THIS DATA SHARING AGREEMENT is dated December 2, 2024 (this “Agreement”). PARTIES each a “party” and together the “parties”. RECITALS AGREED TERMS

INFORMA PLC incorporated and registered in England and Wales with company number 8860726 whose registered office is at ▇ ▇▇▇▇▇▇ ▇▇▇▇▇, ▇▇▇▇▇▇, ▇▇▇▇ ▇▇▇; and

TECHTARGET, INC., a Delaware corporation, headquartered at ▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇,

As a result of an M&A transaction whereby part of Informa PLC (“Ivory”) was sold to a newly created company TechTarget, Inc. (“New Toro”) in which the Informa Group has a majority holding, the Informa Group and New Toro see opportunities for New Toro and Informa Group Companies to leverage their respective datasets relating to audiences for events and media and website interactions.

The parties intend to leverage their respective datasets in compliance with the Data Protection Laws, supported by, and in accordance with, this Agreement, which sets out the agreed use cases (i.e. purposes) that may be made of data shared between the parties, as well as the restrictions and mitigations that must be applied in respect of such use.

The parties also intend this Agreement to set out in a transparent manner their respective responsibilities for compliance when acting as Joint Controllers for the purposes of Article 26 of GDPR.

DEFINITIONS AND INTERPRETATION

Definitions:

Agreed Use Case(s): the uses of Shared Personal Data agreed by the parties as set out in Schedule 1 of this Agreement, which may be updated by the parties in writing (referencing this Agreement), for example, to add, remove or modify use cases, from time to time.

Commencement Date: the date specified at the top of this Agreement.

Confidential Information: means any non-public information that is designated as “confidential” by the disclosing party or that should reasonably be considered to be confidential under the circumstances surrounding disclosure. Confidential Information includes Shared Personal Data and the terms of this Agreement. Confidential Information does not include any information that: (a) was previously known to the receiving party; (b) is received from a third party without similar restriction; (c) is or becomes publicly available other than through breach of this Agreement or wrongful act of a third party; or (d) is independently developed by the receiving party without the use of the other party’s Confidential Information.

Consent Countries: the countries identified in Schedule 4 of this Agreement, which may be updated by the parties in writing referencing this Agreement, from time to time.

Customer: means any client or customer of either party that purchases products or services that may include the Shared Personal Data.

Data Protection Laws: all applicable data protection laws, including the California Consumer Protection Act, European Directive 2002/58/EC, GDPR, the UK Data Protection Act 2018, UK GDPR and any legislation and/or regulation implementing or made pursuant to them, or which amends, replaces, re-enacts or consolidates them and all other applicable laws relating to the processing of personal data and privacy that may exist in any relevant jurisdiction where the parties do business.

Data Subject Request: a request made by a Data Subject to exercise any rights of Data Subjects under the Data Protection Laws.

GDPR: the General Data Protection Regulation ((EU) 2016/679).

Group: means, in relation to a company, that company, any subsidiary or holding company from time to time of that company and any subsidiary from time to time of a holding company of that company.

Informa Group Company: means any member of the Informa Group.

Material Breach:

Personal Data Breach: any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Shared Personal Data.

Permitted Recipient: any third party Processor appointed by either party and required for the processing of the Shared Personal Data, or each of the parties’ professional advisers, or a relevant supervisory authority or other regulator, or any other third party as may be agreed by the parties in writing from time to time.

Privacy Assessment: an assessment of the data protection risks and applicable mitigations, carried out by the Data Protection Officer or Privacy team.

Restrictions and Mitigations: the restrictions on the use and processing of Shared Personal Data and the mitigations set out in Schedule 3 of this Agreement, which may be updated by the parties in writing referencing this Agreement (for example, to add or remove restrictions and/or mitigations), from time to time.

Shared Personal Data: the Personal Data shared by one party to the other (including in pseudonymous form) as described in Schedule 1 of this Agreement, which may be updated by the parties in writing referencing this Agreement (for example, to add or remove categories of personal data), from time to time. To be clear, Shared Personal Data does not include Personal Data used or otherwise processed by a party unless it was received from the other party pursuant to this Agreement, including any such Personal Data that were obtained by the party directly from the data subject or from a third party, and further including such Personal Data that is duplicative of Shared Personal Data received from the other party.

