Common use of Personal Data Transfers Clause in Contracts

Personal Data Transfers. 7.1 Personal Data held in Your Subscription Services environment will be hosted in the designated data center for your region and product. Agilysys will not migrate Your Subscription Services environment to a different data center region without Your prior written authorization. 7.2 Without prejudice to Section 7.1, Agilysys may access and Process Personal Data on a global basis as necessary to perform the Subscription Services, including for IT security purposes, maintenance and related infrastructure, technical support and change management. 7.3 To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”), Switzerland or the United Kingdom(“UK”) to Agilysys Affiliates or Third Party Subprocessors located in countries outside the EEA, Switzerland or the UK that have not received a binding adequacy decision by the European Commission or by a competent national EEA, Swiss or UK data protection authority, such transfers are subject to (i) the terms of the EU Model Clauses incorporated into this Data Processing Agreement by reference; or (ii) other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Applicable Data Protection Law, such as approved Binding Corporate Rules for Processors. For the purposes of the EU Model Clauses, You and Agilysys agree that (i) You will act as the data exporter on Your own behalf and on behalf of any of Your entities, (ii) Agilysys will act on its own behalf and/or on behalf of the relevant Agilysys Affiliates as the data importers, (iii) any Third Party Subprocessors will act as ‘subcontractors’ pursuant to Clause 11 of the EU Model Clauses.

Personal Data Transfers. 7.1 Personal Data held in Your Subscription Services environment will be hosted in the designated data center for your region and product. Agilysys will not migrate Your Subscription Services environment to a different data center region without Your prior written authorization. 7.2 Without prejudice to Section 7.1, Agilysys may access and Process Personal Data on a global basis as necessary to perform the Subscription Services, including for IT security purposes, maintenance and related infrastructure, technical support and change management. 7.3 To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) to Agilysys Affiliates or Third Party Subprocessors located in the United States occurs, such transfer of Personal Data is done in compliance with the Data Privacy Framework as set forth by the United States Department of Commerce, including applicable Switzerland and UK extensions (collectively, “DPF”). If Agilysys’ certification under the DPF is revoked or otherwise invalidated, Agilysys will, when applicable, inform You and take any necessary steps to remediate any unauthorized processing or transfers of Personal Data. 7.4 To the extent such global access involves a transfer of Personal Data originating from the EEA, Switzerland or the United Kingdom(“UK”) UK to Agilysys Affiliates or Third Party Subprocessors located in countries outside the EEA, Switzerland or the UK that have not received a binding adequacy decision by the European Commission or by a competent national EEA, Swiss or UK data protection authority, such transfers are subject to (i) the terms of the EU Model Clauses Clauses, or UK Addendum, as applicable, both of which are incorporated into this Data Processing Agreement by reference, specifically, (a) Module 2 where You are the Controller and Agilysys is a Processor and (b) Module 3 where You are the Processor and Agilysys is also a Processor; or (ii) other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Applicable Data Protection Law, such as approved Binding Corporate Rules for Processors. For the purposes of the EU Model ClausesClauses and UK Addendum, You and Agilysys agree that (i) You will act as the data exporter on Your own behalf and on behalf of any of Your entities, (ii) Agilysys will act on its own behalf and/or on behalf of the relevant Agilysys Affiliates as the data importers, (iii) any Third Party Subprocessors will act as ‘subcontractors’ pursuant to Clause 11 of the EU Model Clauses and UK Addendum. 7.5 Transfers of Personal Data originating from other locations globally to Agilysys Affiliates or Third Party Subprocessors are subject to (i) for Agilysys Affiliates, the terms of the Agilysys Intra-Company Data Processing and Transfer Agreement entered into between Agilysys Corporation and the Agilysys Affiliates, which requires all transfers of Personal Data to be made in compliance with all applicable Agilysys security and data privacy policies and standards; and (ii) for Third Party Subprocessors, the terms of the relevant Agilysys Third Party Subprocessor agreement incorporating security and data privacy requirements consistent with the relevant requirements of this Data Processing Agreement. 7.6 For the purposes of the EU Model Clauses • Clause 9(a), Module 2 and Module 3: the parties selection Option 2. The time period is 14 calendar days. • Clause 11(a): the parties do not select the independent dispute resolution option. • Clause 17, Module 2 and Module 3: the parties selection Option 2. The Member State of the data exporter is: EU Member State where You or Your EU data representative are located. • Clause 18(b), Module 2 and Module 3: the Parties agree that those shall be the courts of the EU Member State where You or Your EU data representative are located. • ▇▇▇▇▇ ▇(A): You are the data exporter. Agilysys is the data importer. Your contact details are set forth on the Supplement. Contact details for Agilysys are: ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇. • ▇▇▇▇▇ ▇(B): the parties agree that the information regarding transfer is set forth at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/en/privacy-policy/ and within this Data Processing Agreement • Annex I(C): the competent supervisory authority is the supervisory authority in the EU Member State where You or Your EU data representative are located. • ▇▇▇▇▇ ▇▇: the parties agree that Section 9 describes the technical and organizational measures applicable to the transfer 7.7 The terms of this Data Processing Agreement shall be read in conjunction with the EU Model Clauses, UK Addendum, and other applicable transfer mechanisms pursuant to this Section 7. To the extent there is any conflict between this Data Processing Agreement and the EU Model Clauses or the UK Addendum, the EU Model Clauses or UK Addendum shall prevail.

