Common use of Transfer mechanisms for data transfers Clause in Contracts

Transfer mechanisms for data transfers. (A) HubSpot shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that for the purposes of the Standard Contractual Clauses, (i) HubSpot, Inc. will be the "data importer" and Customer will be the "data exporter" (on behalf of itself and Permitted Affiliates); (ii) the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iv) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (Aa) HubSpot Workzoom shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (Bb) You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. Workzoom is a recipient of European Data in the United StatesCanada. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (Cc) The parties agree that for the purposes of the Standard Contractual Clauses, (i) HubSpot, Inc. Workzoom will be the "data importer" and Customer Client will be the "data exporter" (on behalf of itself and Permitted Affiliates); (ii) the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iv) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (Dd) To the extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (Ee) If for any reason HubSpot Workzoom cannot comply with its obligations under the Standard Contractual Clauses or is in breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot Workzoom or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot Acalvio shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge Customer acknowledges that in connection with the performance of the Subscription ServicesShadowPlex deployment, HubSpot, Inc. Acalvio is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree Acalvio agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. Acalvio does not rely on the EU-US ACALVIO Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. Acalvio is self-certified to the Privacy Shield HubSpot Inc Acalvio will process European Data in compliance with the Privacy Shield Principles and let you Customer know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpot, Inc. Acalvio will be deemed the "data importer" and Customer will be deemed the "data exporter" (notwithstanding that Customer may yourself be located outside Europe and/or be acting as a processor on behalf of itself and Permitted Affiliatesthird party controllers); , (ii) notwithstanding the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) foregoing, where the HubSpot Acalvio contracting entity under the Agreement is not HubSpotAcalvio, Inc.Customer provides such contracting entity with a mandate to enter into the Standard Contractual Clauses with Acalvio in its name and on its behalf, such contracting entity (not HubSpot, Inc.Acalvio ) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you Customer for the performance of the Standard Contractual Clauses by HubSpot, Inc.Acalvio , and you Customer will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data DocuSign Envelope ID: 8FA8B10C-C4DE-427D-9466-DBB9ACDC5D06 Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree HubSpot, Inc. agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpot, Inc. will be deemed the "data importer" and Customer will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of itself and Permitted Affiliatesthird party controllers); , (ii) notwithstanding the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) foregoing, where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., You provide such contracting entity with a mandate to enter into the Standard Contractual Clauses with HubSpot, Inc. in its name and on its behalf, such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot DealRoom shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpotDealRoom, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree DealRoom, Inc. agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpotDealRoom, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpotDealRoom, Inc. is self-certified to the Privacy Shield HubSpot DealRoom Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpotDealRoom, Inc. will be deemed the "data importer" and Customer Client will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of itself and Permitted Affiliatesthird party controllers); , (ii) notwithstanding the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) foregoing, where the HubSpot DealRoom contracting entity under the Agreement is not HubSpotDealRoom, Inc., You provide such contracting entity with a mandate to enter into the Standard Contractual Clauses with DealRoom, Inc. in its name and on its behalf, such contracting entity (not HubSpotDealRoom, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpotDealRoom, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot Raindrop shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpotRaindrop Systems, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree Raindrop Systems, Inc. agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpotRaindrop Systems, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpotRaindrop Systems, Inc. is self-certified to the Privacy Shield HubSpot Raindrop Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpotRaindrop Systems, Inc. will be deemed the "data importer" and Customer will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of itself and Permitted Affiliatesthird party controllers); , (ii) notwithstanding the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) foregoing, where the HubSpot Raindrop contracting entity under the Agreement is not HubSpotRaindrop Systems, Inc., You provide such contracting entity with a mandate to enter into the Standard Contractual Clauses with Raindrop Systems, Inc. in its name and on its behalf, such contracting entity (not HubSpotRaindrop Systems, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpotRaindrop Systems, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data DocuSign Envelope ID: A449B22A-B813-4D13-AC41-663047786B38 DocuSign Envelope ID: 8FA8B10C-C4DE-427D-9466-DBB9ACDC5D06 Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree HubSpot, Inc. agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpot, Inc. will be deemed the "data importer" and Customer will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of itself and Permitted Affiliatesthird party controllers); , (ii) notwithstanding the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) foregoing, where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., You provide such contracting entity with a mandate to enter into the Standard Contractual Clauses with HubSpot, Inc. in its name and on its behalf, such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot a. Power Diary shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) b. You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. Power Diary Pty Ltd. is a recipient of European Data in the United StatesAustralia. The parties acknowledge and agree the following: (a) i. Standard Contractual Clauses: The parties agree to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) ii. The parties agree that for the purposes of the Standard Contractual Clauses, (i) HubSpot, Inc. Power Diary Pty Ltd. will be the "data importer" and Customer will be the "data exporter" (on behalf of itself and Permitted Affiliates); (ii) the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iv) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) iii. To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) iv. If for any reason HubSpot Power Dairy cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot Power Dairy or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- non-compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws. (B) You acknowledge that in connection with the performance of the Subscription Services, HubSpot, Inc. is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree to abide by and process European Data in compliance with the Standard Contractual Clauses. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that for the purposes of the Standard Contractual Clauses, (i) HubSpot, Inc. will be the "data importer" and Customer will be the "data exporter" (on behalf of itself and Permitted Affiliates); (ii) the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iviii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPA. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

Transfer mechanisms for data transfers. (A) HubSpot Repsly shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data Information (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal DataInformation, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Lawsthe Standard Contractual Clauses. (B) You acknowledge that in connection with the performance of the Subscription ServicesService, HubSpot, Inc. Repsly is a recipient of European Data in the United States. The parties acknowledge and agree the following: (a) Standard Contractual Clauses: The parties agree to abide by and process European Data in compliance with Repsly shall execute the Standard Contractual ClausesClauses (and/or any successor standard contractual clauses issued by the EU Commission) in the event that Customer’s Personal Information is transferred to: (i) the United States or (ii) other countries outside the EEA that are not recognized by the EU Commission as providing adequate protection pursuant to Article 45 of the GDPR. (b) Privacy Shield: Although HubSpot, Inc. does not rely on the EU-US Privacy Shield as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18, for as long as HubSpot, Inc. is self-certified to the Privacy Shield HubSpot Inc will process European Data in compliance with the Privacy Shield Principles and let you know if it is unable to comply with this requirement. (C) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, (i) HubSpot, Inc. Repsly will be deemed the "data importer" and Customer will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of itself third party controllers), and Permitted Affiliates); (ii) the Annexes of the Standard Contractual Clauses shall be populated with the relevant information set out in Annex 1 and Annex 2 of this DPA; (iii) where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely DocuSign Envelope ID: 1A08F25F-AA85-44CB-9938-9904100C1242 responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity; and (iv) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. (D) To extent that . “Technical and for so long as organisational measures including technical and organisational measures to ensure the Standard Contractual Clauses as implemented security of the data are described in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annex 1 and Annex 2 of this DPAthe Data Processing Addendum, available at ▇▇▇▇▇://▇▇▇. (E) If for any reason HubSpot cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and you intend to suspend the transfer of European Data to HubSpot or terminate the Standard Contractual Clauses, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such non- compliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination)▇▇▇▇▇▇.▇▇▇/legal.”