Common use of Standard Contractual Clauses Clause in Contracts

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1) In relation to European Data that is subject to the GDPR [i] Client is the "data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data and the Module Three terms apply to the extent the Client is a Processor of European Data; [iii] in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State; [v] the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [iii] any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1) and the following modifications [i] references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [ii] references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and [iii] references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section of this DPA. (5) Where the TCP contracting entity under the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP HubSpot, Inc. and/or the Data Privacy DocuSign Envelope ID: CCF1FB4B-34E5-43F8-9502-A0796D702BCD Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. HubSpot, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland".. DocuSign Envelope ID: CCF1FB4B-34E5-43F8-9502-A0796D702BCD (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCPHubSpot, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP HubSpot contracting entity under the Agreement is not TCPHubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCPHubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP HubSpot or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-non- compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. If the Services involve the transfer of Customer Personal Data to HarperDB from the European Union, the European Economic Area, Switzerland, or the United Kingdom, to the extent such transfers require an adequate transfer mechanism under European Data Protection Laws require that appropriate safeguards are put in place (and no lawful alternative basis for examplesuch transfer applies, if the Data Privacy Framework does not cover the such transfer to TCP and/or the Data Privacy Framework is invalidated), will be governed by the Standard Contractual Clauses will be for processors, attached as Attachment 2, the terms of which are hereby incorporated by reference and form part into this DPA. In furtherance of the Agreement as followsforegoing, HarperDB and you agree that: (1a) In relation to European Data that is subject to the GDPR [i] Client is the "you (as data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data and the Module Three terms apply to the extent the Client is a Processor of European Data; [iii] in Clause 9, Option 2 applies and changes to Sub-Processors ) will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The parties agree that the governing law and forum for disputes for deemed to have entered into the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State; [v] the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] the supervisory authority that will act HarperDB (as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict.data importer); (2b) In relation for purposes of Appendix 1 to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [iii] any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1) and the following modifications [i] references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [ii] references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and [iii] references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For , the categories of data subjects, data, and the processing operations shall be as set out in Section 2.3 of this DPA; (c) for purposes of Appendix 2 to the Standard Contractual Clauses, the technical and organizational measures shall be the Security Measures as set out in Attachment 1 to this DPA; (d) upon data exporter’s request under the Standard Contractual Clauses, data importer will provide the copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 9(c5(j) of the Standard Contractual Clauses, Client acknowledges and that we data importer may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose remove or redact all commercial information or clauses unrelated the Sub-Processor agreement to you Standard Contractual Clauses or their equivalent beforehand; (e) the audits described in Clause 5(f) and will provide (on a confidential basisClause 12(2) all information we reasonably can. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply shall be performed in accordance with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section Section 7 of this DPA.; (5f) Where your authorizations in Section 4 of this DPA will constitute your prior written consent to the TCP contracting entity subcontracting by HarperDB of the Processing of Customer Personal Data if such consent is required under Clause 5(h) of the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance Standard Contractual Clauses; (g) certification of deletion of Customer Personal Data as described in Clause 12(1) of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in relation to shall be provided only upon your request; (h) the Standard Contractual Clauses to shall automatically terminate once the Customer Personal Data transfer governed thereby becomes lawful under Data Protection Laws in the absence of such contracting entity. If TCP cannot comply with its obligations under Standard Contractual Clauses on any other basis; and (i) in the event that the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (cease to be recognized as applicable) a legitimate basis for any reason, and you intend to suspend the transfer of European Personal Data to TCP or terminate HarperDB under Data Protection Laws, the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and parties shall reasonably cooperate with us to identify what additional safeguards, if any, may be implemented and implement an alternative legitimate basis for such transfer to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination)extent that one is required by Data Protection Laws.