Personal Data Transfers. 7.1 Personal Data held in Your Subscription Services environment will be hosted in the designated data center for your region and product. Agilysys will not migrate Your Subscription Services environment to a different data center region without Your prior written authorization. 7.2 Without prejudice to Section 7.1, Agilysys may access and Process Personal Data on a global basis as necessary to perform the Subscription Services, including for IT security purposes, maintenance and related infrastructure, technical support and change management. 7.3 To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”), Switzerland or the United Kingdom(“UK”) to Agilysys Affiliates or Third Party Subprocessors located in countries outside the EEA, Switzerland or the UK that have not received a binding adequacy decision by the European Commission or by a competent national EEA, Swiss or UK data protection authority, such transfers are subject to (i) the terms of the EU Model Clauses incorporated into this Data Processing Agreement by reference, specifically, (a) Module 2 where You are the Controller and Agilysys is a Processor and (b) Module 3 where You are the Processor and Agilysys is also a Processor; or (ii) other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Applicable Data Protection Law, such as approved Binding Corporate Rules for Processors. For the purposes of the EU Model Clauses, You and Agilysys agree that that (i) You will act as the data exporter on Your own behalf and on behalf of any of Your entities, (ii) Agilysys will act on its own behalf and/or on behalf of the relevant Agilysys Affiliates as the data importers, (iii) any Third Party Subprocessors will act as ‘subcontractors’ pursuant to Clause 11 of the EU Model Clauses.

Personal Data Transfers. 7.1 Personal Data held in Your Subscription Services environment will be hosted in the designated data center for your region and product. Agilysys will not migrate Your Subscription Services environment to a different data center region without Your prior written authorization. 7.2 Without prejudice to Section 7.1, Agilysys may access and Process Personal Data on a global basis as necessary to perform the Subscription Services, including for IT security purposes, maintenance and related infrastructure, technical support and change management. 7.3 To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”), Switzerland or the United Kingdom(“UKKingdom (“UK”) to Agilysys Affiliates or Third Party Subprocessors located in countries outside the EEA, Switzerland or the UK that have not received a binding adequacy decision by the European Commission or by a competent national EEA, Swiss or UK data protection authority, such transfers are subject to (i) the terms of the EU Model Clauses Clauses, or UK Addendum, as applicable, both of which are incorporated into this Data Processing Agreement by reference, specifically, (a) Module 2 where You are the Controller and Agilysys is a Processor and (b) Module 3 where You are the Processor and Agilysys is also a Processor; or (ii) other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Applicable Data Protection Law, such as approved Binding Corporate Rules for Processors. For the purposes of the EU Model ClausesClauses and UK Addendum, You and Agilysys agree that (i) You will act as the data exporter on Your own behalf and on behalf of any of Your entities, (ii) Agilysys will act on its own behalf and/or on behalf of the relevant Agilysys Affiliates as the data importers, (iii) any Third Party Subprocessors will act as ‘subcontractors’ pursuant to Clause 11 of the EU Model Clauses and UK Addendum. 7.4 Transfers of Personal Data originating from other locations globally to Agilysys Affiliates or Third Party Subprocessors are subject to (i) for Agilysys Affiliates, the terms of the Agilysys Intra-Company Data Processing and Transfer Agreement entered into between Agilysys Corporation and the Agilysys Affiliates, which requires all transfers of Personal Data to be made in compliance with all applicable Agilysys security and data privacy policies and standards; and (ii) for Third Party Subprocessors, the terms of the relevant Agilysys Third Party Subprocessor agreement incorporating security and data privacy requirements consistent with the relevant requirements of this Data Processing Agreement. 7.5 For the purposes of the EU Model Clauses • Clause 9(a), Module 2 and Module 3: the parties selection Option 2. The time period is 14 calendar days. • Clause 11(a): the parties do not select the independent dispute resolution option. • Clause 17, Module 2 and Module 3: the parties selection Option 2. The Member State of the data exporter is: EU Member State where You or Your EU data representative are located. • Clause 18(b), Module 2 and Module 3: the Parties agree that those shall be the courts of the EU Member State where You or Your EU data representative are located. • ▇▇▇▇▇ ▇(A): You are the data exporter. Agilysys is the data importer. Your contact details are set forth on the Supplement. Contact details for Agilysys are: ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇. • ▇▇▇▇▇ ▇(B): the parties agree that the information regarding transfer is set forth at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/en/privacy-policy/ and within this Data Processing Agreement • Annex I(C): the competent supervisory authority is the supervisory authority in the EU Member State where You or Your EU data representative are located. • ▇▇▇▇▇ ▇▇: the parties agree that Section 9 describes the technical and organizational measures applicable to the transfer 7.6 The terms of this Data Processing Agreement shall be read in conjunction with the EU Model Clauses, UK Addendum, and other applicable transfer mechanisms pursuant to this Section 7. To the extent there is any conflict between this Data Processing Agreement and the EU Model Clauses or the UK Addendum, the EU Model Clauses or UK Addendum shall prevail.

