Common use of Sub-Processing Clause in Contracts

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-Processing. 2.1 Customer generally authorises (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇://▇▇▇.▇▇ as at the date of this DPA ▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor Listprocessor List Website”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by . The Controller is responsible for visiting the Sub-Processorprocessor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, [by providing Customer with an updated copy the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the provision Services Agreement and without liability to the Controller) the affected part of the Services, Services Agreement with respect only to those Services which avoids cannot be provided by the Processor without the use of that proposed the objected-to new or additional Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may processor by providing written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon (d) The Processor and/or Wolters Kluwer group shall maintain a written contract between Pryon and impose the Sub-Processor that includes terms which offer at least an equivalent level of same data protection for Customer Personal Data obligations as those set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (including “EEA”) and/or their Member States and Switzerland to Third Countries, to the Security Measuresextent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”). Pryon , the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for any breach the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this DPA caused by clause 5 shall not apply to the extent Controller instructs the Processor to allow a Sub-Processorthird party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ to appoint 7.1. DT engages Sub-Processors in accordance to perform certain Processing of Supply Partner Personal Data on Supply Partner’s behalf. Prior to an engagement with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed a Sub-Processor, including reasonable details DT: (i) Carries out reviews and requires or receives adequate assurances that the Sub-Processor complies with obligations substantially similar to the obligations as set out in this Addendum; and (ii) ensures that a Statutory Data Transfer Agreement or such other appropriate methods of Personal Data transfer are at all relevant times incorporated into the Processing to be undertaken by agreement executed between DT and the Sub-Processor, [by providing Customer if the engagement with an updated copy the Sub-Processor involves a Personal Data Transfer of Supply Partner Personal Data,. 7.2. Upon the execution of this Addendum, Supply Partner hereby gives DT Supply Partner’s approval to engage the companies detailed at ▇▇▇▇://▇▇▇.▇▇.▇▇▇/subprocessors as Sub- Processors. 7.3. Where a Sub-Processor fails to fulfill its data protection obligations or statements, DT will remain fully liable to Supply Partner for the performance of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) Processor's obligations to the proposed appointment: (a) Pryon shall use reasonable efforts same extent that DT would be liable to make available a commercially reasonable change Supply Partner directly under the terms of this Addendum, except as otherwise set forth in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to if DT would have performed the extent that it relates to the Services which require the use obligations of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect 7.4. DT will inform Supply Partner of DT’s engagement with a new Sub-Processor. Supply Partner may object to each the use of new or additional Sub-Processor by sending DT a written notice within five (5) business days of receipt of said notice. If Supply Partner objects to the new Sub-Processor, Pryon shall maintain a written contract between Pryon DT will make commercially reasonable efforts to provide Supply Partner the same level of Service without the use of such Sub-Processor. Notwithstanding, Supply Partner’s objection and the Sub-Processor that includes terms which offer at least an equivalent level results thereof will not amend, alter or reduce Supply Partner’s obligations under the Agreement. Supply Partner will not be entitled to any refund and will hold DT harmless from and against any claims, suits and demands associated with or related to Supply Partner’s termination of protection for Customer Personal Data as those set out the Agreement, in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by connection with Supply Partner’s objection to a new Sub-Processor. 7.5. Notwithstanding the provisions here above (e.g. prior consent by Supply Partner), Supply Partner hereby authorizes DT to sub-contract the Processing to Sub-Processors based outside of Supply Partner’s jurisdiction, to the extent necessary, at DT sole discretion, to duly perform the Service on condition that the Sub-Processors provide sufficient guarantees in relation to required level of data protection, e.g. through a sub-contracting agreement which is based on a Statutory Data Protection Agreement , or based on such other applicable Personal Data Transfer mechanisms. Any such Statutory Data Protection Agreement concluded by DT will be treated as if concluded in the name and on behalf of Supply Partner. Supply Partner will be responsible to obtain regulatory approvals from the relevant Supervising Authorities and to perform any submissions and registrations, as required by Data Protection Laws.

Sub-Processing. 2.1 Customer generally authorises (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided through Finsit or on the GDPR page at ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇://▇▇▇.▇▇ as at the date ▇▇.▇▇.▇▇/softwaresupport/2015/home.asp or any dedicated websites of this DPA Processor from time to time (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor Listprocessor List Website”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by . The Controller is responsible for visiting the Sub-Processorprocessor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, [by providing Customer with an updated copy the Controller shall notify the Processor promptly in writing within 14 days after publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the provision Services Agreement and without liability to the Controller) the affected part of the Services, Services Agreement with respect only to those Services which avoids cannot be provided by the Processor without the use of that proposed the objected-to new or additional Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may processor by providing written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon (d) The Processor and/or Wolters Kluwer Group shall maintain a written contract between Pryon and impose the Sub-Processor that includes terms which offer at least an equivalent level of same data protection for Customer Personal Data obligations as those set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (including “EEA”) and/or their Member States and Switzerland to Third Countries, to the Security Measures). Pryon extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for any breach the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this DPA caused by clause 5 shall not apply to the extent Controller instructs the Processor to allow a Sub-Processorthird party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. 2.1 Customer generally a. The Data Controller hereby authorises ▇▇▇▇▇ the Data Processor to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of processors listed at the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from link ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ://▇▇▇▇▇’s ▇▇▇.▇▇▇/legal/. b. Subject to Section 5.1, the Data Processor shall provide reasonable notice to the Data Controller before engaging a new Sub-processor by means of email to the address provided in the Subscriber Agreement indicating to the Data Controller that it has updated the list of Sub-processors set forth at the link ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇▇/legal/.The Data Controller may object to such changes within thirty (30) calendar days of receipt of the notice, if there is a justified reason. In the event that the Data Controller objects to the appointment of a new Sub-processor, the Data Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed entitled to have approved make a change to the engagement and ongoing use Services that avoids the processing of that Personal Data by the new Sub-Processorprocessor in favour of the Data Controller. If the Data Processor is unable to make such change available within a reasonable period, it will notify the Data Controller. In such case, the Data Controller may terminate the Main Agreement upon written notice sent by registered e-mail or registered letter with acknowledgment of receipt. 2.5 With c. The Data Processor shall, in relation to each Sub-processor: i. provide the Data Controller with information about the data processing operations that shall be carried out by each Sub-processor; ii. conduct adequate due diligence procedures with respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and processor for the Sub-Processor purpose of ensuring that includes terms which offer at least an equivalent the latter is able to provide the level of protection for Customer Personal Data required by this DPA, including, without limitation, providing sufficient guarantees that adequate technical and organisational measures will be implemented so that data processing operations comply with any requirements under the Data Protection Legislation and this DPA; iii. include in the agreement executed by the Data Processor and each Sub-processor terms and conditions that substantially restate the same as those set out specified in this DPA (including DPA; iv. to the Security Measures). Pryon shall remain extent the agreement between the Data Processor and each Sub-Processor provides for the transfer of Personal Data outside the EEA, include the Standard Contractual Clauses or any other tool pursuant to Data Protection Legislation in any agreement with each Sub-processor in order to provide adequate protection to the processing of Personal Data; and v. be fully liable towards the Data Controller for any breach of this DPA caused committed by a each Sub-Processorprocessor in relation to its obligations concerning the processing of Personal Data.

