Common use of Subprocessors Clause in Contracts

Subprocessors. Findmyshift shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in 3.1 Customer (also on behalf of its Data Controllers) hereby authorizes SAP (also for the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes purpose of Clause 9 11 paragraph 1 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends ) to instruct Subprocessors other than engage subcontractors for the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing processing of Personal Data (email each a “Subprocessor”) to the email address(es) on record in Findmyshift’s account information extent necessary for Customer is sufficient) and will give fulfilling its contractual obligations under the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks Agreement as long as SAP remains responsible for the protection any acts or omissions of its Personal Subprocessors in the same manner as for its own acts and omissions hereunder. SAP shall pass on to Subprocessors SAP's obligation as Data exist at Processor (or Subprocessor) vis-à-vis Customer and the Subprocessor)respective Data Controllers as set out in this Exhibit. It is possible SAP undertakes to have a selection process by which it evaluates the security, privacy and confidentiality practices of a Subprocessor in regard to data handling on a scheduled basis (alternatively, the Subprocessor shall possess a security certification that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services evidences appropriate security measures are in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related place with regard to the Subprocessor’s services to be provided to SAP). 4.7.23.2 SAP will inform Customer upon its request by email about the name, address and role of each Subprocessor it uses to provide the Service. When instructing SAP may remove or appoint suitable and reliable other Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil at its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities own discretion in accordance with this DPA Section 3. SAP will inform Customer by email in advance (except for Emergency Replacements under Section 3.3) of any changes to the list of Subprocessors, which shall be deemed accepted as long as they comply with and are bound by applicable Data Protection LawsLaw or, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor is incorporated outside the EEA, the Standard Contractual Clauses). If Customer has a legitimate reason to object to SAP’s use of a Subprocessor (e.g. if the Subprocessor is located in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing without an adequate level of data protection for personal dataand Customer needs to complete additional formalities as a Data Controller prior to the use of such Subprocessor) Customer shall notify SAP thereof in writing within thirty (30) days after receipt of SAP’s notice. If, in If Customer does not object during such time period the performance of this DPA, Findmyshift transfers any Personal Data new Subprocessor(s) shall be deemed accepted. If Customer objects to a sub- processor located outside the use of the EEASubprocessor concerned SAP shall have the right to cure the objection through one of the following options (to be selected at SAP’s sole discretion): (a) SAP will abort its plans to use the Subprocessor with regard to Personal Data; or (b) SAP will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Subprocessor with regard to Personal Data; or (c) SAP may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve use of the Subprocessor with regard to Personal Data. If none of the above options are reasonably available and the objection has not been cured within thirty (30) days after SAP’s receipt of Customer’s objection, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeeither party may terminate the affected Service with reasonable prior written notice.

Subprocessors. Findmyshift 10.1. Controller authorizes KnowBe4 to appoint (and permit each Subprocessor appointed in accordance with this Section 10 to appoint) Subprocessors in accordance with this Section 10 and any restrictions in the Agreement. 10.2. Notwithstanding anything to the contrary in this DPA or the Agreement, KnowBe4 may continue to use all Subprocessors (including Affiliates) already engaged by KnowBe4 as of the Effective Date, subject to KnowBe4 promptly meeting the obligations set forth in Section 10.4. Customer may request a list of KnowBe4’s current Subprocessors by emailing ▇▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇, provided Customer has executed this DPA or upon the execution of an agreement with KnowBe4 containing obligations of confidentiality. 10.3. KnowBe4 shall be entitled provide reasonable advanced notification to Customer where KnowBe4 wishes to engage Subprocessors a Subprocessor to fulfil Findmyshift’s obligations defined in the Agreement only with process Customer Data and shall provide, upon Customer’s written consent. For these purposesrequest, Customer consents to the engagement as Subprocessors identity and location of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 Subprocessor and a description of the Standard Contractual Clauses. 4.7.1processing to be subcontracted or outsourced to such Subprocessor. If Findmyshift intends Where KnowBe4 wishes to instruct Subprocessors other than appoint a Subprocessor under this DPA, KnowBe4 will select the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) Subprocessor with due diligence and will give verify prior to engaging the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves Subprocessor that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing complying with the level obligations of protection for Personal KnowBe4 towards Customer, to the extent applicable to the Services assigned to that Subprocessor. If, within five (5) days of receipt of such notice, Customer notifies KnowBe4 in writing of any objections (on reasonable grounds) to the proposed appointment, then KnowBe4 shall not appoint (or disclose any Customer Data required to) the proposed Subprocessor until reasonable steps have been taken to address the reasonable objections raised by Customer, and KnowBe4 has been provided a reasonable written explanation of the Agreementsteps taken. 4.7.310.4. Where Findmyshift engages Subprocessors, Findmyshift will KnowBe4 shall enter into a contract with each Subprocessor whereby KnowBe4 shall require the Subprocessor that imposes on the Subprocessor the same to comply with obligations that apply to Findmyshift no less onerous than KnowBe4’s obligations under this DPA. Where KnowBe4 shall ensure the subcontracting agreement with such Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities includes appropriate contractual provisions in accordance with Data Privacy Laws. 10.5. Such subcontracting under this DPA and Data Protection Laws, including to obtain information Section 10 shall not release KnowBe4 from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations its responsibility under the sub- processing contract, where necessary by inspecting Agreement. KnowBe4 shall be responsible for the relevant contract documentswork and activities of all Subprocessors. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift a. Bluecore shall be entitled to not engage third-party Subprocessors to fulfil Findmyshift’s obligations defined in connection with the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors provision of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities except in accordance with this DPA and Data Protection Laws, including Section 6. Any such Subprocessors will be permitted to obtain information Personal Data only to deliver the services Bluecore has retained them to provide, and are prohibited from Findmyshift, upon using Personal Data for any other purpose. Bluecore will have a written request, on the substance of the contract agreement with each Subprocessor and the implementation of the agrees that any agreement with a Subprocessor will include data protection obligations no less protective than those set out in this DPA b. Bluecore shall be liable for the acts and omissions of its Subprocessors and compliance with all the obligations of this DPA by such Subprocessors to the same extent Bluecore would be liable if performing the services of each Subprocessor directly under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance terms of this DPA. To this end, Findmyshift transfers Bluecore will conduct proper due diligence on all Subprocessors to ensure each Subprocess can comply with Data Protection Laws and all applicable terms and conditions of this DPA. c. Customer acknowledges and agrees that Third Party Partners are not Subprocessors and Bluecore assumes no responsibility or liability for the acts or omissions of such Third Party Partners. Subprocessors retained by Bluecore to provide Services for Customer will at all times be deemed Subprocessors of Bluecore and shall not under any circumstance be construed or deemed to be employees or Subprocessors of Customer. d. A list of Bluecore’s authorized Subprocessors is available upon Customer’s request. Bluecore may add additional Subprocessors to this list provided that it gives thirty (30) days’ prior written notification of the identity of the Subprocessor to Customer and Customer does not object to the appointment within that period. In the event Customer objects to a new Subprocessor, Bluecore will use reasonable efforts to make available to Customer a change in the affected Services or recommend a commercially reasonable change to Customer’s use of the affected Services to avoid Processing of Personal Data by the objected- to new Subprocessor without unreasonably burdening Customer. If Bluecore is unable to make available such change within a sub- processor located outside reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the Agreement and applicable SOW(s) in respect to those Services which cannot be provided by Bluecore without the use of the EEAobjected-to new Subprocessor, Findmyshift shallby providing written notice to Bluecore, in advance without Bluecore imposing a penalty for such termination on Customer. Customer shall receive a refund of any such transfer, ensure that a legal mechanism to achieve adequacy prepaid fees for the period following the effective date of termination in respect of that processing is in placesuch terminated Services.

