DATA PROTECTION ADDENDUM

This Data Protection Addendum (“DPA”) forms part of the Master Subscription Agreement between Aryaka and Customer (the “Agreement”) under which Aryaka provides the Services to Customer. Capitalized terms used but not defined in this DPA shall have the meaning as set forth in the Agreement.

• 1.DEFINITIONS
• 1.1 “Data Controller” means the entity which, alone or jointly with others, determines the purposes and means of Processing of Personal Information.
• 1.2 “Data Processor” means the entity which Processes Personal Information on behalf of the Data Controller.
• 1.3 “Data Protection Laws” mean all laws applicable to the Processing of Personal Information.
• 1.4 “Data Subject” means any individual about whom Personal Information may be Processed under this DPA.
• 1.5 “Personal Information” or “Personal Data” means business contact information that relates to an identified or identifiable natural person collected from the Customer, such as name, title, email address, and phone number that is necessary to negotiate and perform the Services contemplated by the Agreement and maintain the commercial relationship between the Parties.
• 1.6 “Process” or “Processing” means any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of Personal Information.
• 2. Relationship between the Parties. Customer and Aryaka have entered into an Agreement for Services. The Parties acknowledge that Customer and Aryaka are each a Controller for purposes of the Agreement. In order to fulfill the terms of the Agreement, the Parties must provide limited Personal Information to each other. The Parties will Process such Personal Information in accordance with confidentiality requirements, the Agreement and this DPA or otherwise as required by applicable Data Protection Law. Each Party will be solely responsible for complying with its obligations under Data Protection Laws with respect to the Processing of Personal Information, including for providing any necessary notices to, and obtaining any necessary consents from, Data Subjects or other individuals with respect to the Processing of Personal Information. The Parties will not retain, use, sell, share or disclose Personal Information for any purpose other than performance of the Agreement, or as required by applicable Data Protection Laws. Should a Party determine that it can no longer meet its obligations under applicable Data Protection Laws, it will promptly inform the other Party.
• 3. Security.The Parties will maintain reasonable administrative, physical and technical safeguards designed to protect the security, confidentiality and integrity of the Personal Information against unauthorized loss, destruction, alteration, access, or disclosure, including the measures listed in Annex 2 to Appendix 1.
• 4. Subcontractors. Customer agrees that Aryaka may disclose Personal Information to its subcontractors for purposes of providing Services to Customer (“Subcontractors”), provided that Aryaka will impose substantially similar obligations on its Subcontractors regarding the security and confidentiality of Personal Information as those set forth in this DPA.
• 5. Data Location. In connection with the performance of the Agreement, Aryaka may transfer Personal Information to various locations, which may include locations both inside and outside of the United Kingdom (“UK”) or European Economic Area (“EEA”). To the extent such transfer involves a transfer of Personal Information originating from Customer in the UK, EEA or Switzerland to Aryaka or its Subcontractors located in countries outside the UK, EEA or Switzerland that have not received a binding adequacy decision, the Parties agree that the European Union Standard Contractual Clauses (Controller to Controller) which are attached hereto at Appendix 1 and such transfer is described in Annex I thereto.
• 6. Data Subject Requests and Complaints. The Parties will cooperate in responding to a Data Subject request or complaint. Each Party will seek to implement appropriate processes (including technical and organizational measures) to respond to requests or complaints from Data Subjects. Each Party will promptly and securely delete or destroy any Personal Information pertaining to an individual (not otherwise subject to an exemption) where such information is within the Party’s possession or control. If applicable, the Party will direct any affiliate or subprocessor that Processes Personal Information related to the identified Data Subject to promptly and securely delete or destroy such Personal Information.