Standard Contractual Clauses. If European Data Protection Laws require The parties agree that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover when the transfer to TCP and/or of Personal Data under the Data Privacy Framework Agreement is invalidated)a Restricted Transfer, the Standard Contractual Clauses SCCs will be incorporated into this Addendum by reference this reference, with each Data Exporter and form part of Data Importer being deemed to have entered into the Agreement SCCs in its own name and on its own behalf as follows: 3.3.1. In relation to Data that is protected by the EU GDPR, the EU SCCs will apply completed as follows: (1) In relation to European Data that is subject to Module One will apply; (2) in Clause 7, the GDPR [i] Client is optional docking clause will apply; (3) in Clause 11, the "data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data optional language will not apply; (4) in Clause 17, Option 1 will apply, and the Module Three terms apply to EU SCCs will be governed by the extent the Client is a Processor law of European Data; [iii] Netherlands ; (5) in Clause 918(b), Option 2 applies and changes to Sub-Processors will disputes shall be notified in accordance with resolved before the ‘Sub-Processors’ section of this DPA; [iv] The parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section Dutch courts; (6) Annex I of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State; [v] the Annexes of the Standard Contractual Clauses will SCCs shall be deemed completed with the information set out in the Annexes of Schedule 1 to this DPAAddendum; [vi] the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict.and (27) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part Annex II of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will EU SCCs shall be deemed completed with the information set out in Schedule 2 to this Addendum. 3.3.2. In relation to Data that is protected by the Annexes UK GDPR, the UK SCCs will apply completed as follows: (1) the International Data Transfer Agreement (VERSION A1.0, in force 21 March 2022, the “IDTA”) issued by the UK Information Commissioner shall be deemed to have been entered into; (2) Table 1-4, Part 1 of this DPA and Table 4 will the IDTA shall be deemed completed as specified below – A. UK country’s law that governs the IDTA shall be England and Wales; B. Primary place for legal claims to be made by selecting “neither party”; the parties to the IDTA shall be England and [iii] any conflict between Wales; C. The Linked Agreement is the terms Agreement D. UK GDPR applies to the Data Importer; E. The parties to the IDTA can end the IDTA before the end of its term by serving one months’ written notice; F. The parties to the IDTA that may end the IDTA when the Approved IDTA changes shall be Data Exporter; G. If the information of the Standard Contractual Clauses and below items is updated in the UK Addendum Linked Agreement (as defined in the IDTA) referred to, the following information in the IDTA will be resolved in accordance with Section 10 and Section 11 update automatically: a. The categories of the UK Addendumtransferred Personal Data; b. The categories of special category and criminal records data; c. The Data Subject of the transferred Personal Data; d. The purposes for which the Data Importer may Process the transferred Personal Data; e. The security requirements. (3) Unless explicitly specified in point A to G above, Table 1-3 shall be deemed completed with the information set out in Schedule 1 to this Addendum; (4) Table 4 shall be deemed completed with the information set out in Schedule 2 to this Addendum. 3.3.3. In relation to European Data that is subject to protected by the Swiss DPA, the Standard Contractual Clauses EU SCCs will apply as set out in accordance with sub-section Section 3.3.1 of this Addendum amended as follows: (1) and the following modifications [i] references to "“Regulation (EU) 2016/679" ” in the EU SCCs will be interpreted as references deemed to refer to the Swiss DPA; [ii] ; (2) references to specific articles of “Regulation (EU) 2016/679” will be deemed replaced with the equivalent article or section of the Swiss DPA; (3) references to “EU”, ,” “Union,” and “Member State lawState” will be interpreted as references to Swiss law; and [iii] deemed replaced with “Switzerland”; (4) references to the "“competent supervisory authority" and "competent courts" will be ” are replaced with the "the “Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section of this DPA.Commissioner”; and (5) Where in Clause 18(b), disputes shall be resolved before the TCP contracting entity under the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance competent courts of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in Switzerland. 3.3.4. In relation to Data that is protected by another Applicable Data Protection Law, the Standard Contractual Clauses Data Exporter and the Data Importer agree that such SCCs shall automatically apply to such contracting entity. If TCP cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data from the Data Exporter to TCP or terminate the Standard Contractual Clauses ,or UK AddendumData Importer and, you agree where applicable shall be deemed completed on a mutatis mutandis basis to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part completion of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination)SCCs as described above.