Subprocessors. Findmyshift shall sha l be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing sub-Processing by Findmyshift for purposes of Clause 9 11 of the Standard Contractual Clauses. 4.7.11. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will wil notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficientsu ficient) and will wil give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., e.g. if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that If Findmyshift will not be able and Customer are unable to guarantee continuous delivery of resolve such objection, either party may terminate the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related Agreement by providing written notice to the Subprocessorother party. Customer sha l receive a refund of any prepaid but unused fees for the period fo lowing the e fective date of termination. 4.7.22. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.33. Where Findmyshift engages Subprocessors, Findmyshift will wil enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will wil remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.44. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing sub-Processing contract, where necessary by inspecting the relevant contract documents. 4.7.55. The provisions of this Section 4.6 shall mutually sha l mutua ly apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- sub-processor located outside of the EEA, Findmyshift shallsha l, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled Client provides general authorization to Red Hat to engage and use Subprocessors to fulfil Findmyshift’s its contractual obligations defined in to Client under the Agreement only with Customer’s written consentor to provide certain Online Services on behalf of Red Hat, such as providing hosting and infrastructure services. For these purposes, Customer Client consents to the engagement as Red Hat’s use of Subprocessors for such purposes. A list of the third current applicable Subprocessors is available on the Red Hat Customer Portal (▇▇▇▇▇://▇▇▇.▇▇/subprocessors) or on written request from Client. Red Hat will provide advance notice to Client of any addition or replacement of the Subprocessors by updating the Subprocessor list published on the Red Hat Customer Portal or as otherwise agreed upon by the parties listed in Annex 4writing. For Additionally, Client may subscribe on the avoidance Red Hat Customer Portal to an automatic notification of doubt, the above authorisation constitutes Customer’s prior written consent changes to the sub- processing by Findmyshift for purposes of Clause 9 Subprocessor list. Within thirty (30) days after Red Hat’s notification of the Standard Contractual Clauses. 4.7.1intended change, Client can object to any new Subprocessor on the basis that such addition would cause Client to violate applicable legal requirements. If Findmyshift intends Client objects to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing Red Hat’s use of any new Subprocessor by giving written notice to Red Hat within thirty (email to the email address(es30) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement days of being informed by Red Hat of the appointment of such new Subprocessors within 30 days after being notified. The objection must be based on Subprocessor and Red Hat fails to provide a commercially reasonable grounds (e.g., if alternative to avoid the Customer proves that significant risks for the protection Processing of its Personal Data exist at the Subprocessor). It is possible by such Subprocessor within thirty (30) days of Red Hat’s receipt of Client’s objection, Client may, as its sole and exclusive remedy, terminate any Online Services that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable provided by Red Hat without the use of the objected to new Subprocessor. If Client does not object within such period, the respective Subprocessor may be commissioned to Process Personal Data. Client agrees to treat the list of Subprocessors as Red Hat’s Confidential Information under the terms of the Agreement. Subprocessors are required to abide by the same level of data protection and security as Red Hat under this Addendum as applicable to their Processing of Personal Data and Red Hat will remain responsible to Client for such implementation delays due any acts or omissions of any Subprocessor that cause Red Hat to discussions related to breach any of Red Hat’s obligations under this Addendum. Red Hat will restrict the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4Subprocessors’ access to, and before that Subprocessor first Processes Customer Personal DataProcessing of, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by only to what is necessary to provide products or services to Client in accordance with the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled (▇) ▇▇▇▇▇ authorizes Vendor to engage third party Subprocessors to fulfil Findmyshift’s obligations defined in connection with the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors provision of the third parties listed Services in Annex 4accordance with the terms of this DPA. (b) Vendor will maintain an up-to-date list of its Subprocessors and will make the current list of Subprocessors available to Pasha on request. For Vendor may continue to use those Subprocessors already engaged as of the avoidance date of doubtthis DPA, provided that such Vendor’s use of such Subprocessors complies with the above authorisation constitutes Customer’s provisions of this DPA. (c) Vendor will provide ▇▇▇▇▇ at least 30 days prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 notice of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends appointment of any new Subprocessor, including full details of the processing to instruct Subprocessors other than be undertaken by the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email Subprocessor to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer provide the opportunity for ▇▇▇▇▇ to object to the engagement appointment. If, within ten business days of the receipt of such notice, ▇▇▇▇▇ notifies Vendor in writing of any objections to the proposed appointment, Vendor will work with ▇▇▇▇▇ in good faith to make reasonable efforts to address ▇▇▇▇▇'s objections. If ▇▇▇▇▇'s objections to a new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift Subprocessor cannot be held liable for such implementation delays due addressed, and Vendor cannot change the provision of the Services to discussions related avoid the use of the proposed Subprocessor within ten business days from Vendor’s receipt of ▇▇▇▇▇’s notice, notwithstanding anything in the Agreement, ▇▇▇▇▇ may by written notice to Vendor with immediate effect terminate the Agreement to the extent that it relates to the Services that require the use of the proposed Subprocessor, without further liability to Pasha other than for services provided by Vendor and not paid for by ▇▇▇▇▇ as of the date of such termination. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to (d) Vendor will ensure that each Subprocessor performs the Subprocessor is capable of providing the level of protection for Personal Data obligations required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with terms of this DPA as they apply to the processing of Personal Data undertaken by that Subprocessor as if the Subprocessor that imposes on the Subprocessor the same obligations that apply were a party to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift Vendor will remain be liable to the Customer for the performance acts and omissions of such its Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with under this DPA and Data Protection Laws, including the Agreement to obtain information from Findmyshift, upon written request, on the substance same extent Vendor would be liable if performing the services of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documentseach Subprocessor directly. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift ‌ 8.1 Customer hereby authorizes SmartRecruiters to engage Subprocessors as further specified in Annex 3 – Subprocessors, provided that SmartRecruiters remains responsible for any acts or omissions of its Subprocessors in the same manner as for its own acts and omissions hereunder. 8.2 SmartRecruiters may remove or appoint suitable and reliable o t h e r Subprocessors at its own discretion in accordance with this Section 8.2:‌ (a) S m a r t R e c r u i t e r s shall inform Customer 30 days in advance of any envisaged changes to the list of Subprocessors.