Sub-Processing. 2.1 Customer generally authorises (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇://▇▇▇.▇▇ as at the date of this DPA ▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor Listprocessor List Website”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by . The Controller is responsible for visiting the Sub-Processorprocessor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, [by providing Customer with an updated copy the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the provision Services Agreement and without liability to the Controller) the affected part of the Services, Services Agreement with respect only to those Services which avoids cannot be provided by the Processor without the use of that proposed the objected-to new or additional Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may processor by providing written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon (d) The Processor and/or Wolters Kluwer group shall maintain a written contract between Pryon and impose the Sub-Processor that includes terms which offer at least an equivalent level of same data protection for Customer Personal Data obligations as those set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (including “EEA”) and/or their Member States and Switzerland to Third Countries, to the Security Measuresextent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”). Pryon , the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for any breach the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this DPA caused by clause 5 shall not apply to the extent Controller instructs the Processor to allow a Sub-Processorthird party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. ‌ 2.1 Customer Client generally authorises ▇▇▇▇▇ Inselligence to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon Inselligence may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ Inselligence as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 3 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon Inselligence shall give Customer Client prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] ) days of receipt of that notice, Customer Client notifies Pryon Inselligence in writing of any objections (on reasonable grounds) to the proposed appointment:appointment:‌ (a) Pryon Inselligence shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇Inselligence’s receipt of CustomerClient’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer Client declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer Client does not object to ▇▇▇▇▇Inselligence’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer Client shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon Inselligence shall maintain a written contract between Pryon Inselligence and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Client Personal Data as those set out in this DPA (including the Security Measures). Pryon Inselligence shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-Processing. 2.1 5.1. The Customer generally authorises provides general authorization for Akeyless to engage third party data Processors (“Sub-Processor”) to Process Customer Data. The Customer specifically authorizes ▇▇▇▇▇▇▇▇ to engage and appoint such Sub-Processors as listed in accordance with this Paragraph 2Annex III, to Process Customer Data, as well as permits each Sub-Processor to appoint a Sub-Processor on its behalf. 2.2 Pryon 5.2. Akeyless may continue to use those engage an additional or replace an existing Sub-Processors already engaged to Process Customer Data, subject to the provision of a thirty (30) days prior notice of its intention to do so to the Customer (such notice can be provided through the Customer account or through an email correspondence) (“Notice” and “Notice Period” respectively). In case the Customer has not objected to the adding or replacing of a Sub-Processor within Notice Period, such Sub-Processor shall be deemed approved by the Customer. In the event the Customer objects to the adding or replacing of a Sub-Processor, within such Notice Period, Akeyless may, under ▇▇▇▇▇▇▇▇’ sole discretion, suggest the engagement of a different Sub-Processor for the same course of services, or otherwise enable the Customer to terminate the Agreement where the Services cannot be reasonably provided under such circumstances, without liability to Customer. 5.3. Akeyless shall, where it engages any Sub-Processor, impose, through a legally binding contract between Akeyless and the Sub-Processor, data protection obligations that are no less onerous than, and provide at least the same level of protection as, those set out in this DPA. Akeyless shall ensure that such contract will require the Sub-Processor to provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of Data Protection Laws. Sub-processors shall be obligated, contractually, to reasonably cooperate with Akeyless, the Customer or an applicable regulatory authority in the event of an investigation or Security Incident. 5.4. ▇▇▇▇▇▇▇▇ as at shall remain responsible to the date Customer for the performance of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer ’s obligations in accordance with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedythis DPA. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 8.1 The Processor is authorised to appoint use sub-processors without further written permission from the Controller. An updated list of the Processor´s Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as processors can be found at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy://▇▇▇. 2.4 If Customer does not object to ▇▇▇▇▇▇▇▇.▇▇▇/subprocessors. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of the sub-processor in question within 2 weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have authorized the new sub-processor. If the Controller refuses to consent to the Processors´ appointment of a Subsub-processors on reasonable grounds, then the Processor during will either look for alternative solutions or not appoint the objection period referred sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to in Paragraph 2.3, Customer shall be deemed suspend or terminate this Agreement (and any other agreement between the Parties relating to have approved the engagement and ongoing use provision of that Sub-Processorservices by the Processor to the Controller) without penalty for both parties. 2.5 With respect 8.4 Prior to each Subletting the sub-Processorprocessor commence processing personal data, Pryon the Processor shall maintain enter into a written contract between Pryon and agreement with the Subsub-processor, making the sub-processor subject as a minimum to the obligations which the Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (is subject to under the DPA, including the Security Measures). Pryon shall remain liable for any breach obligation to implement adequate technical and organisational measures to ensure that the requirements of this DPA caused by a Sub-Processorthe General Data Protection Regulation be satisfied.

