNI, personal data and shall have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriatenessintegrity, accuracy and quality of all such Customer Data. 5.2 Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 5 is in addition to, and right to use does not relieve, remove or replace, a party's obligations under the Customer Data. bookinglab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking Service by youProtection Legislation. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services 5.3 The parties acknowledge that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab if Homeless Link processes any Personal Data personal data on your the Customer's behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be Customer is the Controller and Homeless Link is the Processor for the purposes of the Data Controller Protection Legislation. Schedule 6 sets out the scope, nature and JRNI and/or bookinglab shall be a purpose of processing by Homeless Link, the duration of the processing, the types of personal data and the categories of Data Processor and in any such case:Subject. (a) you shall 5.4 Without prejudice to the generality of clause 5.2, the Customer will ensure that you are entitled it has all necessary appropriate consents and notices in place to enable lawful transfer of the relevant Customer Personal Data personal data to JRNI and/or bookinglab Homeless Link for the duration and purposes of this Agreement so that they Homeless Link may lawfully use, process and transfer the Customer Personal Data personal data in accordance with this Agreement on your the Customer's behalf. 5.5 Without prejudice to the generality of clause 5.2, Homeless Link shall, in relation to any personal data processed in connection with the performance by Homeless Link of its obligations under this Agreement: 5.5.1 process that personal data only on the written instructions of the Customer unless Homeless Link is required by the laws of the United Kingdom applicable to Homeless Link to process personal data (Applicable Laws). Where Homeless Link is relying on Applicable Laws as the basis for processing personal data, Homeless Link shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Homeless Link from so notifying the Customer; 5.5.2 immediately inform the Customer if, in the opinion of Homeless Link, an instruction infringes the Data Protection Legislation and shall not pass on any such instruction to SFDC; 5.5.3 ensure that all personnel who have access to and/or process personal data are obliged to keep the personal data confidential; 5.5.4 the Customer acknowledges and agrees that Homeless Link may be required to transfer personal data outside the UK in exceptional cases (including, but not limited to, the temporary failure of a Salesforce data centre) or in cases of emergency where a transfer is necessary to meet Homeless Link’s compelling legitimate interests. Homeless Link will only make such exceptional or emergency transfers of personal data outside of the UK where the following conditions are fulfilled: (a) the transfer is to a country covered by UK adequacy regulations, or the Customer or Homeless Link has provided appropriate safeguards pursuant to Article 46 of the UK GDPR, or an exception in Article 49 of the UK GDPR applies; (b) you shall ensure that the relevant third parties have been informed of, Data Subject has enforceable rights and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws;effective legal remedies; and (c) each Party Homeless Link complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred. 5.5.5 assist the Customer, at the Customer's cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; 5.5.6 notify the Customer without undue delay and within 24 hours of becoming aware of a personal data breach; 5.5.7 at the written direction of the Customer on the terms set out in clause 13.3.3, delete or return personal data and copies thereof to the Customer on termination of the agreement unless required by Applicable Law to store the personal data; and 5.5.8 maintain complete and accurate records and information to demonstrate its compliance with this clause 5 and allow for audits (including inspections) by the Customer or the Customer’s designated auditor. 5.6 Each party shall take ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of the personal data and against accidental loss or its destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage; anddamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). (d) notwithstanding any other provision 5.7 The Customer consents to Homeless Link appointing SFDC as a third-party processor of personal data under this Agreement, but subject always to Appendix B(1. Homeless Link confirms that it has entered or (as the case may be) Data Protection and B(2) will enter with SFDC into a written agreement incorporating the Data Processing Activities, nothing shall prevent JRNI or bookinglab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authorityAddendum. 8.4 From 5.8 Without prejudice to clause 5.7, Homeless Link shall not appoint another third-party processor of personal data under this Agreement without the MSA Start Date Customer’s prior written consent. If the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category consents in writing to the appointment of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab at your request) from the Booking Service to a third party and for ensuring processor, Homeless Link confirms that such transfer is in compliance it will enter into a written agreement with the Partiesthird-party processor incorporating terms which offer at least the same level of protection for the personal data as those set out in this clause 5 and which meet the requirements of Article 28 of the UK GDPR. 5.9 As between the Customer and Homeless Link, Homeless Link shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this clause 5. 5.10 Either party may, at any time on not less than 30 days' obligations under the Data Protection Lawsnotice, revise this clause 5 by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to this Agreement).

Customer Data. 8.1 You, not bookinglab BookingLab or JRNI, have sole responsibility for the entry, deletion, correction, accuracy, quality, integrity, legality, reliability, appropriateness, and right to use the Customer Data. bookinglab BookingLab and JRNI is not responsible for any of the foregoing or for any destruction, damage, loss, or failure to store any Customer Data beyond its reasonable control or resulting from any failure in data transmission or operation of the Booking TuCO Service by you. 8.2 As of the MSA Start Date, JRNI is certified under ISO 27001 and shall maintain an information security program for the Services that complies with the ISO 27001 standards or such other standards as are substantially equivalent to ISO 27001. 8.3 If JRNI and/or bookinglab BookingLab processes any Personal Data on your behalf when performing its obligations under this Agreement, the Parties acknowledge that you shall be the Data Controller and JRNI and/or bookinglab BookingLab shall be a Data Processor and in any such case: (a) you shall ensure that you are entitled to transfer the relevant Customer Personal Data to JRNI and/or bookinglab BookingLab so that they may lawfully use, process and transfer the Customer Personal Data in accordance with this Agreement on your behalf; (b) you shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable Data Protection Laws; (c) each Party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (d) notwithstanding any other provision of this Agreement, but subject always to Appendix B(1) Data Protection and B(2) Data Processing Activities, nothing shall prevent JRNI or bookinglab BookingLab from disclosing Customer Personal Data or Customer Data to their Group Companies, Affiliates and third party service providers as necessary to provide the Services in accordance with clause 3, and otherwise in order to comply with Applicable Law or at the request of a governmental, regulatory or supervisory authority. 8.4 From the MSA Start Date the Parties shall comply with Appendix B(1) Data Protection and Appendix B(2) Data Processing Activities 8.5 ensure that Customer Data and Personal Data deemed as a special category of Data under GDPR is not given to us in any form unless pre-agreed by us in writing 8.6 You are solely responsible and liable for any transfer of Customer Data made by you (or made by JRNI or bookinglab BookingLab at your request) from the Booking TuCO Service to a third party and for ensuring that such transfer is in compliance with the Parties' obligations under the Data Protection Laws.