‌ (b) If Customer has a legitimate data protection related reason to object to SmartRecruiters’ use of a Subprocessor, Customer shall notify SmartRecruiters within fourteen (14) days after receipt of SmartRecruiters’ notice according to Section (a)8.2(a) above. If Customer does not object during this time period, the new Subprocessor(s) shall be deemed accepted. If Customer objects to the use of the Subprocessor(s) concerned, SmartRecruiters shall have the right to cure the objection through one of the following options (to be selected at SmartRecruiters’ sole discretion): (a) SmartRecruiters will abort its plans to use the Subprocessor with regard to Customer’s Personal Data; or (b) SmartRecruiters will take corrective steps and proceed to use the Subprocessor with regard to Customer’s Personal Data. If SmartRecruiters decides not to implement option (a) or (b) above, SmartRecruiters shall notify Customer without undue delay. In this case Customer shall be entitled within further fourteen (14) days to engage Subprocessors to fulfil Findmyshift’s obligations defined notify in the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors writing SmartRecruiters about its termination of the third parties listed in Annex 4. Main Agreement and any such termination would become effective upon the expiry of the second (2nd) calendar month after SmartRecruiters’ receipt of the termination notice. (c) For the avoidance of doubt, the above authorisation constitutes irrespective of any Customer objection according to lit. (b) above, SmartRecruiters shall be entitled to engage any Subprocessor, it being understood that Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the termination right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including lit. (b) above remains unaffected. 8.3 SmartRecruiters shall pass on to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection it s subcontractors acting as Subprocessors SmartRecruiters’ obligations under the sub- processing contract, where necessary by inspecting the relevant contract documentsthis Data Processing Agreement. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled Customer hereby specifically authorizes the engagement of Supplier’s Affiliates as Subprocessors pursuant to engage Subprocessors to fulfil Findmyshift’s obligations defined in the Agreement only with Customer’s written consentand for the Term. For these purposesIn addition, Customer consents to hereby generally authorizes the engagement of any other third parties as Subprocessors of the third parties (“Third Party Service Provider Subprocessors”), subject to Supplier’s compliance with this Section 22. Customer hereby authorizes all “Subprocessors” listed in Annex 4Appendix 3. For the avoidance of doubtIf Customer has entered into Model Contract Clauses as described in Section 21 (Personal Data Transfer), the above authorisation constitutes authorizations will constitute Customer’s prior written consent to the sub- processing subcontracting by Findmyshift for purposes of Clause 9 Supplier of the Standard Contractual Clauses. 4.7.1Processing of Customer Data if such consent is required under the Model Contract Clauses and Data Protection Legislation and/or Non-European Data Protection Legislation, as applicable. If Findmyshift intends Information about Subprocessors is available in Appendix 3 and may be updated by Supplier from time to instruct Subprocessors other than time in accordance with this DPA. When engaging any Subprocessor, Supplier will: (a) ensure via a written legal instrument or contract that: (i) the companies Subprocessor only accesses and processes Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including this DPA) and any Model Contract Clauses entered into as described in Section 10.2 (Transfers of Data Out of the EEA), as applicable; and (ii) if the GDPR applies to the Processing of Customer Personal Data, the data protection obligations set out in Article 28(3) of the GDPR, as described in this DPA, are mandated by said legal instrument or contract on the Subprocessor; and (b) remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor. When any Third-Party Subprocessor not listed in Annex 4Appendix 3 at the Agreement Effective Date is engaged during the Term, Findmyshift Supplier will, at least 30 days before the new Third-Party Subprocessor processes any Customer Data, inform Customer of the engagement (including the name and location of the relevant Third-Party Subprocessor and the activities it will notify the Customer thereof in writing (perform) by sending an email to the email address(es) on record in Findmyshift’s account information for Notification Email Address. Customer is sufficient) and will give the Customer the opportunity to may object to any new Third-Party Subprocessor by terminating the Agreement immediately upon written notice to Supplier, provided that Customer sends such notice within 90 days of being informed of the engagement of the Third-Party Subprocessor. This termination right is Customer’s sole and exclusive remedy if Customer objects to any new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Third-Party Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled Customer hereby authorizes CCH to engage appoint Subprocessors in accordance with this Section 7, subject to fulfil Findmyshift’s obligations defined any restrictions in the Agreement only Agreement. CCH will bind Subprocessors with Customer’s written consent. For these purposes, Customer consents agreements that require them to provide at least the level of data protection required of CCH by this Addendum relative to the Subprocessor’s activities relating to the Services. Customer authorizes CCH’s engagement as Subprocessors of CCH’s Affiliates, and the third parties party(ies) listed in Annex 41, as Subprocessors. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift In case CCH intends to instruct Subprocessors other than the companies listed in Annex 4engage new or additional Subprocessors, Findmyshift CCH will notify the inform Customer thereof in writing (which may be by email or other Product‐enabled notification to Customer’s Product Administrator) of such additions or replacements (the email address(es) on record in Findmyshift’s account information for “Subprocessor Notice”). If Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on has reasonable grounds (e.g., if the Customer proves proving that significant risks for the protection of its Customer Personal Data exist at with such new or additional Subprocessor(s), Customer will notify CCH in writing within 30 days of the Subprocessordate of the Subprocessor Notice, detailing the basis for the objection. CCH will work with Customer in good faith to make available a commercially reasonable change in the provision of the Services or recommend a commercially reasonable change to such Customer’s configuration or use of the Services to avoid processing of Customer Personal Data by the objected‐to new or additional Subprocessor(s) without unreasonably burdening Customer, in either case which avoids the use of the Subprocessor(s). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding Where such a Subprocessor, and Findmyshift change cannot be held liable for such implementation delays due made within 90 days from CCH’s receipt of Customer’s objection notice, notwithstanding anything in the Agreement, Customer, may, as its sole remedy, by written notice to discussions related CCH with immediate effect terminate that portion of the Agreement that relates to the Subprocessor. 4.7.2Services that require the use of such new or additional Processor. When instructing CCH shall be responsible for the acts and omissions of any Subprocessors other than the companies listed as it is to Customer for its own acts and omissions in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable relation to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities matters provided in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5Addendum. The provisions of this Section 4.6 7 shall mutually not apply if Findmyshift engages to the extent Customer instructs CCH to allow a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any third party to Process Customer Personal Data pursuant to a sub- processor located outside of contract that Customer has directly with the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placethird party.