Sub-Processing. 2.1 ‌ 10.1 The Customer generally authorises ▇▇▇▇▇ to appoint acknowledges and expressly agrees that IZIX may use Third Party Sub-Processors processors for the provision of IZIX Services as described in accordance with this Paragraph 2the Agreement. 2.2 Pryon may continue to use those 10.2 Any such Sub-Processors already engaged by ▇▇▇▇▇ as at processors that provide services to and process Personal Data for IZIX shall be permitted to Process Personal Data only to deliver the date of this DPA (as those services IZIX has entrusted them with and shall be prohibited from Processing such Personal Data for any other purpose. IZIX remains fully responsible for any such Sub-Processors are shownprocessor’s compliance with IZIX’s obligations under the Agreement, together with their respective functions and locationsincluding this DPA. 10.3 IZIX shall, in Annex 4 (Authorised prior to the entrusting of services to a Sub-Processors) (the “processor, carry out any relevant due diligence on such Sub-Processor List”)processor to assess whether it is capable of providing the level of protection for the Personal Data as is required by this Data Processing Agreement and provide evidence of such due diligence to the Customer where requested by the Customer or a regulator. 2.3 Pryon 10.4 IZIX shall give Customer prior enter into written notice agreements with any such Sub-processor which contain obligations no less protective than those contained in this DPA, with respect to the protection of Personal Data to the extent applicable to the nature of the appointment IZIX Services provided by such Sub- processor, including the obligations imposed by the Standard Contractual Clauses, as applicable. 10.5 Upon the Customer’s written request, IZIX shall make available to the Customer the current list of any proposed Sub-Processorprocessors for the provision of IZIX Services. 10.6 If the Customer objects to the use of a new Sub-processor that shall be processing the Customer’s Personal Data, including reasonable details then the Customer shall notify IZIX in writing within 30 calendar days after being informed of the Processing to be undertaken by the processing activities of said Sub-Processorprocessor. In such a case, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon IZIX shall use reasonable efforts to make available change the affected Services or to recommend a commercially reasonable change in to the provision Customer’s use of the Services, which avoids affected Services to avoid the use Processing of that proposed Personal Data by the Sub-Processor; and (b) where: (i) processor concerned. If IZIX is unable to make available or propose such a change within 60 calendar days, the Customer may terminate the relevant part of the Agreement regarding those Services which cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may provided by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require IZIX without the use of the proposed Sub-Processorprocessor concerned. To that end, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use provide written notice of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor termination that includes terms which offer at least an equivalent level of protection the reasonable motivation for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Subnon-Processorapproval.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 5.1. The Data Controller authorizes the Data Processor to appoint Sub-Processors processors in accordance with this Paragraph 25. 2.2 Pryon 5.2. The Data Processor may continue to use those Sub-Processors processors already engaged by ▇▇▇▇▇ the Data Processor as at of the date of this DPA (Addendum Effective Date, subject to the Data Processor in each case as those Sub-Processors are shown, together with their respective functions and locations, soon as reasonably practicable meeting the obligations set out in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”)Paragraph 5.4. 2.3 Pryon 5.3. The Data Processor shall give Customer the Data Controller prior written notice of the appointment of any proposed new Sub-Processorprocessor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]processor. If, within [fourteen ten (14)] days 10) Business Days of receipt of that notice, Customer the Data Controller notifies Pryon the Data Processor in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon a. The Data Processor shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, Services which avoids the use of that proposed Sub-Processorprocessor; and (b) b. where: (i) : i. such a change cannot be made within fourteen sixty (1460) days from ▇▇▇▇▇the Data Processor’s receipt of Customerthe Data Controller’s notice; (; ii) . no commercially reasonable change is available; and/or (and/or iii) Customer . the Data Controller declines to bear the cost of the proposed change, then either Party notwithstanding anything in the Agreement, the Data Processor and/or the Data Controller may by written notice to the other Party with immediate effect terminate the Agreement, Agreement either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedySub- processor. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 5.4. With respect to each Sub-Processorprocessor, Pryon shall maintain a written contract the Data Processor shall: a. before the Sub-processor first Processes the Data Controller’s Personal Data (or, as soon as reasonably practicable, in accordance with Paragraph 5.2), carry out adequate due diligence to ensure that the Sub-processor is capable of providing the level of protection for the Data Controller’s Personal Data required by this DPA; and b. ensure that the arrangement between Pryon the Data Processor and the Sub-Processor that includes processor is governed by a written contract including terms which which: i. offer at least an equivalent level of protection for Customer the Data Controller’s Personal Data as those set out in this DPA (including including, in particular, those set out in Engage BDR, LLC DATA PROTECTION ADDENDUM Page 4 of 26 Paragraph 4 above); and ii. meet the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Sub-ProcessorData Protection Laws, including, but not limited to, Article 28(3) of the GDPR.