Personal Data Transfers. 7.1 Personal Data held in Your Subscription Services environment will be hosted in the designated data center for your region and product. Agilysys will not migrate Your Subscription Services environment to a different data center region without Your prior written authorization. 7.2 Without prejudice to Section 7.1, Agilysys may access and Process Personal Data on a global basis as necessary to perform the Subscription Services, including for IT security purposes, maintenance and related infrastructure, technical support and change management. 7.3 To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”), Switzerland or the United Kingdom(“UKKingdom (“UK”) to Agilysys Affiliates or Third Party Subprocessors located in countries outside the EEA, Switzerland or the UK that have not received a binding adequacy decision by the European Commission or by a competent national EEA, Swiss or UK data protection authority, such transfers are subject to (i) the terms of the EU Model Clauses Clauses, or UK Addendum, as applicable, both of which are incorporated into this Data Processing Agreement by reference, specifically, (a) Module 2 where You are the Controller and Agilysys is a Processor and (b) Module 3 where You are the Processor and Agilysys is also a Processor; or (ii) other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Applicable Data Protection Law, such as approved Binding Corporate Rules for Processors. For the purposes of the EU Model ClausesClauses and UK Addendum, You and Agilysys agree that (i) You will act as the data exporter on Your own behalf and on behalf of any of Your entities, (ii) Agilysys will act on its own behalf and/or on behalf of the relevant Agilysys Affiliates as the data importers, (iii) any Third Party Subprocessors will act as ‘subcontractors’ pursuant to Clause 11 of the EU Model Clauses and UK Addendum. 7.4 Transfers of Personal Data originating from other locations globally to Agilysys Affiliates or Third Party Subprocessors are subject to (i) for Agilysys Affiliates, the terms of the Agilysys Intra-Company Data Processing and Transfer Agreement entered into between Agilysys Corporation and the Agilysys Affiliates, which requires all transfers of Personal Data to be made in compliance with all applicable Agilysys security and data privacy policies and standards; and (ii) for Third Party Subprocessors, the terms of the relevant Agilysys Third Party Subprocessor agreement incorporating security and data privacy requirements consistent with the relevant requirements of this Data Processing Agreement. 7.5 For the purposes of the EU Model Clauses • Clause 9(a), Module 2 and Module 3: the parties selection Option 2. The time period is 14 calendar days. • Clause 11(a): the parties do not select the independent dispute resolution option. • Clause 17, Module 2 and Module 3: the parties selection Option 2. The Member State of the data exporter is: EU Member State where You or Your EU data representative are located. • Clause 18(b), Module 2 and Module 3: the Parties agree that those shall be the courts of the EU Member State where You or Your EU data representative are located. • Annex I(A): You are the data exporter. Agilysys is the data importer. Your contact details are set forth on the Supplement. Contact details for Agilysys are: ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇. • Annex I(B): the parties agree that the information regarding transfer is set forth at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/en/privacy-policy/ and within this Data Processing Agreement • Annex I(C): the competent supervisory authority is the supervisory authority in the EU Member State where You or Your EU data representative are located. • Annex II: the parties agree that Section 9 describes the technical and organizational measures applicable to the transfer 7.6 The terms of this Data Processing Agreement shall be read in conjunction with the EU Model Clauses, UK Addendum, and other applicable transfer mechanisms pursuant to this Section 7. To the extent there is any conflict between this Data Processing Agreement and the EU Model Clauses or the UK Addendum, the EU Model Clauses or UK Addendum shall prevail.