Subprocessors. Findmyshift ‌ a. Juniper grants its general advance written permission for Supplier to delegate Processing to other processors (“Subprocessors”). Supplier shall provide Juniper a list of its Subprocessors upon request or provide Juniper with a link to a published list of Subprocessors. Supplier shall impose on any Subprocessors contractual obligations no less stringent than the requirements applicable to Supplier under the Contract and this DPA as well as any terms required to be included under applicable Data Protection Requirements, and if Subprocessors further delegate their own obligations to additional third parties, Supplier shall require its Subprocessors to impose the same restrictions on such third parties. Upon ▇▇▇▇▇▇▇’s written request, Supplier shall promptly provide to Juniper copies of the data protection, data privacy, and information security terms it has in place with its Subprocessors, provided Supplier may redact confidential terms unrelated to the foregoing. Third parties engaged by Supplier shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in deemed the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of Supplier and shall not be the third parties listed in Annex 4employees, contractors, or Subprocessors of Juniper. For Supplier shall be fully liable for the avoidance actions of doubtits Subprocessors as if performed by Supplier itself.‌ b. To the extent required under applicable Data Protection Requirements, Supplier shall inform Juniper of any intended changes concerning the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes addition or replacement of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4any Subprocessors, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer Juniper shall have the opportunity to object to any such Subprocessors. If the engagement of the new Subprocessors within 30 days after being notified. The Parties are unable to resolve an objection must be based on a reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure belief that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract would be unable to comply with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance requirements of this DPA, Findmyshift transfers any Personal Data to Juniper may terminate the Contract and receive a sub- processor located outside of the EEA, Findmyshift shall, in advance refund of any such transferunused prepaid fees and shall be entitled to any other rights it has under the Contract. c. Notwithstanding the provisions of Section 5(a), ensure prior express written approval of Juniper is required for any Subprocessors that a legal mechanism are (a) banned from providing products or services to achieve adequacy the United States government or any other government in respect the applicable territory covered by the Contract or (b) listed on the United States Department of that processing is in placeThe Treasury SDN List available at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/resource- center/sanctions/SDN-List/Pages/default.aspx.

Subprocessors. Findmyshift a. You consent and authorize BMS to continue to use the Subprocessors already engaged by BMS as of the date of this DPA. Those Subprocessors are listed in Schedule 2 of this DPA. b. BMS agree to respect the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another Processor, namely that BMS may not engage another Subprocessor to process Customer Personal Data without your prior authorization. BMS agrees to send via e- mails prior written notice of its intent to appoint any new Subprocessor with full details of the Processing to be undertaken by the Subprocessor. If within 10 days of receipt of each such notice, you do not explicitly notify BMS in writing of any objections (on reasonable grounds) to the proposed appointment, it shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in the Agreement only with Customer’s written consent. For these purposes, Customer consents deemed that you have consented to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1proposed appointment. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to you object to the engagement use of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, BMS shall have the right, at its discretion, to cure the objection through one of the following options: (i) BMS will cease to use the Subprocessor with regard to Personal Data, (ii) BMS will take the corrective steps requested by you in your objection and Findmyshift canproceed to use the Subprocessor to process Personal Data; or (iii) BMS may cease to provide or you may agree not be held liable for such implementation delays due to discussions related use (temporarily or permanently) the Services that would involve use of the Subprocessor to the Subprocessorprocess Personal Data. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that c. Before a Subprocessor first Processes can processes Customer Personal Data, Findmyshift agrees to BMS will carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Customer Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and applicable Data Protection Laws, ; and ensure that the arrangement is governed by a written contract including to obtain information from Findmyshift, upon written request, on terms which offer at least the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate same level of protection for personal data. If, Customer Personal Data as those set out in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside and that such terms meet the requirements of Article 28(3) of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeGDPR.