Sub-Processing. 2.1 Customer generally authorises (b) The controller gives permission for the use of Sub-processor(s) that are engaged in by the Processor for the provision of the Services. The Controller gives his approval for the Sub- processor(s) as specified on the website of Processor under "Sub-Processors": ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇://▇▇▇▇▇ as at ▇▇▇▇.▇▇▇/privacy-conditions/ (c) In the date of this DPA (as those event that the Processor intends to enable new or more Sub-Processors are shownprocessors, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of ensure that the Sub-Processor List via a ‘mailshot’ page on the website is updated. Controller will be informed by Processor about changes in the Sub-Processor list on the website. lf the Controller has reasonable grounds to object to the use of new or similar bulk distribution mechanism sent via email to Customer’s contact point as set out more Sub-processors, the Controller must immediately notify this in Attachment 1 to Annex 1 (European Annex)]. If, writing within [fourteen (14)] 14 days of receipt of the Sub- processor Notification. In the event that noticethe Controller objects to a new or different Sub- processor, Customer notifies Pryon in writing of any objections (on reasonable grounds) to and that objection is not unreasonable, the proposed appointment: (a) Pryon shall use Processor will make reasonable efforts to make changes to the Services available to the Controller, or to recommend a commercially reasonable change in the provision configuration of the Controller or the use by the Controller of the Services, which avoids for the use prevention of that proposed Processing of Personal Data by the new or other Sub-Processor; and processor against whom has been objected, without unreasonably burdening the Controller. If the Processor cannot make this change available within a reasonable period, which period shall not exceed sixty (b60) where: (i) such a change days, the Controller may terminate the affected part of the Services Agreement, however only regarding those Services that cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear provided by the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require Processor without the use of the proposed new or other Sub-processor objected to by means of written notification to the Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of (d) The processor chooses the Sub-processor with the necessary care. (e) lf such a Sub-processor is in a Third Country, at the written request of the Controller,the Processor during will enter an EU model contract (Controller> Processor) for the objection period referred Controller (in the name of the Controller), pursuant to in Paragraph 2.3Decision 2010/87/EU. In this case, Customer shall be deemed theController instructs and authorizes the Processor to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and instruct the Sub-processors on behalf of the Controller, and to use all the rights of the Controller towards the Sub- processors based on the EU model contract. (f) Without prejudice to the contents of clause 6 of the DPA, the Processor that includes terms which offer at least an equivalent level remains liable to the Controller for compliance with the obligations of protection for Customer Personal Data as those set out in this DPA (including the Security Measures)Sub-processor if the Sub-processor does not fulfil its obligations. Pryon shall remain However, the Processor is not liable for any breach of this DPA caused by a damage and claims arising from instructions from the Controller to Sub-Processorprocessors.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 13.1 ‘Sub-Processing’, in the meaning of this Agreement, does not include ancillary services, such as telecommunication services, postal / transport services, maintenance and user support services or the disposal of data carriers, as well as other measures to appoint ensure the confidentiality, availability, integrity and resilience of the hardware and software of data Processing equipment. The Processor shall, however, be obliged to make appropriate and legally binding contractual arrangements and take appropriate inspection measures to ensure the data protection and the data security of the Controller's data, even in the case of outsourced ancillary services to Sub-Processors. 13.2 The Controller agrees to the commissioning of the following sub-processors on the condition of a contractual agreement in accordance with applicable data protection laws: Sub-Processor Address / country Service N/A N/A N/A 13.3 Outsourcing to further Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those or changing any existing Sub-Processors already engaged by ▇▇▇▇▇ as at is permissible if the date Processor informs the Controller of this DPA (as those the identity of the Sub- Processor and the scope of the planned Sub-Processors are shown, together with their respective functions Processing in writing or in text form and locations, in Annex 4 (Authorised the Controller does not object to the planned Sub-ProcessorsProcessing in writing or in text form within ten (10) (days as from giving notice by the “Processor. The Controller shall not unreasonably object to the planned Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of Processing. In addition, the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointmentfollowing provisions apply: (a) Pryon shall use reasonable efforts the transfer of Personal Data to make available a commercially reasonable change in the provision of Sub-Processor and the Services, which avoids the use of that proposed Sub-Processor’s commencement of the data Processing shall only be undertaken after compliance with all requirements has been achieved; (b) if the Sub-Processor provides the agreed service outside the EU/EEA, the Processor shall ensure compliance with Applicable Laws; and (bc) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of Processor shall impose on the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred same data protection obligations as set out in this Agreement, in particular with regard to the provision of sufficient guarantees to implement appropriate technical and organisational measures in Paragraph 2.3, Customer shall be deemed to have approved such a manner that the engagement and ongoing use Processing will meet the requirements of that Sub-Processorthe Applicable Law. 2.5 13.4 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Processor will before the Sub- Processor first Processes any data of the Controller, carry out adequate due diligence to ensure that the Sub-Processor is capable of providing the level of protection for the Personal Data required by this Agreement and shall ensure that includes the agreement between the Processor and the relevant Sub-Processor, is governed by a written contract including terms which offer at least an equivalent the same level of protection for Customer Personal Data the Controller as those set out in this DPA (including Agreement and meets the Security Measures). Pryon shall remain liable for any breach requirements of this DPA caused by a Sub-Processorarticle 28(3) of the GDPR.