Transparency Requirements: the requirements to ensure that processing is fair and transparent, as set out in Schedule 2, which may be updated by the parties in writing referencing this Agreement (for example, to modify the manner in which notice is provided and/or any Data Subject consent (if any) obtained), from time to time.

UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

Controller, Processor, Data Subject, Personal Data, Joint Controllers, processing, special category data, supervisory authority and appropriate technical and organisational measures shall have the meanings given to them in the GDPR.

COMMENCEMENT AND DURATION

This Agreement shall commence on the Commencement Date and shall continue in effect until terminated in accordance with Section 14.1 (the “Term”).

PURPOSE; PROCESS

This Agreement sets out the framework for the sharing of Personal Data between the parties as Joint Controllers.

Within thirty (30) days following the Commencement Date, the parties shall agree on the process for sharing and identifying Shared Personal Data, as may be adjusted by the parties from time to time in accordance with applicable laws and each party shall comply with and share Shared Personal Data in accordance with the terms of such agreement.

GENERAL

Each party shall only use or otherwise process (whether directly or indirectly through a third party, including a Permitted Recipient acting as a Processor) Shared Personal Data for the Agreed Use Cases subject to, and in accordance with, the Restrictions and Mitigations.

Each party shall provide the other with contact details of at least one staff member as a point of contact and responsible manager (“Point of Contact for Data”) for all issues arising out of this Agreement and the Data Protection Laws, including the joint training of relevant staff, the procedures to be followed in the event of a Personal Data Breach, maintaining a point of contact for and handling any Data Subject Request, and the regular review of the parties’ compliance with the Data Protection Laws.

Each party shall comply with the Data Protection Laws as may be applicable to its processing of the Shared Personal Data, having regard to its role as a Joint Controller, including by publishing revised privacy notices to applicable data subjects relating to its role as a Joint Controller or as otherwise may be required in connection with the execution, delivery, and performance of this Agreement.

Each party shall ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of the Shared Personal Data and against accidental loss or destruction of, or damage to, the Shared Personal Data.

PERSONAL DATA BREACHES

Any party that discovers a Personal Data Breach shall inform the Point of Contact for Data at the other party as soon as possible and in any event within twenty-four (24) hours of discovery.

Where a Personal Data Breach occurs, the parties shall co-operate in addressing it in an appropriate and timely manner, including by deciding whether notification to the supervisory authority, and/or communication to data subjects are required under Articles 33 and 34 of GDPR.

FAIR AND LAWFUL PROCESSING

Each party shall ensure that it processes the Shared Personal Data fairly and lawfully and in accordance with Schedule 2 of this Agreement.

Each party shall ensure that it only processes Shared Personal Data on a lawful basis, which the parties anticipate for the Agreed Use Cases may include the following:

the processing is necessary for the legitimate interests of each party, where such interests are not overridden by the interests or fundamental rights and freedoms of the Data Subjects;

compliance with each party’s respective legal obligations; and,

with a Data Subject’s consent, particularly in respect of the Consent Countries.

PERMITTED RECIPIENTS

Each party agrees that the other may engage Permitted Recipients to assist in the performance of this contract, or engage Permitted Recipients for any other legitimate business purpose, except where such engagement may:

cause either party to breach applicable laws; or

materially disadvantage either party,

Each party may only engage Permitted Recipients that are Processors:

where the Processor has provided sufficient guarantees to implement appropriate technical and organisational measures that applicable processing will meet the requirements of the Data Protection Laws; and,

subject to written agreements that comply with the Data Protection Laws, including, where applicable, the requirements set out in Article 28 of GDPR and UK GDPR.

Except as provided in this Agreement, including with respect to the Agreed Use Cases (but subject always to the Restrictions and Mitigations), or as required by applicable laws, neither party shall disclose Shared Personal Data to any third parties without the other party’s prior written consent.

