Common use of SUB-PROCESSORS AND THIRD COUNTRY TRANSFERS Clause in Contracts

SUB-PROCESSORS AND THIRD COUNTRY TRANSFERS. 7.1 Sana Labs may engage sub-processors within and outside the EU/EEA and may transfer and in other ways process Personal Data outside the EU/EEA. Sana Labs shall ensure that sub-processors are bound by written agreements which impose on them the same data processing obligations as the obligations under this DPA in respect of data protection. Appendix B contains a complete list of its sub-processors that from the date of entry into force of this DPA have been pre-approved by the Subscriber. 7.2 Sana Labs shall inform the Subscriber of any new sub-processors and give the Subscriber the opportunity to object to such changes. Such objections by the Subscriber shall be based on grounds regarding the new sub-processor’s ability to comply with Applicable Data Protection Laws and be made in writing within thirty (30) days from receipt of the information. Sana Labs shall upon request provide the Subscriber with all information that the Subscriber may reasonably request to assess the proposed sub-processor’s ability to comply with Applicable Data Protection Laws. If Sana Labs, despite the Subscriber’s objection, wishes to engage the proposed sub-processor, the Subscriber is entitled to terminate the Agreement at no extra cost. 7.3 If Personal Data is transferred to, or made available from, outside EU/EEA, Sana Labs shall ensure that the transfer is subject to an appropriate safeguard under Applicable Data Protection Laws, using Standard Contractual Clauses adopted by the European Commission or an adequacy decision from the European Commission. The Subscriber hereby authorizes Sana Labs to enter into such standard data protection clauses with sub-processors on behalf of the Subscriber. 7.4 Sana Labs shall closely follow the development regarding the transfer of Personal Data outside the EU/EEA and, to the extent possible, implement any evolved requirements related to the transfer of Personal Data to a sub-processor, including the adoption of additional security measures and the conducting of all required risk assessments of privacy laws in jurisdiction where the sub-processor is located, to ensure that the Services and the use of the Services are compliant with Applicable Data Protection Laws.

SUB-PROCESSORS AND THIRD COUNTRY TRANSFERS. 7.1 Sana Labs may engage sub-processors within and outside the EU/EEA and may transfer and in other ways process Personal Data outside the EU/EEA. Sana Labs shall ensure that sub-processors are bound by written agreements which impose on them the same data processing obligations as the obligations under this DPA in respect of data protection. Appendix B contains a complete list of its sub-processors that from the date of entry into force of this DPA have been pre-approved by the Subscriber. 7.2 Sana Labs shall inform the Subscriber of any new sub-processors and give the Subscriber the opportunity to object to such changes. Such objections by the Subscriber shall be based on grounds regarding the new sub-processor’s ability to comply with Applicable Data Protection Laws and be made in writing within thirty (30) days from receipt of the information. Sana Labs shall upon request provide the Subscriber with all information that the Subscriber may reasonably request to assess the proposed sub-processor’s ability to comply with Applicable Data Protection Laws. If Sana Labs▇▇▇▇, despite the Subscriber’s objection, wishes to engage the proposed sub-processor, the Subscriber is entitled to terminate the Agreement at no extra cost. 7.3 If Personal Data is transferred to, or made available from, outside EU/EEA, Sana Labs shall ensure that the transfer is subject to an appropriate safeguard under Applicable Data Protection Laws, using Standard Contractual Clauses adopted by the European Commission or an adequacy decision from the European Commission. The Subscriber hereby authorizes Sana Labs to enter into such standard data protection clauses with sub-processors on behalf of the Subscriber. 7.4 Sana Labs shall closely follow the development regarding the transfer of Personal Data outside the EU/EEA and, to the extent possible, implement any evolved requirements related to the transfer of Personal Data to a sub-processor, including the adoption of additional security measures and the conducting of all required risk assessments of privacy laws in jurisdiction where the sub-sub- processor is located, to ensure that the Services and the use of the Services are compliant with Applicable Data Protection Laws.