Sub-Processing. 2.1 6.1 Customer generally authorises ▇▇▇▇▇ Raft to appoint Sub-Processors in accordance with this Paragraph 2Section 6. Without limitation to the foregoing, Customer authorises the engagement of the Sub- Processors listed as of the Addendum Effective Date at the URL specified in Section 6.2. 2.2 Pryon may continue to use those 6.2 Information about Raft’s Sub-Processors already engaged by Processors, including their functions and locations, is available at: ▇▇▇▇▇://▇▇▇.▇▇▇▇.▇▇/▇▇▇▇-▇▇▇▇▇▇▇▇▇▇▇▇▇-▇▇▇▇▇▇ as at in the date of this DPA Data Processing Agreement section (as those Submay be updated by Raft from time-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Subto-Processorstime) or such other website address as Raft may provide to Customer from time to time (the “Sub-Processor ListSite”). 2.3 Pryon shall give 6.3 When Raft engages any Sub-Processor after the Addendum Effective Date, Raft will notify Customer prior written notice of the appointment engagement (including the name and location of any proposed the relevant Sub-Processor, including reasonable details of Processor and the Processing to be undertaken activities it will perform) by the Sub-Processor, [by providing Customer with an updated copy of updating the Sub-Processor List via a ‘mailshot’ Site or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 by other written means at least thirty (European Annex)]30) days before such Sub-Processor Processes Customer Personal Data. If, within [fourteen ten (14)] 10) days of receipt being notified of that noticesuch engagement, Customer notifies Pryon Raft in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon Raft shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen thirty (1430) days from ▇▇▇▇▇Raft’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the SaaS Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 6.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3Section 6.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 6.5 With respect to each Sub-Processor, Pryon Raft shall maintain a written contract between Pryon Raft and the Sub-Processor that includes terms which offer at least an equivalent a level of protection for Customer Personal Data as substantially similar to those set out in this DPA (including the Security Measures). Pryon Raft shall remain liable for any breach of this DPA caused by a Sub-ProcessorProcessor to the same extent as Raft would have been had Raft performed the Processing itself.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ Processor shall not subcontract its obligations under this Addendum or under the Service Contract to appoint Suba sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at processor without the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice consent of Controller. Processor shall inform Controller of its intention to engage a sub-processor and Controller shall have the right to consent to the appointment of any proposed Suba new sub-Processorprocessor, including reasonable details which consent shall not be unreasonably withheld, conditioned or delayed. If Controller agrees to the appointment of sub-processors, those sub‑processors must be appointed on the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or substantially similar bulk distribution mechanism sent via email to Customer’s contact point terms as are set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) this Addendum with respect to the proposed appointment: protection of Customer Data to the extent applicable to the nature of the services provided by such sub-processor. Controller hereby approves the appointment of the following third-party sub-processors: Amazon Web Services (ato the extent that the Controller has purchased a cloud hosted solution) Pryon shall use reasonable efforts to make available a commercially reasonable change as its web hosting provider (and All Lines Technology in the provision U.S. to the extent the Controller has purchased the Emerald support package) by Processor as a sub-processer. Controller acknowledges and agrees that Affiliates of Panopto EMEA Limited will be retained as sub-processors. Except as otherwise set forth in the ServicesServices Contract, which avoids Processor shall be liable for the use act and omission of that proposed Subits sub-Processor; and processors to the same extent Processor would be liable if performing the services of each sub-processor directly under this Addendum. Processor may, by giving no less than thirty (b30) where: (i) such a change cannot be made days’ notice to Controller, as or make changes to the list of sub- processors. Controller may object to the appointment of an additional sub-processor within fourteen (14) days from ▇▇▇▇▇of such notice on reasonable grounds relating to the protection of Personal Data, in which case Processor shall have the right to cure the objection through one of the following options (to be selected at Processor’s sole discretion): (a) Processor will cancel its plans to use such sub-processor with regard to Personal Data or will offer an alternative to provide its services without such sub-processor; (b) Processor will take the corrective steps requested by Controller in its objections (which remove Controller’s objection) and proceed to use the sub-processor with regard to the Personal Data; or (c) Processor may cease to provide or Controller may agree not to use (temporarily or permanently) the particular aspect of the services that would involve the use of such sub-processor with regard to Personal Data, subject to a mutual agreement of the parties to adjust the remuneration for the services provided considering the reduced scope of the services to the extent possible. If note on the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Processor’s receipt of CustomerController’s notice; (ii) no commercially reasonable objection, either party may terminate the Agreement and Controller will be entitled to a pro-rata refund for the prepaid fees for the services not performed as of the date of termination. Notwithstanding the foregoing, Processor may replace a sub-processor if the need for the change is available; and/or (iii) Customer declines urgent and necessary to bear provide the cost Processor’s services and the reason for the change is beyond the Processors control in which case Processor shall notify Controller of such replacement as soon as reasonably practicable and Controller shall retain the proposed change, then either Party may by written notice right to object to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Subreplacement sub-Processor, processor as its sole and exclusive remedyset forth above. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-Processing. 2.1 5.1 Customer generally authorises hereby acknowledges and agrees that Digital Realty may engage (i) Digital Reality affiliates as sub- processors; and (ii) the sub-processors set out at ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2▇://▇▇▇. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at ▇▇▇▇▇▇▇▇▇.▇▇▇/about/legal/privacy/sub-processors. Customer acknowledges and agrees that the date of this DPA (as those other party may engage third-party Sub-Processors are shown, together processors in connection with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed . That other Party will enter into a written agreement with each Sub-Processor; andprocessor containing data protection obligations that provide at least the same level of protection for Personal Data as those in this DPA, to the extent applicable to the nature of the Services provided by such Sub-processor. (b) where5.2 Customer hereby consents to this list of sub-processors, their locations, and processing activities as it pertains to its Personal Data. Digital Realty shall: (iA) make available an up-to-date list of the sub-processors it has appointed upon written request from Customer; and (B) notify Customer if it adds any new sub-processors at least 14 days prior to allowing such a change cannot be made within fourteen (14) days sub-processor to process Customer Personal Data. Customer may request the current list of Sub- processors for the Services, including the identities of those Sub-processors and their country of location via email from ▇▇▇▇▇’s ▇▇@▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇. Customer will have 14 days from the date of receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to approve or reject the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 change. If Customer does not object to ▇▇▇▇▇’s appointment of a Subin this time period, the sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall processor will be deemed accepted. If Customer rejects the replacement sub-processor, Digital Realty may terminate the services relying on the replacement sub-processor with immediate effect on written notice to have approved the engagement and ongoing use of that Sub-ProcessorCustomer. 2.5 With respect 5.3 Digital Realty is responsible under the Applicable Data Protection Laws for the acts or omissions of its sub-processors to the same extent it would be liable if performing the Services of each Sub-Processor, Pryon shall maintain a written contract between Pryon and processor directly under the Subterms of this DPA. Digital Realty will impose data protection obligations upon any sub-Processor processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as are no less protective than those set out included in this DPA. This DPA (including may be executed electronically and in any number of counterparts, each of which is an original and all of which evidence the Security Measures)same agreement between the parties. Pryon Except for matters covered by this DPA, this DPA is subject to the terms of the Agreement. Except as specifically amended and modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. The exclusions and limitations on liability contained in the Agreement shall remain liable for apply to any breach liability arising under or in respect of this DPA. The terms of this DPA caused by a Sub-Processorwill control to the extent there is any conflict between terms of this DPA and the terms of the Agreement. If there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail with respect to Personal Data that is subject to EU GDPR or UK GDPR.