DATA SUBJECTS’ RIGHTS AND NOTIFICATION TO SUPERVISORY AUTHORITIES

Any party that receives a Data Subject Request which relates directly or indirectly to the processing of Shared Personal Data shall contact the Point of Contact for Data at the other party as soon as possible, and in any event within five (5) business days of receipt of the request, providing a copy of the Data Subject Request and reasonable details of the circumstances giving rise to the request.

The parties agree to provide reasonable assistance as is necessary to each other to enable them to comply with Data Subject Requests and to respond to any other queries or complaints from Data Subjects. The Joint Controller that originally collected (or otherwise obtained) the Shared Personal Data that is the subject of the Data Subject Request shall have primary responsibility for handling that request.

Any party that receives correspondence from a supervisory authority or other data protection regulator which relates to the processing of Shared Personal Data shall contact the Point of Contact for Data as soon as possible and in any event within three (3) business days of receipt of the request. The parties agree to provide reasonable assistance as is necessary to each other to enable them to respond to and comply with the correspondence from the supervisory authority or other data protection regulator.

DATA RETENTION AND DELETION

TRANSFERS

CONFIDENTIALITY

LIABILITY

The parties agree that each party shall only be responsible for any fines, regulatory penalties, damages, costs, compensation claims and other liabilities to third parties to the extent that such liabilities result from that party’s breach of the Data Protection Laws or this Agreement.

To the fullest extent permitted by applicable laws, neither party will be liable to the other under or in connection with this Agreement, whether in contract, tort (including negligence), misrepresentation (whether tortious or statutory), breach of statutory duty or otherwise for any special, incidental, indirect or consequential damages or for loss of data, loss of profits, business interruption, or similar damages or loss, even if such party has been advised of the possibility of such damages.

GOVERNANCE

The parties will meet to review the effectiveness of this data sharing initiative every three (3) months (or such frequency as the parties may agree from time to time), having consideration to the aims and purposes set out in this Agreement.

The review of the effectiveness of this Agreement will involve:

assessing whether the purposes for which the Shared Personal Data is being processed are still the ones listed in Schedule 1 of this Agreement;

if new or modified purposes for which the Shared Personal Data is being processed are necessary or desirable, assessing whether the risks to the goodwill and reputation of Ivory’s brands (and/or which New Toro would agree to for its own brands for such purposes) are greater than the risks associated with the purposes as set forth in Schedule 1 on the date of this Agreement and, if so, additional consideration shall be given to Ivory in assessing such new or modified purposes;

assessing whether the Shared Personal Data is still as listed in Schedule 1 of this Agreement;

assessing whether the Restrictions and Mitigations listed in Schedule 3 of this Agreement are being complied with and are fit for purpose (and amending them where they are found not to be fit for purpose);

assessing whether the legal framework governing data quality, retention, and data subjects’ rights are being complied with; and,

assessing whether any Personal Data Breaches involving the Shared Personal Data have been handled in accordance with this Agreement and the Data Protection Laws.

TERMINATION

Either party may terminate this Agreement:

For its convenience upon six (6) months’ notice to the other party at any time following the date on which Ivory ceases to be the owner, directly or indirectly, of at least forty percent (40%) of the outstanding shares of New Toro; and

upon notice to the other party in the event of a Material Breach by the other party if such Material Breach is not remedied by the other party within sixty (60) days following such party’s receipt of notice of such Material Breach.

Ivory may terminate this Agreement upon notice to New Toro in the event that the Brand Licence Agreement between the parties expires or otherwise terminates in accordance with the provisions thereof.

Upon the effective date of termination of this Agreement for any reason, each party will immediately cease use of Shared Personal Data received from the other party and delete such data from its systems (including those of any Permitted Recipients); provided, for clarity, that the foregoing will not apply to any Personal Data that were obtained by the party directly from the data subject or from a third party, including such Personal Data that are duplicative of Shared Personal Data received from the other party. No further Personal Data will be shared by either party.