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP HubSpot, Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. HubSpot, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2 Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCPHubSpot, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2 to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP HubSpot contracting entity under the Agreement is not TCPHubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCPHubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP HubSpot or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-non- compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. It is noted that on 28 June 2021 the European Commission made an implementing decision pursuant to Article 45 of the EU GDPR on the adequate protection of personal data by the United Kingdom which contains carve-outs for certain transfers outside of the EU to the UK of certain types of Personal Data (the “UK Adequacy Decision”). If European any transfer of Personal Data Protection Laws require which is subject to EU GDPR pursuant to this Contract is not covered by the UK Adequacy Decision or at any time during the term of the Contract the UK Adequacy Decision is: withdrawn, invalidated, overruled or otherwise ceases to have effect, or amended in such a way as to affect the transfers of Personal Data outside of the EU which are contemplated under this Contract, Clauses 24.30 to 24.32 below shall apply. The Parties agree: that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP and/or the Data Privacy Framework is invalidated), without any further action being required they have entered into the Standard Contractual Clauses in the European Commission's decision 2021/917/EU set out in Annex 4 to Schedule 11 in respect of data transfers by the Supplier outside of the EU to the UK; that, where no other appropriate safeguard or exemption applies, that the Personal Data subject to this Agreement (and to which Chapter V of the EU GDPR applies) will be incorporated by reference and form part of the Agreement as follows: (1) In relation to European Data that is subject to the GDPR [i] Client is the "data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data and the Module Three terms apply to the extent the Client is a Processor of European Data; [iii] in Clause 9, Option 2 applies and changes to Sub-Processors will be notified transferred in accordance with those Standard Contractual Clauses as of the ‘Sub-Processors’ section of this DPAdate the Parties entered into those Standard Contractual Clauses; [iv] The parties agree that to use best endeavours to complete the governing law and forum for disputes for annexes to the Standard Contractual Clauses will be determined in accordance with promptly and at their own cost for the 'Contracting Entitypurpose of giving full effect to them; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, and that if such section does not specify an EU Member State; [v] the Annexes of there is any conflict between this Agreement and the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [iii] any conflict between the terms of the Standard Contractual Clauses and shall apply. NOT USED: NOT USED; NOT USED; NOT USED; NOT USED. In the UK Addendum will be resolved in accordance with Section 10 and Section 11 of event that the UK Addendum. (3) In relation to European Data that is subject to the Swiss DPACommission updates, the amends, substitutes, adopts or publishes new Standard Contractual Clauses will apply in accordance with sub-section (1) and from time to time, the following modifications [i] references Parties agree: that the most up to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [ii] references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and [iii] references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the date Standard Contractual Clauses by instructing us from time to comply with time shall be automatically incorporated in place of those in Annex 4 to Schedule 11 (as the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section of this DPA. (5context requires) Where the TCP contracting entity under the Agreement and that such incorporation is not TCPa Change; that where no other appropriate safeguard or exemption applies, such contracting entity will remain fully that the Personal Data subject to this Agreement (and solely responsible and liable to you for the performance which Chapter V of the Standard Contractual Clauses by TCP, and you EU GDPR applies) will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service transferred in accordance with the relevant form of the most up to date Standard Contractual Clauses as of the date the European Commission decision regarding such new Standard Contractual Clauses becomes effective; to use best endeavours to complete any part of the most up to date Standard Contractual Clauses that a Party must complete promptly and at their own cost for the purpose of giving full effect to them; and that if there is any conflict between this Agreement without liability and the most up to either party (but without prejudice date Standard Contractual Clauses the terms of the most up to any fees you have incurred prior to such suspension or termination)date Standard Contractual Clauses shall apply.