Sub-Processing. 2.1 Customer generally authorises 8.1 The Processor is authorised to use sub-processors without further written permission from the Controller. An updated list of the Processor´s Sub-processors can be found at h ttps://▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear ▇▇▇.▇▇▇/subprocessors. The Processor shall notify the cost Controller in writing of the proposed identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of the sub-processor in question within 2 weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have authorized the new sub-processor. If the Controller refuses to consent to the Processors´ appointment of a sub-processors on reasonable grounds, then the Processor will either look for alternative solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either Party may by written notice party has the right to suspend or terminate this Agreement (and any other agreement between the Parties relating to the other Party with immediate effect terminate provision of services by the Agreement, either in whole or Processor to the extent that it relates Controller) without penalty for both parties. 8.4 Prior to letting the sub-processor commence processing personal data, the Processor shall enter into a written agreement with the sub-processor, making the sub-processor subject as a minimum to the Services obligations which require the use Processor is subject to under the DPA, including the obligation to implement adequate technical and organisational measures to ensure that the requirements of the proposed Sub-Processor, as its sole and exclusive remedyGeneral Data Protection Regulation be satisfied. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Sub-Processor.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ to appoint 8.1 The Supplier may Process the Personal Data in the locations and with the Sub-Processors processors set out in accordance with Annex 2 to this Paragraph 2.Schedule in order to perform the Services.‌ 2.2 Pryon 8.2 The Customer may continue to use those receive notifications of new Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those processors and updates to existing Sub-Processors are shownprocessors by subscribing for updates. If the Customer subscribes, together the Supplier will provide the subscriber with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed new Sub-Processorprocessor, including reasonable full details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]processor. If, within [fourteen thirty (14)] 30) days of receipt of that notice, Customer the Company notifies Pryon the Supplier in writing of any reasonable objections (on reasonable grounds) to the proposed appointment:, neither the Supplier nor any Supplier Affiliate shall disclose any Personal Data to that proposed Sub-processor until reasonable steps have been taken to address the objections raised by the Customer and the Customer has been provided with a reasonable written explanation of the steps taken. (a) Pryon shall 8.3 In the event the Customer objects to a new Sub-processor, the Supplier will use reasonable efforts to make a change to the affected Services available a or recommend commercially reasonable change in changes to the provision Customer’s configuration or use of the ServicesServices to avoid the Processing that is the subject of the objection. If the Supplier is unable to make available such changes within a reasonable period of time, the Customer may terminate the applicable Service Order with respect only to those Services which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear provided by the cost Supplier without use of the proposed change, then either Party may objected-to Sub-processor by providing written notice to the other Party Supplier. The Supplier will then refund the Customer any prepaid fees covering the remainder of the term of such Service Order following the effective date of termination with immediate effect terminate respect to such terminated Services. 8.4 The Customer provides a general consent for the AgreementSupplier to engage onward Sub-processors, either provided the following requirements are satisfied: (a) any onward sub-processor must agree in whole writing to only process data in a country that the European Commission has declared to have an “adequate” level of protection or to the extent that it relates only process data on terms equivalent to the Services which require applicable Standard Contractual Clauses, or pursuant to Binding Corporate Rules and (b) the use Supplier will restrict the onward Sub-processor’s access to Personal Data only to what is strictly necessary to provide the Services, and will prohibit the Sub-processor from processing the Personal Data for any other purpose. 8.5 The Supplier will enter into a written agreement with each Sub-processor containing data protection obligations no less protective than those contained in this Data Protection Schedule with respect to the protection of Personal Data. The Parties agree that the copies of the proposed Sub-Processorprocessor agreements that must be provided by the Supplier to the Customer pursuant to the relevant Standard Contractual Clauses may have all commercial information, as or clauses unrelated to the Standard Contractual Clauses or their equivalent, removed by the Supplier beforehand; and, that such copies will be provided by the Supplier, in a manner to be determined in its sole and exclusive remedydiscretion, only upon the written request of the Customer. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment 8.6 Use of a Sub-Processor during processor will not relieve, waive or diminish any obligation the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved Supplier has under the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon Agreement and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain Supplier is liable for any breach acts or omissions of this DPA caused by a any Sub-Processor.processor to the same extent as if the acts or omissions were performed by the Supplier.‌

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ to appoint 7.1. DT engages Sub-Processors in accordance to perform certain Processing of Supply Partner Personal Data on Supply Partner’s behalf. Prior to an engagement with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed a Sub-Processor, including reasonable details DT: (i) Carries out reviews and requires or receives adequate assurances that the Sub-Processor complies with obligations substantially similar to the obligations as set out in this Addendum; and (ii) ensures that a Statutory Data Transfer Agreement or such other appropriate methods of Personal Data transfer are at all relevant times incorporated into the Processing to be undertaken by agreement executed between DT and the Sub-Processor, [by providing Customer if the engagement with an updated copy of the Sub-Processor List via involves a ‘mailshot’ or similar bulk distribution mechanism sent via email Personal Data Transfer of Supply Partner Personal Data,. 7.2. Upon the execution of this Addendum, Supply Partner hereby gives DT Supply Partner’s approval to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to engage the proposed appointmentcompanies detailed at ▇▇▇▇: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from //▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of ▇▇▇▇.▇▇▇/legal/sub- processor-list-for-dtx as Sub-Processors. 7.3. Where a Sub-Processor during fails to fulfill its data protection obligations or statements, DT will remain fully liable to Supply Partner for the objection period referred performance of the Sub-Processor's obligations to the same extent that DT would be liable to Supply Partner directly under the terms of this Addendum, except as otherwise set forth in Paragraph 2.3the Agreement, Customer shall be deemed to if DT would have approved performed the engagement and ongoing use obligations of that the Sub-Processor. 