Subprocessors. Findmyshift shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in 3.1 Customer (also on behalf of its Data Controllers) hereby authorizes SAP (also for the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes purpose of Clause 9 11 paragraph 1 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends ) to instruct Subprocessors other than engage subcontractors for the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing processing of Personal Data (email each a “Subprocessor”) to the email address(es) on record in Findmyshift’s account information extent necessary for Customer is sufficient) and will give fulfilling its contractual obligations under the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks Agreement as long as SAP remains responsible for the protection any acts or omissions of its Personal Subprocessors in the same manner as for its own acts and omissions hereunder. SAP shall pass on to Subprocessors SAP's obligation as Data exist at Processor (or Subprocessor) vis-à-vis Customer and the Subprocessor)respective Data Controllers as set out in this Exhibit. It is possible SAP undertakes to have a selection process by which it evaluates the security, privacy and confidentiality practices of a Subprocessor in regard to data handling on a scheduled basis (alternatively, the Subprocessor shall possess a security certification that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services evidences appropriate security measures are in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related place with regard to the Subprocessor’s services to be provided to SAP). 4.7.23.2 SAP will inform Customer upon its request by email about the name, address and role of each Subprocessor it uses to provide the Service. When instructing SAP may remove or appoint suitable and reliable other Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil at its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities own discretion in accordance with this DPA Section 3. SAP will inform Customer by email in advance (except for Emergency Replacements under Section 3.3) of any changes to the list of Subprocessors, which shall be deemed accepted as long as they comply with and are bound by applicable Data Protection LawsLaw or, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor is incorporated outside the EEA, the Standard Contractual Clauses. If Customer has a legitimate reason to object to SAP’s use of a Subprocessor (e.g. if the Subprocessor is located in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing without an adequate level of data protection for personal dataand Customer needs to complete additional formalities as a Data Controller prior to the use of such Subprocessor) Customer shall notify SAP thereof in writing within thirty (30) days after receipt of SAP’s notice. If, in If Customer does not object during such time period the performance of this DPA, Findmyshift transfers any Personal Data new Subprocessor(s) shall be deemed accepted. If Customer objects to a sub- processor located outside the use of the EEASubprocessor concerned SAP shall have the right to cure the objection through one of the following options (to be selected at SAP’s sole discretion): (a) SAP will abort its plans to use the Subprocessor with regard to Personal Data; or (b) SAP will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Subprocessor with regard to Personal Data; or (c) SAP may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve use of the Subprocessor with regard to Personal Data. If none of the above options are reasonably available and the objection has not been cured within thirty (30) days after SAP’s receipt of Customer’s objection, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeeither party may terminate the affected Service with reasonable prior written notice.

Subprocessors. Findmyshift shall be entitled to engage Subprocessors to fulfil Findmyshift6.1. Customer authorizes Datadog’s obligations defined in the Agreement only with Customeruse of Datadog’s written consent. For these purposes, Customer consents to the engagement Affiliates as Subprocessors and both Datadog’s and its Affiliates’ use of third-party Subprocessors in connection with the third parties listed in Annex 4provision of Services. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent As a condition to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends permitting a Subprocessor to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Process Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift Datadog or a Datadog Affiliate will enter into a contract written agreement with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its containing data protection obligationsobligations no less protective than those in this DPA with respect to Customer Personal Data. Datadog will restrict its Subprocessors’ access to only what is necessary to maintain the Services or to provide the Services to Customer and Authorized Users. Subject to this Section 6, Findmyshift will Datadog reserves the right to engage and substitute Subprocessors as it deems appropriate, but shall: (a) remain liable responsible to the Customer for the provision of the Services and (b) be liable for the actions and omissions of its Subprocessors undertaken in connection with Datadog’s performance of such Subprocessors obligationsthis DPA to the same extent Datadog would be liable if performing the Services directly. 4.7.46.2. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the SubprocessorDatadog’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, current Subprocessors are listed in the performance Subprocessor List. Upon execution of this DPA, Findmyshift transfers Datadog will subscribe Customer’s email address listed on the signature page of this DPA to notifications of Datadog’s use of new Subprocessors (“Change Notices”). Datadog will send a Change Notice before a new Subprocessor Processes any Customer Personal Data. Customer may object to any new Subprocessor on reasonable grounds relating to the protection of the Customer Personal Data, in which case Datadog shall have the right to satisfy the objection through one of the following: (a) Datadog will cancel its plans to use the Subprocessor with regard to Customer Personal Data or will offer an alternative to provide the Services without such Subprocessor; (b) Datadog will take the corrective steps requested by Customer in its Objection Notice (which remove Customer’s objection) and proceed to use the Subprocessor with regard to Customer Personal Data; or (c) Datadog may cease to provide, or Customer may agree not to use (temporarily or permanently), the particular aspect of the Services that would involve the use of such Subprocessor with regard to Personal Data, subject to a sub- processor located outside mutual agreement of the EEAParties to adjust the remuneration for the Services considering their reduced scope. 6.3. All objections under Section 6.2 must be submitted by email to Datadog at ▇▇▇▇@▇▇▇▇▇▇▇▇▇.▇▇▇ within 14 days of the Change Notice (each, Findmyshift shallan “Objection Notice”). If none of the options outlined in Clause (a), in advance (b) or (c) of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.Section

Subprocessors. Findmyshift Customer authorizes Idera to appoint (and permitted each Subprocessor appointed in accordance with this paragraph (e) to appoint) Subprocessors in accordance with this paragraph (e). Idera may continue to use those Subprocessors already engaged by ▇▇▇▇▇ as of the date of the Main Agreement, subject to Idera meeting the obligations set out this paragraph (e) of this DPA. Idera’s Subprocessors are listed on the Idera Affiliates Processing Terms. Idera shall be entitled maintain an updated the list of Subprocessors. Idera shall provide Customer prior written notice of the appointment of any new Subprocessor. Customer agrees that Idera may provide such written notice by offering Customers a mechanism to engage Subprocessors subscribe to fulfil Findmyshift’s obligations defined updates to the list of Idera Subprocessors. If, within ten (10) days of posting of each such update , Customer notifies Idera in writing of any reasonable objections to the proposed appointment by contacting ▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇.▇▇▇, Customer may, as a sole and exclusive remedy, immediately terminate the applicable Main Agreement and this DPA only with Customer’s written consent. For these purposes, Customer consents respect to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription those Services in case of disagreements regarding a Subprocessor, and Findmyshift which cannot be held liable for such implementation delays due provided by Idera without the use of the objected-to discussions related Subprocessor. Customer may terminate the Main Agreement by providing written notice to Idera pursuant to the Subprocessor. 4.7.2. When instructing Subprocessors other than terms of the companies listed in Annex 4, and Main Agreement provided that all amounts due under the Main Agreement(s) before that Subprocessor first Processes the termination date with respect to the Processing of Customer Personal DataData are duly paid to Idera. Idera shall remain responsible for the Processing of the Customer Personal Data until the termination or expiration of the Main Agreement. With respect to each Subprocessor, Findmyshift agrees to Idera shall: (a) carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection and security for Customer Personal Data required by this DPA, the Main Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with and Applicable Laws before the Subprocessor that imposes first Processes Customer Personal Data impose on the Subprocessor terms between Idera and the prospective Subprocessor that provide for at least the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, Customer Personal Data as those set out in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift 10.1. Controller authorizes Service Provider to appoint (and permit each Subprocessor appointed in accordance with this Section 10 to appoint) Subprocessors in accordance with this Section 10 and any restrictions in the Terms of Service. 