Termination or expiry of this Agreement (for whatever reason) shall not affect (i) the validity or enforceability of any of the terms and conditions of this Agreement intended to have continuing effect, or (ii) the accrued rights of the parties arising in any way out of this Agreement at the date of termination.

VARIATION

CHANGES TO THE APPLICABLE LAW

GOVERNING LAW

JURISDICTION

▇▇▇▇▇▇ ▇▇▇▇▇▇

/s/ ▇▇▇▇▇▇ ▇▇▇▇▇▇

▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇

/s/ ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇

•  Demographic data such as event/media registration data, including name, title, business contact details.

•  Firmographic data, such as company, company size, market sector.

•  Behavioural data, such as noted interests based on historical content consumption on media sites and/or at events.

No special category or sensitive data will be included.

•  Demographic data such as event/media registration data, including name, title, business contact details.

•  Firmographic data, such as company, company size, market sector.

•  Behavioural data, such as noted interests based on historical content consumption on media sites and/or at events.

No special category or sensitive data will be included.

•  Demographic data such as event/media registration data, including name, title, business contact details.

•  Firmographic data, such as company, company size, market sector.

•  Behavioural data, such as noted interests based on historical content consumption, on media sites and/or at events.

No special category or sensitive data will be included.

•  Demographic data such as event/media registration data, including name, title, business contact details.

•  Firmographic data, such as company, company size, market sector.

•  Behavioural data, such as noted interests based on historical content consumption on media sites and/or at events.

No special category or sensitive data will be included.

•  Demographic data such as event/media registration data, including name, title, business contact details.

•  Firmographic data, such as company, company size, market sector.

•  Behavioural data, such as noted interests based on historical content consumption on media sites and/or at events.

No special category or sensitive data will be included.

Obligations on the Party providing Shared Personal Data

Legacy Data. Each party shall only make Shared Personal Data available to the other party where:

the Data Subject was informed of the identity of the Controller collecting their Personal Data at the time of collection;

the Data Subject was informed that their Personal Data may be processed for purposes the same as, or substantially similar to, the Agreed Use Cases at the time of collection;

the Data Subject was informed that their Personal Data may be shared with other companies in the same group for such purposes at the time of collection;

the Data Subject has not indicated that they no longer wish their Personal Data to be used for purposes the same as, or substantially similar to, the Agreed Use Cases, whether by making a Data Subject Rights Request, revoking a consent previously provided or opting-out from such processing by any means; and,

In respect of the Consent Countries, it has obtained a positive indication of consent from the Data Subject that the processing of their Personal Data in-line with 1.1.1 to 1.1.3 above was acceptable and that the Data Subject has not withdrawn this indication as set out in 1.1.4 above.

New Data. From thirty (30) days after the date this Agreement is signed, each party shall only make Shared Personal Data available to the other party where the Data Subject was provided with the following information (which may have been provided through a combination of a privacy policy available at the point of collection and “just in time” notices posted at the point of data collection):

the identity and the contact details of the Controller collecting the Personal Data, which must also include the following statement at the point of data collection: “An Informa Company”. This shall be communicated alongside a description of the essence of the arrangements between the parties as Joint Controllers, which may be included in the parties’ respective privacy policies;

the contact details of the data protection officer for the party collecting the Personal Data;

the purposes for which the Personal Data will be processed and the legal basis for the processing, including a summary of any legitimate interests relied upon by the Controller, and, in particular, that the Personal Data may be processed for the Agreed Use Cases and that the Data Subject may opt-out of such use. In respect of Data Subjects in the Consent Countries, each party will obtain the Data Subject’s prior consent to such use (including by other Informa Group Companies) before including their Personal Data in the Shared Personal Data;

the possibility of the Data Subject’s Personal Data being shared with other Informa Group Companies, together with other potential recipients or categories of recipients, if any;

the fact that the Controller intends to transfer Personal Data to other countries around the world, including a description of any appropriate or suitable safeguards (e.g. EU Standard Contractual Clauses) and the means by which to obtain a copy of them;

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

the existence of the right to request from the Controller access to and rectification or erasure of personal data or restriction of processing concerning the Data Subject or to object to processing as well as the right to data portability;

where the processing is based on consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

the right to lodge a complaint with a supervisory authority; and,

whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the Personal Data and of the possible consequences of failure to provide such data.