2.5 With respect 7.4. DT will inform Supply Partner of DT’s engagement with a new Sub-Processor. Supply Partner may object to each the use of new or additional Sub-Processor by sending DT a written notice within five (5) business days of receipt of said notice. If Supply Partner objects to the new Sub-Processor, Pryon shall maintain a written contract between Pryon DT will make commercially reasonable efforts to provide Supply Partner the same level of Service without the use of such Sub-Processor. Notwithstanding, Supply Partner’s objection and the Sub-Processor that includes terms which offer at least an equivalent level results thereof will not amend, alter or reduce Supply Partner’s obligations under the Agreement. Supply Partner will not be entitled to any refund and will hold DT harmless from and against any claims, suits and demands associated with or related to Supply Partner’s termination of protection for Customer Personal Data as those set out the Agreement, in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by connection with Supply Partner’s objection to a new Sub-Processor. 7.5. Notwithstanding the provisions here above (e.g. prior consent by Supply Partner), Supply Partner hereby authorizes DT to sub-contract the Processing to Sub-Processors based outside of Supply Partner’s jurisdiction, to the extent necessary, at DT sole discretion, to duly perform the Service on condition that the Sub-Processors provide sufficient guarantees in relation to required level of data protection, e.g. through a sub-contracting agreement which is based on a Statutory Data Protection Agreement , or based on such other applicable Personal Data Transfer mechanisms. Any such Statutory Data Protection Agreement concluded by DT will be treated as if concluded in the name and on behalf of Supply Partner. Supply Partner will be responsible to obtain regulatory approvals from the relevant Supervising Authorities and to perform any submissions and registrations, as required by Data Protection Laws.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 8.1 The Processor is authorised to appoint use sub-processors without further written permission from the Controller. An updated list of the Processor´s Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as processors can be found at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy://▇▇▇. 2.4 If Customer does not object to ▇▇▇▇- ▇▇▇▇.▇▇▇/▇▇▇▇▇’s ▇▇▇▇▇▇▇▇. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of a Subthe sub-Processor during the objection period referred to processor in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorquestion within 2 weeks after having received notice. 2.5 8.2 With respect to each SubForecast’s other sub-Processorprocessors, Pryon Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall maintain not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have au- thorized the new sub-processor. If the Controller refuses to consent to the Processors´ appoint- ment of a written contract sub-processors on reasonable grounds, then the Processor will either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in Parties Last update: 8th November 2021 concerning the appointment, then either party has the right to suspend or terminate this DPA (and any other agreement between the Parties relating to the provision of services by the Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the sub-processor commence processing personal data, the Processor shall en- ter into a written agreement with the sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the DPA, including the Security Measures). Pryon shall remain liable for any breach obli- gation to implement adequate technical and organisational measures to ensure that the require- ments of this DPA caused by a Sub-Processorthe Applicable Data Protection Law be satisfied.

Sub-Processing. 2.1 Customer generally authorises (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub-processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub-processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or at ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇://▇▇▇.▇▇ as at the date of this DPA ▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor ListSub- processor List Website”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by . The Controller is responsible for visiting the Sub-Processorprocessor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, [by providing Customer with an updated copy the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall will use reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the provision Services Agreement and without liability to the Controller) the affected part of the Services, Services Agreement with respect only to those Services which avoids cannot be provided by the Processor without the use of that proposed the objected-to new or additional Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may processor by providing written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon (d) The Processor and/or Wolters Kluwer group shall maintain a written contract between Pryon and impose the Sub-Processor that includes terms which offer at least an equivalent level of same data protection for Customer Personal Data obligations as those set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub-processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (including “EEA”) and/or their Member States and Switzerland to Third Countries, to the Security Measuresextent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”). Pryon , the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for any breach the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this DPA caused by clause 5 shall not apply to the extent Controller instructs the Processor to allow a Sub-Processorthird party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. 2.1 10.1 The Customer generally authorises ▇▇▇▇▇ to appoint acknowledges and expressly agrees that IZIX may use Third Party Sub-Processors processors for the provision of IZIX Services as described in accordance with this Paragraph 2the Agreement. 2.2 Pryon may continue to use those 10.2 Any such Sub-Processors already engaged by ▇▇▇▇▇ as at processors that provide services to and process Personal Data for IZIX shall be permitted to Process Personal Data only to deliver the date of this DPA (as those services IZIX has entrusted them with and shall be prohibited from Processing such Personal Data for any other purpose. IZIX remains fully responsible for any such Sub-Processors are shownprocessor’s compliance with IZIX’s obligations under the Agreement, together including this DPA. 10.3 IZIX shall, prior to the entrusting of services to a Sub- processor, carry out any relevant due diligence on such Sub- processor to assess whether it is capable of providing the level of protection for the Personal Data as is required by this Data Processing Agreement and provide evidence of such due diligence to the Customer where requested by the Customer or a regulator. 10.4 IZIX shall enter into written agreements with their respective functions and locationsany such Sub- processor which contain obligations no less protective than those contained in this DPA, in Annex 4 (Authorised with respect to the protection of Personal Data to the extent applicable to the nature of the IZIX Services provided by such Sub-Processors) (processor, including the “obligations imposed by the Standard Contractual Clauses, as applicable. 10.5 Upon the Customer’s written request, IZIX shall make available to the Customer the current list of Sub-Processor List”)processors for the provision of IZIX Services. 