10.2. Notwithstanding anything to the contrary in this Data Processing Agreement or the Terms of Service, Service Provider may continue to use all Subprocessors (including Affiliates) already engaged by Service Provider as of the Effective Date, subject to Service Provider promptly meeting the obligations set forth in Section 10.4. 10.3. Service Provider shall be entitled provide reasonable advanced notification to Customer where Service Provider wishes to engage Subprocessors a Subprocessor to fulfil Findmyshift’s obligations defined in the Agreement only with process Customer Data and shall provide, upon Customer’s written consent. For these purposesrequest, Customer consents to the engagement as Subprocessors identity and location of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 Subprocessor and a description of the Standard Contractual Clauses. 4.7.1processing to be subcontracted or outsourced to such Subprocessor. If Findmyshift intends Where Service Provider wishes to instruct Subprocessors other than appoint a Subprocessor under this Data Processing Agreement, Service Provider will select the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) Subprocessor with due diligence and will give verify prior to engaging the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves Subprocessor that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing complying with the level obligations of protection for Personal the Service Provider towards Customer, to the extent applicable to the services assigned to that Subprocessor. If, within five (5) days of receipt of such notice, Customer notifies Service Provider in writing of any objections (on reasonable grounds) to the proposed appointment, then Service Provider shall not appoint (or disclose any Customer Data required to) the proposed Subprocessor until reasonable steps have been taken to address the reasonable objections raised by Customer, and Customer has been provided with a reasonable written explanation of the Agreementsteps taken. 4.7.310.4. Where Findmyshift engages Subprocessors, Findmyshift will The Service Provider shall enter into a contract with each Subprocessor whereby the Service Provider shall require the Subprocessor that imposes on to comply with obligations no less onerous than the Subprocessor the same Service Provider’s obligations that apply to Findmyshift under this DPAData Processing Agreement. Where Service Provider shall ensure the subcontracting agreement with such Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities includes appropriate contractual provisions in accordance with Data Privacy Laws. 10.5. Such subcontracting under this DPA and Data Protection Laws, including to obtain information Section 10 shall not release the Service Provider from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection their responsibility for their obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5Terms of Service. The provisions Service Provider shall be responsible for the work and activities of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeall Subprocessors.

Subprocessors. Findmyshift shall Customer acknowledges and agrees that Rubrik may retain its Affiliates and third parties as Subprocessors in connection with the provision of the Services. Rubrik maintains a current list of Subprocessors required to provide its Products and Services, which can be entitled found at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇/en/legal/rubrik- subprocessors. Rubrik will only appoint any new Subprocessors pursuant to engage Subprocessors to fulfil Findmyshift’s obligations defined in Article 28(2) of the Agreement only with Customer’s written consentGDPR. For these purposesAt the web link set forth above, Customer consents may also find a mechanism to subscribe to notifications of new Subprocessors for each applicable Service, and if Customer subscribes, Rubrik shall provide notification of a new Subprocessor(s) before authorizing any new Subprocessor(s) to process Customer Personal Data in connection with the engagement as Subprocessors provision of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1applicable Service. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to does not object to the engagement appointment of the any new Subprocessors within 30 days after being notifiednotification of such appointment by Rubrik, Customer will be deemed as having provided its consent to the new appointment. The objection must be based on Should Customer object (acting reasonably) to a new Subprocessor, upon prior written notice, Rubrik will use reasonable grounds (e.g., if efforts to make available to Customer a change in the Service or recommend a commercially reasonable change to Customer’s configuration or use of the Service to avoid Processing of Customer proves that significant risks for the protection of its Personal Data exist at by the Subprocessor)objected-to new Subprocessor without unreasonably burdening Customer. It If Rubrik is possible unable to make available such change within a reasonable time period, which shall not exceed thirty (30) days, Customer may terminate the Agreement with respect to those specific Services that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for provided without the objected- to new Subprocessor. Such termination right is Customer’s sole and exclusive remedy with respect to such implementation delays due objection. Rubrik undertakes to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract written agreement with any applicable Subprocessors in accordance with the Subprocessor that imposes on the Subprocessor the same requirements under Data Protection Laws and such obligations that apply to Findmyshift under will in no event be less protective than this DPA. Where Rubrik will restrict the Subprocessor fails Subprocessors' access to fulfil its data protection obligations, Findmyshift only what is necessary to provide or maintain the Products and Services. Rubrik will remain liable to responsible for its compliance with the Customer for the performance obligations of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance for any acts or omissions of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documentsSubprocessors. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

Subprocessors. Findmyshift shall be entitled Partner hereby authorizes the use of Subprocessor(s) engaged by WKH for the provision of the Services. Partner approves the WKH Subprocessors set forth here: ▇▇▇▇▇://▇▇▇.▇▇▇/Pages/subprocessors.aspx. In case WKH intends to engage new or additional Subprocessors, WKH will inform Partner of such addition or replacement of Subprocessors to fulfil Findmyshift’s obligations defined in (the Agreement only with Customer’s written consent. For these purposes“Subprocessor Notice”), Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing which Subprocessor Notice may be by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in FindmyshiftWKH’s account information for Customer is sufficient) and will give the Customer the opportunity Partner. If Partner has a reasonable basis to object to the engagement use of the any such new or additional Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves because Partner is able to prove that significant risks for the protection of its Partner Personal Data exist at with such Subprocessors, Partner will notify WKH in writing within 30 days of the date of the Subprocessor Notice, detailing the basis for such objection. WKH will work with Partner in good faith to make available a commercially reasonable change in the provision of the Services or recommend a commercially reasonable change to such Partner’s configuration or use of the Services to avoid processing of Partner Personal Data by the objected-to new or additional Subprocessor without unreasonably burdening Partner, in either case which avoids the use of the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding Where such a Subprocessor, and Findmyshift change cannot be held liable for such implementation delays due made within 90 days from WKH’s receipt of Partner’s objection notice, notwithstanding anything in the Agreement, Partner, may, as its sole remedy, by written notice to discussions related WKH with immediate effect terminate that portion of the Agreement that relates to the Subprocessor. 4.7.2Services that require the use of such new or additional Subprocessors. When instructing WKH will bind Subprocessors other than the companies listed in Annex 4, and before with written agreements that Subprocessor first Processes Customer Personal Data, Findmyshift agrees require them to carry out adequate due diligence to ensure that the Subprocessor is capable of providing provide at least the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable required of WKH by this Addendum relative to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities relating to the Services. WKH shall be responsible for the acts and omissions of any Subprocessors as it is to Partner for its own acts and omissions in accordance with relation to the matters provided in this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5Addendum. The provisions of this Section 4.6 7 shall mutually not apply if Findmyshift engages to the extent Partner instructs WKH to allow a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any third party to process Partner Personal Data pursuant to a sub- processor located outside of contract that Partner has directly with the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placethird party.