Opt-outs and Revoked Consent

Obligations on a Party using Shared Personal Data

When processing Shared Personal Data, each party shall ensure that every communication sent to Data Subjects as a result of such processing:

identifies the sender and also includes in a reasonably prominent manner, the descriptor: “an Informa Company”;

includes a prominent link to a privacy policy that includes each of the items listed in 1.2.1 to 1.2.10 above; and

contains a clear and easy-to-use means by which the Data Subject may communicate a change in their preferences, such as by opting-out or revoking any previously given consent. Such means may include: (a) providing a prominent unsubscribe option in each electronic communication, and (b) including a prominent link to a preference centre that enables a Data Subject to make granular choices regarding the uses and sharing of their Personal Data.

Each party shall promptly record the means, date and time-stamp of any and all indications from Data Subjects, howsoever received, that they no longer wish the Controller to use and/or share their Personal Data for any particular purposes, including the Agreed Use Cases. Each party shall honour such requests in full except to the extent that it is not required to do so by the Data Protection Laws.

The requesting business should show business justification for targeting this audience (i.e. the request should be supported by evidence of profiles’ topic alignment).

High volume of data in EU (over 5,000) will require a Privacy Assessment before data is shared.

Activation via SMS or telephone will require a Privacy Assessment before data is shared.

Where a Privacy Assessment finds a sharing request is high risk despite the existing controls, such a request will require approval of the CEO of the sharing entity/division.

Data access via sharing will be “System to System” and manual downloads of audience records is prohibited.

Data sharing request will be use-case specific, data records obtained via sharing would be limited to the initial use case. Any subsequent use case would warrant a reassessment.

The preference centres, when available, will be the master data for all consent consideration.

Shared Personal Data must not include Personal Data relating to a Data Subject in the European Economic Area where its use may involve it being shared with a third party without the Data Subject having consented to such sharing.

The requesting business should show business justification for targeting this audience (i.e. the request should be supported by evidence of profiles’ topic alignment).

High volume of data in EU (over 5,000) will require a Privacy Assessment before data is shared.

Activation via SMS or telephone will require a Privacy Assessment before data is shared.

Where a Privacy Assessment finds a sharing request is high risk despite the existing controls, such a request will require approval of the CEO of the sharing entity/division.

Data access via sharing will be “System to System” and manual downloads of audience records is prohibited.

Data sharing request will be use-case specific, data records obtained via sharing would be limited to the initial use case. Any subsequent use case would warrant a reassessment.

Shared Personal Data must not include Personal Data relating to a Data Subject in the European Economic Area where its use may involve it being shared with a third party without the Data Subject having consented to such sharing.

Data access via sharing will be “System to System” and manual downloads of audience records is prohibited.

Data sharing request will be use-case specific, data records obtained via sharing would be limited to the initial use case. Any subsequent use case would warrant a reassessment.

The parties will apply technical and organisational controls to prevent activation.

The requesting business should show business justification for targeting this audience (i.e. the request should be supported by evidence of profiles’ topic alignment).

High volume of data in EU (over 5,000) will require a Privacy Assessment before data is shared.

Activation via SMS or telephone will require a Privacy Assessment before data is shared.

Where a Privacy Assessment finds a sharing request is high risk despite the existing controls. such a request will require approval of the CEO of the sharing entity/division.

Data access via sharing will be “System to System” and manual downloads of audience records is prohibited.

Data sharing request will be use-case specific, data records obtained via sharing would be limited to the initial use case. Any subsequent use case would warrant a reassessment.

The preference centres, when available, will be the master data for all consent consideration.

The parties will apply technical and organisational controls to prevent activation.

Data access via sharing will be “System to System” and manual downloads of audience records is prohibited.

Data sharing request will be use-case specific, data records obtained via sharing would be limited to the initial use case. Any subsequent use case would warrant a reassessment.