2.3 Pryon 10.6 If the Customer objects to the use of a new Sub-processor that shall give be processing the Customer’s Personal Data, then the Customer prior written notice shall notify IZIX in writing within 30 calendar days after being informed of the appointment processing activities of any proposed said Sub-Processorprocessor. In such a case, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon IZIX shall use reasonable efforts to make available change the affected Services or to recommend a commercially reasonable change in to the provision Customer’s use of the Services, which avoids affected Services to avoid the use Processing of that proposed Personal Data by the Sub-Processor; and (b) where: (i) processor concerned. If IZIX is unable to make available or propose such a change within 60 calendar days, the Customer may terminate the relevant part of the Agreement regarding those Services which cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may provided by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require IZIX without the use of the proposed Sub-Processorprocessor concerned. To that end, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use provide written notice of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor termination that includes terms which offer at least an equivalent level of protection the reasonable motivation for Customer Personal Data as those set out in this DPA (including the Security Measures). Pryon shall remain liable for any breach of this DPA caused by a Subnon-Processorapproval.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 6.1 The Controller hereby authorizes the Processor to appoint Sub-Processors engage the entities listed in accordance with this Paragraph 2Exhibit 2 as a sub- processor. 2.2 Pryon may continue to use those Sub6.2 The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other processors or sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA processors (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised hereinafter collectively “Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of , thereby giving the appointment of any proposed Sub-Processor, including reasonable details of Controller the Processing opportunity to be undertaken by object to and prohibit such changes. If the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer Controller does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during within two weeks, the objection period referred to in Paragraph 2.3, Customer addition or replacement shall be deemed to have approved been approved. 6.3 If an objection is raised in accordance with Section 6.2, the engagement Processor shall be entitled to terminate the Agreement as well as this DPA at any time, subject to giving two weeks’ prior notice. 6.4 Where the Processor engages another Sub-Processor for carrying out specific processing activities on behalf of the Controller, the same data protection obligations as set out in this DPA shall be imposed on that Sub-Processor by means of a contract. This contract shall in particular provide sufficient guarantees by the Sub-Processor to implement appropriate technical and ongoing use organizational measures in such a manner that the processing will meet the requirements of applicable data protection law. 6.5 Subject to the limitations of liability set out in the Agreement, where a Sub-Processor fails to fulfil its data protection obligations, the Processor shall remain liable to the Controller for the performance of that Sub-Processor’s obligations. 2.5 With respect to each 6.6 Notwithstanding Section 5, where a. the Processor informs the Controller of the use of any Sub-Processor, Pryon shall maintain a written contract between Pryon Processors and includes or makes available upon request information on the contractual terms offered by such Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (Processors, including the Security Measures). Pryon technical and organizational measures implemented by such Sub-Processors (“Sub- b. the Controller approves or is deemed to have approved such Sub-Processors pursuant to Sections 6.1 or 6.2, these Sub-Processing Terms shall remain liable for any breach be considered to be in full compliance with the terms of this DPA caused by a Sub-ProcessorDPA, including Sections 5 and 6.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ 8.1 The Processor is authorised to appoint use sub-processors without further written permission from the Controller. An updated list of the Processor´s Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as processors can be found at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, [by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the proposed appointment: (a) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy://▇▇▇. 2.4 If Customer does not object to ▇▇▇▇ ▇▇▇▇.▇▇▇/▇▇▇▇▇’s ▇▇▇▇▇▇▇▇. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowingthe Controller to reasonably object to the appointment of a Subthe sub-Processor during the objection period referred to processor in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processorquestion within 2weeks after having received notice. 2.5 8.2 With respect to each SubForecast’s other sub-Processorprocessors, Pryon Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall maintain not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have au- thorized the new sub-processor. If the Controller refuses to consent to the Processors´ appoint- ment of a written contract sub-processors on reasonable grounds, then the Processor will either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between Pryon and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in Parties concerning the appointment, then either party has the right to suspend or terminate this DPA (and any other agreement between the Parties relating to the provision of services by the Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the sub-processor commence processing personal data, the Processor shall en- ter into a written agreement with the sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the DPA, including the Security Measures). Pryon shall remain liable for any breach obli- gation to implement adequate technical and organisational measures to ensure that the require- ments of this DPA caused by a Sub-Processorthe Applicable Data Protection Law be satisfied.

Sub-Processing. 2.1 Customer generally authorises ▇▇▇▇▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon The Processor may continue to use those Sub-Processors already engaged by ▇▇▇▇▇ as at the date of this DPA another Processor (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by hereinafter the Sub-Processor). By signing this DPA, [by providing Customer the Controller grants the Processor the general authorisation to recruit Sub-Processors. The Processor may continue to work with an updated copy Sub-Processors that had already been appointed on the effective date of the DPA provided the following conditions are met without undue delay. These terms and conditions shall apply to all Sub-Processors: a) The Processor must ensure in advance that the Sub-Processor can provide sufficient guarantees regarding the implementation of Appropriate Technical and Organisational Measures such that the Processing meets GDPR requirements. b) The Processor shall contractually impose on the Sub-Processor the same Data Protection obligations as those set out in Article 4 of this DPA. Within the framework of this general authorisation, the Processor undertakes to inform the Controller, subject to at least two (2) weeks’ advance notice, of the changes envisaged regarding the addition or replacement of Sub-Processors, allowing the Controller to object to these changes on reasonable grounds. Unreasonable and invalid objections shall include but are not limited to undocumented objections; reasonable and valid objections include but are not limited to situations where the Controller has documented reasons to question the ability of the Sub-Processor List via to protect the Personal Data and keep it confidential. To be valid, objections must be raised before half of the advance notice has expired. The Processor shall provide a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) reasoned reply to the proposed appointment: (areasonable and valid) Pryon shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and objections raised. Should the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal fail to fulfil its Data as those set out in this DPA (including Protection obligations, the Security Measures). Pryon Processor shall remain fully liable towards the Controller for any breach the performance of this DPA caused by a the Sub-Processor’s obligations.