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP Neon Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. Neon, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Neon Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP contracting entity under the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP Neon cannot comply with its obligations under the Standard Contractual Clauses or is in breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP Neon or terminate the Standard Contractual Clauses ,Clauses, or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service Neon Services in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP HubSpot, Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. HubSpot, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.. DocuSign Envelope ID: 14B4DE79-CB8D-4CA8-B8B7-8FE555DE9336 (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCPHubSpot, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP HubSpot contracting entity under the Agreement is not TCPHubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCPHubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP HubSpot or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-non- compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. It is noted that on 28 June 2021 the European Commission made an implementing decision pursuant to Article 45 of the EU GDPR on the adequate protection of personal data by the United Kingdom which contains carve-outs for certain transfers outside of the EU to the UK of certain types of Personal Data (the “UK Adequacy Decision”). If European any transfer of Personal Data Protection Laws require which is subject to EU GDPR pursuant to this Agreement is not covered by the UK Adequacy Decision or at any time during the term of the Agreement the UK Adequacy Decision is: withdrawn, invalidated, overruled or otherwise ceases to have effect, or amended in such a way as to affect the transfers of Personal Data outside of the EU which are contemplated under this Agreement, Clauses 32.5.2 to 32.5.3 below shall apply. The Parties agree: that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP and/or the Data Privacy Framework is invalidated), without any further action being required they have entered into the Standard Contractual Clauses in the European Commission's decision 2021/914/EU in respect of data transfers by the Provider outside of the EU to the UK; that, where no other appropriate safeguard or exemption applies, that the Personal Data subject to this Agreement (and to which Chapter V of the EU GDPR applies) will be incorporated by reference and form part of the Agreement as follows: (1) In relation to European Data that is subject to the GDPR [i] Client is the "data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data and the Module Three terms apply to the extent the Client is a Processor of European Data; [iii] in Clause 9, Option 2 applies and changes to Sub-Processors will be notified transferred in accordance with those Standard Contractual Clauses as of the ‘Sub-Processors’ section of this DPAdate the Parties entered into those Standard Contractual Clauses; [iv] The parties agree that to use best endeavours to complete the governing law and forum for disputes for annexes to the Standard Contractual Clauses will be determined in accordance with promptly and at their own cost for the 'Contracting Entitypurpose of giving full effect to them; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, and that if such section does not specify an EU Member State; [v] the Annexes of there is any conflict between this Agreement and the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [iii] any conflict between the terms of the Standard Contractual Clauses and shall apply. In the UK Addendum will be resolved in accordance with Section 10 and Section 11 of event that the UK Addendum. (3) In relation to European Data that is subject to the Swiss DPACommission updates, the amends, substitutes, adopts or publishes new Standard Contractual Clauses will apply in accordance with sub-section (1) and from time to time, the following modifications [i] references Parties agree: that the most up to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [ii] references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and [iii] references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the date Standard Contractual Clauses by instructing us from time to comply with time shall be automatically incorporated in place of those in use at the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section time of this DPA. (5) Where the TCP contracting entity under the Agreement such update, amendment, substitution, adoption or publication and that such incorporation is not TCPa Change; that where no other appropriate safeguard or exemption applies, such contracting entity will remain fully that the Personal Data subject to this Agreement (and solely responsible and liable to you for the performance which Chapter V of the Standard Contractual Clauses by TCP, and you EU GDPR applies) will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service transferred in accordance with the relevant form of the most up to date Standard Contractual Clauses as of the date the European Commission decision regarding such new Standard Contractual Clauses becomes effective; to use best endeavours to complete any part of the most up to date Standard Contractual Clauses that a Party must complete promptly and at their own cost for the purpose of giving full effect to them; and that if there is any conflict between this Agreement without liability and the most up to either party (but without prejudice date Standard Contractual Clauses the terms of the most up to any fees you have incurred prior to such suspension or termination)date Standard Contractual Clauses shall apply.

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP Neon Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. Neon, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCP, Neon Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Sub- Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause ▇▇▇▇▇▇ 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP contracting entity under the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP Neon cannot comply with its obligations under the Standard Contractual Clauses or is in breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP Neon or terminate the Standard Contractual Clauses ,Clauses, or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-non- compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service Neon Services in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Standard Contractual Clauses. If European Data Protection Laws require Without prejudice to section 10.3 of this DPA, the following provisions will be used to assist in the interpretation of the Standard Contractual Clauses incorporated as part of this DPA: (a) Annexes to the EU SCCs and the UK SCCs are as set out in Attachment 1; (b) for the purposes of the EU SCCs: (i) Clause 9 Option 2 shall apply (general written authorisation) and the Parties agree that appropriate safeguards are put in place the time period for submitting