Subprocessors. Findmyshift 3.1. Customer (also on behalf of its Data Controllers) hereby authorizes Resolve Systems (also for the purpose of Clause 11 paragraph 1 of this Exhibit) to engage subcontractors for the processing of Personal Data (each a “Subprocessor”) to the extent necessary for fulfilling its contractual obligations under the Agreement as long as Resolve Systems remains responsible for any acts or omissions of its Subprocessors in the same manner as for its own acts and omissions hereunder. Resolve Systems shall pass on to Subprocessors Resolve Systems’ obligation as Data Processor (or Subprocessor) vis-a-vis Customer and the respective Data Controllers as set out in this Exhibit. Resolve Systems undertakes to have a selection process by which it evaluates the security, privacy and confidentiality practices of a Subprocessor in regard to data handling on a scheduled basis (alternatively, the Subprocessor shall possess a security certification that evidences appropriate security measures are in place with regard to the Subprocessor's services to be provided to Resolve Systems). 3.2. Resolve Systems will inform Customer upon its request by email about the name, address and role of each Subprocessor it uses to provide the Service. Resolve Systems may remove or appoint suitable and reliable other Subprocessors at its own discretion in accordance with this Section 3. Resolve Systems will inform Customer by email in advance (except for Emergency Replacements under Section 3.3) of any changes to the list of Subprocessors, which shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in deemed accepted as long as they comply with and are bound by applicable Data Protection Law or, if a Subprocessor is incorporated outside the Agreement only with Customer’s written consent. For these purposesEEA, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity has a legitimate reason to object to the engagement Resolve Systems’ use of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds a Subprocessor (e.g., e.g. if the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor located in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing without an adequate level of data protection for personal dataand Customer needs to complete additional formalities as a Data Controller prior to the use of such Subprocessor) Customer shall notify Resolve Systems thereof in writing within thirty (30) days after receipt of Resolve Systems’ notice. If, in If Customer does not object during such time period the performance of this DPA, Findmyshift transfers any Personal Data new Subprocessor(s) shall be deemed accepted. If Customer objects to a sub- processor located outside the use of the EEASubprocessor concerned Resolve Systems shall have the right to cure the objection through one of the following options (to be selected at Resolve Systems’ sole discretion): (a) Resolve Systems will abort its plans to use the Subprocessor with regard to Personal Data; or (b) Resolve Systems will take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the Subprocessor with regard to Personal Data; or (c) Resolve Systems may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve use of the Subprocessor with regard to Personal Data. If none of the above options are reasonably available and the objection has not been cured within thirty (30) days after Resolve Systems’ receipt of Customer's objection, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeeither party may terminate the affected Service with reasonable prior written notice.

Subprocessors. Findmyshift shall be entitled to engage Subprocessors to fulfil Findmyshift’s obligations defined in the Agreement only with Customer’s written consent. For these purposes, Customer consents to the engagement as Subprocessors of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift a) Provider has Innomotics’ general authorization for purposes of Clause 9 of the Standard Contractual Clauses. 4.7.1. If Findmyshift intends to instruct Subprocessors other than the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of Subprocessors. A current list of Subprocessors commissioned by Provider is contained in ▇▇▇▇▇ ▇▇▇. b) The Provider shall specifically inform Innomotics in writing of any intended changes to that list through the addition or replacement of Subprocessors at least 30 days in advance. Provider shall provide Innomotics with the information necessary to enable Innomotics to exercise the right to object. If Innomotics raises no objections within this 30-day period, then this shall be taken as an approval of the new Subprocessors within 30 days after being notifiedSubprocessor. The objection must be based on If Innomotics raises objections, Provider will - before authorizing the Sub- processor to access Personal Data - use reasonable efforts to address the concerns and reservations expressed by Innomotics and (i) refrain from using the Subprocessor or (ii) propose to Innomotics a reasonable change in the Services or Innomotics’ configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Subprocessor. If Provider is unable to eliminate the grounds (e.g., if the Customer proves that significant risks for the protection objection by Innomotics, Innomotics is entitled to terminate the affected Services without any damages or penalties. In the event of its Personal Data exist at termination by Innomotics, Provider will refund any prepaid amounts for the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding applicable Service on a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessorpro-rata basis. 4.7.2c) Where the Provider engages a Subprocessor to carry out specific processing activities (on behalf of Innomotics and/or Authorized Entities), it shall do so by way of a written contract that provides for, in substance, the same data protection obli- gations as those binding the Provider under this DPA. d) Provider shall provide, at Innomotics’ request, a copy of such a Subprocessor contract and any subsequent amendments to Innomotics. When instructing Subprocessors To the extent necessary to protect business secrets or other than the companies listed in Annex 4confidential information, and before that Subprocessor first Processes Customer including Personal Data, Findmyshift agrees Provider may redact the text of the contract prior to carry out adequate due diligence to ensure that sharing a copy. e) Provider shall adequately and regularly audit the Subprocessor is capable with respect to compliance with these requirements and document the results of providing the level of protection for Personal Data required by the Agreementsuch audits. 4.7.3. Where Findmyshift engages Subprocessors, Findmyshift will enter into a contract with the Subprocessor that imposes on the Subprocessor the same obligations that apply f) Provider shall remain fully responsible to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer Innomotics for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under its con- tract with the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5Provider. The provisions Provider shall immediately inform Innomotics of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised any failure by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data Subprocessor to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure fulfil its obligations under that a legal mechanism to achieve adequacy in respect of that processing is in placecontract.