notice of changes shall be 5 business days, (ii) Clause 17 Option 1 (governing law) shall apply and shall be governed by the laws of Sweden, and for example, if (iii) Clause 18 (choice of forum and jurisdiction) the Data Privacy Framework does not cover courts of Sweden shall have jurisdiction; (c) information and documentation to be provided by the transfer data importer to TCP and/or the Data Privacy Framework is invalidated), data exporter under the Standard Contractual Clauses will be incorporated by reference and form part provided only upon Customer’s reasonable request, taking into account the nature of the Agreement as follows:Processing and the information available to IFS; (1d) In relation to European Data that is subject to the GDPR [i] Client is the "data exporter" and TCP. is the "data importer"; [ii] the Module Two terms apply to the extent the Client is a Controller of European Data and the Module Three terms apply to the extent the Client is a Processor of European Data; [iii] in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The parties agree that the governing law and forum for disputes for audits under the Standard Contractual Clauses will be determined carried out in accordance with the 'Contracting Entity; Applicable Law; Notice’ section 7 (Audits) of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State; [v] the Annexes this DPA; (e) any certification of deletion of Personal Data that is required under the Standard Contractual Clauses will be deemed completed with provided by the information set out in the Annexes of this DPA; [vi] the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] if and data importer to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict.data exporter only upon Customer’s request; (2f) In relation IFS will only accept to European Data that is Transfer and process any sensitive data as expressly agreed and set forth in Annex 1 of Attachment 1; and (g) for the purpose of Clause 9(a) of the EU SCCs and subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place in accordance with sub-section (1) and the following modifications [i] the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [ii] Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [iii] any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1) and the following modifications [i] references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [ii] references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and [iii] references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland". (4) Client agrees that by complying with our obligations under the 'Sub-Processors' section 8 of this DPA, TCPCustomer (also on behalf of other Controllers referenced in section 4.1) hereby gives its general written consent, Inc. fulfills its obligations under Section 9 authorization and mandate to IFS to use Sub-processors for Processing of Personal Data solely for the purposes set forth in this DPA; and (h) for Swiss Personal Data, the Data Transfer Agreement shall be deemed modified such that any reference to the GDPR shall refer to the Swiss Federal Acts on Data Protection 1992 and 2020, and the term ‘Member State’ shall not be interpreted in a way as to exclude Data Subjects in Switzerland from the possibility of enforcing their rights in their place of habitual residence in accordance with clause 18(c) of the Standard Contractual Clauses. For the purposes of Clause 9(cTHE UNDERSIGNED INDIVIDUALS CONFIRM THAT (I) of the Standard Contractual Clauses, Client acknowledges that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide THEY ARE DULY AUTHORIZED BY THEIR RESPECTIVE ENTITIES TO EXECUTE THIS ADDENDUM ON SUCH ENTITY’S BEHALF; AND (on a confidential basisII) all information we reasonably canEACH PARTY HAS HAD THE OPPORTUNITY TO READ AND NEGOTIATE THE LANGUAGE OF THIS ADDENDUM AND ANY APPLICABLE TERMS AND CONDITIONS. Client also acknowledges and agrees that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITS' section of this DPA.CUSTOMER IFS Signature: Signature: Name: Name: Title: Title: Date: Date: (5) Where the TCP contracting entity under the Agreement is not TCP, such contracting entity will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCP, and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).ATTACHMENT 1 ANNEX I

Standard Contractual Clauses. If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to TCP HubSpot, Inc. and/or the Data Privacy DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows: (1a) In relation to European Data that is subject to the GDPR [(i] Client ) Customer is the "data exporter" and TCP. HubSpot, Inc. is the "data importer"; [(ii] ) the Module Two terms apply to the extent the Client Customer is a Controller of European Data and the Module Three terms apply to the extent the Client Customer is a Processor of European Data; [(iii] ) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; [iv] The (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be determined in accordance with the 'Contracting Entity; Applicable Law; Notice’ section of the Jurisdiction Specific Terms or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); [v] (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; [vi] (viii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR; and [vii] (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict. (2b) In relation to European Data that is subject to the UK GDPR, UK Extension to the EU-U.S. Data Privacy Framework will first apply and/or UK Extension to the EU-U.S. DPF is invalidated, the Standard Contractual Clauses will take place apply in accordance with sub-section section (1a) and the following modifications [(i] ) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; [(ii] ) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and [(iii] ) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum. (3c) In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section section (1a) and the following modifications [(i] ) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; [(ii] ) references to “"EU”", “"Union” " and “"Member State law” " will be interpreted as references to Swiss law; and [(iii] ) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland".. DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A (4d) Client agrees You agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, TCPHubSpot, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, Client acknowledges you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. Client You also acknowledges acknowledge and agrees agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'THIRD PARTY CERTIFICATIONS AND AUDITSDemonstration of Compliance' section of this DPA. (5e) Where the TCP HubSpot contracting entity under the Agreement is not TCPHubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by TCPHubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If TCP HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and you intend to suspend the transfer of European Data to TCP HubSpot or terminate the Standard Contractual Clauses ,or UK Addendum, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If we have not or cannot cure the non-non- compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).