Subprocessors. Findmyshift shall be entitled to engage Subprocessors 1. Customer agrees that Civic may use sub-processors to fulfil Findmyshift’s its contractual obligations defined under the Agreement. Where Civic authorizes any sub-processor as described in this Section 4, Civic agrees to impose data protection terms on any sub-processor it appoints that require it to protect the Agreement only with Customer’s written consent. For these purposes, Customer consents Personal Data to the engagement standard required by applicable Data Protection Laws, such as Subprocessors including the same data protection obligations referred to in Article 28(3) of the third parties listed GDPR, in Annex 4. For particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the avoidance of doubt, processing will meet the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 requirements of the Standard Contractual ClausesData Protection Laws. 4.7.12. If Findmyshift intends Civic shall make available to instruct Subprocessors other than Customer the companies listed current list of sub-processors utilised, in Annex 4, Findmyshift Appendix 2 . Civic may continue to use those Sub-processors already engaged as at the date of this DPA. 3. Civic will notify the Customer thereof of new sub-processors by email. If, within a reasonable time specified in the notice, Customer notifies Civic in writing (email of any objections to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) and will give the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be proposed appointment based on reasonable grounds (e.g., if relating to data protection: Civic shall work with Customer in good faith to make available a commercially reasonable change in the Customer proves that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery provision of the Subscription Services in case which avoids the use of disagreements regarding that proposed sub-processor. Where such a Subprocessor, and Findmyshift change cannot be held liable for such implementation delays due made, notwithstanding anything in the Terms, Customer may by written notice to discussions related Civic with immediate effect terminate the relationship. Such termination is without prejudice to any fees incurred by Customer prior to the Subprocessortermination. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Personal Data required by the Agreement. 4.7.3. Where Findmyshift engages SubprocessorsCivic utilises sub-processors, Findmyshift will enter into a contract with Civic shall remain the Subprocessor that imposes on Customer's sole point of contact for all matters falling within the Subprocessor the same obligations that apply to Findmyshift under this DPA. Where the Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities in accordance with this DPA and Data Protection Laws, including to obtain information from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5. The provisions of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance scope of this DPA, Findmyshift transfers any and shall procure that its sub-processor complies with and is bound by the requirements of this DPA as they apply to Civic. 5. Civic shall procure that all sub-processors used by it in the provision of the Services from time to time under this Agreement execute a confidentiality undertaking on terms that are substantially the same as (and no less onerous than) those set out in this DPA. 6. The Subprocessors listed in Appendix 2 of the DPA are approved for processing of Personal Data to a sub- processor located outside of under the EEA, Findmyshift shall, circumstances specified in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placethis DPA.

Subprocessors. Findmyshift 10.1. Controller authorizes Service Provider to appoint (and permit each Subprocessor appointed in accordance with this Section 10 to appoint) Subprocessors in accordance with this Section 10 and any restrictions in the Services Agreement. 10.2. Notwithstanding anything to the contrary in this Data Processing Agreement or the Services Agreement, Service Provider may continue to use all Subprocessors (including Affiliates) already engaged by Service Provider as of the Effective Date, subject to Service Provider promptly meeting the obligations set forth in Section 10.4. 10.3. Service Provider shall be entitled provide reasonable advanced notification to Customer where Service Provider wishes to engage Subprocessors a Subprocessor to fulfil Findmyshift’s obligations defined in the Agreement only with process Customer Data and shall provide, upon Customer’s written consent. For these purposesrequest, Customer consents to the engagement as Subprocessors identity and location of the third parties listed in Annex 4. For the avoidance of doubt, the above authorisation constitutes Customer’s prior written consent to the sub- processing by Findmyshift for purposes of Clause 9 Subprocessor and a description of the Standard Contractual Clauses. 4.7.1processing to be subcontracted or outsourced to such Subprocessor. If Findmyshift intends Where Service Provider wishes to instruct Subprocessors other than appoint a Subprocessor under this Data Processing Agreement, Service Provider will select the companies listed in Annex 4, Findmyshift will notify the Customer thereof in writing (email to the email address(es) on record in Findmyshift’s account information for Customer is sufficient) Subprocessor with due diligence and will give verify prior to engaging the Customer the opportunity to object to the engagement of the new Subprocessors within 30 days after being notified. The objection must be based on reasonable grounds (e.g., if the Customer proves Subprocessor that significant risks for the protection of its Personal Data exist at the Subprocessor). It is possible that Findmyshift will not be able to guarantee continuous delivery of the Subscription Services in case of disagreements regarding a Subprocessor, and Findmyshift cannot be held liable for such implementation delays due to discussions related to the Subprocessor. 4.7.2. When instructing Subprocessors other than the companies listed in Annex 4, and before that Subprocessor first Processes Customer Personal Data, Findmyshift agrees to carry out adequate due diligence to ensure that the Subprocessor is capable of providing complying with the level obligations of protection for Personal the Service Provider towards Customer, to the extent applicable to the Services assigned to that Subprocessor. If, within five (5) days of receipt of such notice, Customer notifies Service Provider in writing of any objections (on reasonable grounds) to the proposed appointment, then Service Provider shall not appoint (or disclose any Customer Data required to) the proposed Subprocessor until reasonable steps have been taken to address the reasonable objections raised by Customer, and Customer has been provided with a reasonable written explanation of the Agreementsteps taken. 4.7.310.4. Where Findmyshift engages Subprocessors, Findmyshift will The Service Provider shall enter into a contract with each Subprocessor whereby the Service Provider shall require the Subprocessor that imposes on to comply with obligations no less onerous than the Subprocessor the same Service Provider’s obligations that apply to Findmyshift under this DPAData Processing Agreement. Where Service Provider shall ensure the subcontracting agreement with such Subprocessor fails to fulfil its data protection obligations, Findmyshift will remain liable to the Customer for the performance of such Subprocessors obligations. 4.7.4. Where a Subprocessor is engaged, the Customer must be granted the right to monitor and inspect the Subprocessor’s activities includes appropriate contractual provisions in accordance with Data Privacy Laws. 10.5. Such subcontracting under this DPA and Data Protection Laws, including to obtain information Section 10 shall not release the Service Provider from Findmyshift, upon written request, on the substance of the contract and the implementation of the data protection their responsibility for their obligations under the sub- processing contract, where necessary by inspecting the relevant contract documents. 4.7.5Services Agreement. The provisions Service Provider shall be responsible for the work and activities of this Section 4.6 shall mutually apply if Findmyshift engages a Subprocessor in a country outside the European Economic Area (“EEA”) not recognised by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Findmyshift transfers any Personal Data to a sub- processor located outside of the EEA, Findmyshift shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in placeall Subprocessors.