Alert Service Agreement

Version 4.3, June 2023

WHEREAS:

1. the Company wishes to engage CBH for the provision of Software-as-a-Service (SaaS) Services as described herein;

2. CBH has agreed to supply the said services on the terms and conditions set out in this Agreement;

3. it is the express objective and intention of the Parties to this Agreement to achieve a high degree of efficiency in their professional relationship, to their mutual benefit.

NOW, THEREFORE, the Parties hereto agree as follows:

1. Conditions precedent

1. The following shall be the condition precedent for CBH to start rendering the Services:

   1. The Company has integrated with CBH through the Technical Solution and/or registered with the CBH client's hub;

   2. The Company successfully underwent the verification and due diligence processes, by providing the Company Information requested by CBH;

   3. The Company provided CBH by email, defined in this Agreement, with the following information: (a) Acquirer BIN; (b) Acquirer CAID; (c) Payment Descriptor; (d) d.b.a. (doing business as); (e) Company's legal entity name; (f) MCC; (g) support email; and (h) support telephone.

2. If the Company becomes incompliant with any of the conditions precedent set out in clause 1.1, CBH shall have the right to suspend rendering Services until the Company is compliant again.

3. In consideration of the Fees and subject to the Company's conformity with the Agreement, CBH shall render Services as set out in this Agreement.

2. Services

1. CBH shall render the Services agreed in Schedule(s) to this Agreement.

2. The change in Applicable Laws may affect CBH's ability to provide and Company's ability to receive the Services.

3. CBH is authorised to suspend rendering the Services as necessary to conduct maintenance, upgrade, repair and/or provide other necessary attention to CBH's Technical Solution, servers or equipment. CBH will have reasonable discretion to determine when to suspend Services and shall give the 5 days e-mail written notice on such suspension.

4. Without derogating from any other right available to CBH under this Agreement, Applicable Laws or otherwise, on the basis of risk management considerations or where required to comply with the Applicable Law CBH, in its sole discretion, has the right to suspend the Services in any jurisdiction at any time and for any period of time.

5. CBH reserves the right to use third-party service providers in rendering any of the Services to the Company. CBH shall exercise reasonable care while choosing the provider. CBH accepts no liability for the provision of the Services by any third party.

6. As a Software-as-a-Service (SaaS) provider, CBH does not verify or modify the information. CBH provides a technical solution allowing the Company to transfer information between the Company and the Acquirer (and other third-party service providers, if applicable).

3. Fees

1. The Company shall pay the Fees defined in Schedule(s) to the Agreement. The Fees shall be confirmed by an invoice (or an electronic invoice) issued by CBH on a monthly basis. The net Fees due shall be paid by the Company to CBH's bank account stipulated in the invoice within ten (10) calendar days of receiving the invoice.

2. CBH shall have the right, for its sole discretion, to issue the invoice to Company if the Fees exceed USD 10,000 (or an equivalent). This does not restrict CBH to issue the invoice at the end of the month as per clause 3.1.

3. Interest shall accrue on any unpaid invoice owed by the Company to CBH at the rate of 10% per month. CBH also will be entitled at any time to suspend providing Services.

4. If the Company has any valid reason for disputing any amount of an invoice, the Company shall notify CBH in writing within five (5) business days of receipt of the disputed invoice. Within five (5) business days of receipt of the notification from the Company, CBH shall decide whether the invoice amount is disputed reasonably. If CBH accepts the Company's objections, the respective adjustments will be made and the Company shall pay the adjusted sum within five (5) business days when the adjust invoice has been sent. If CBH rejects the Company's objections, the Company shall pay the Fees defined in the initial invoice. All payments made by Company to CBH are non-refundable. Payment made by Company to CBH confirms the Company's agreement with the Fees defined in the invoice. All fees payable to CBH under this Agreement are exclusive of value added tax and any additional or other taxes, charges or duties which may be imposed in connection with any and all payments made or due hereunder and shall, if applicable, be borne by the Company. In case value added tax or any other sales tax is or becomes chargeable (retroactively or going forward) in accordance with applicable laws, CBH shall add such amount to the Fees accordingly.

5. Any fees or amounts paid by the Company, whether directly or by way of set-off, deduction or otherwise, to Acquirers or other third-party service providers, shall not affect nor derogate from Company's obligation to pay all the Fees due to CBH hereunder.

6. Any repayment of funds to the End User for the execution of the Transaction (as a result of the Chargeback or otherwise) is subject to the following terms:

   1. the Company is solely responsible for repayment of funds, on the terms indicated in the agreement with the Acquirer (and/or other service providers (if any)); and

   2. the Fees charged by CBH in relation to execution of such Transaction is not to be returned to the Company.

7. The Company shall meet all costs associated with its compliance with the Applicable Law.

4. Amendments

1. CBH shall have the right, upon a three (3) day notice, to change any of the Services if:

   1. Company requests so;

   2. the changes are made at the Card Scheme(s) and/or other third-party's request;

   3. the changes are imposed upon CBH under the Applicable Law;

   4. the change is required on the basis of risk management considerations of CBH;

   5. Company fails to fulfil its obligations under the Agreement.

2. CBH shall have the right, upon a ten (10) day notice, to change any provision of the Agreement, including but not limited, with regards to Clause 3 of the Agreement, if:

   1. the changes are made at the Card Scheme(s) and/or other third-party's request;

   2. the changes are imposed upon CBH under the Applicable Law;

   3. the change is required on the basis of risk management considerations of CBH;

   4. Company fails to fulfil its obligations under the Agreement.

3. If the Company does not accept the changes prescribed in clause 4.2 of the Agreement, it has the right to terminate the Agreement before the new provisions enter into force. After the said term, the new changes are considered accepted and in force.

5. Prohibited Actions

1. It is prohibited to the Company to:

   1. Use the Services in a way that infringes Applicable Laws, good practices, rights of third parties, or the policies of the Acquirers.

   2. Use the Services to handle the Transactions on the websites and in IT environments that were not previously approved by CBH.

   3. Use the Services to process notifications received not via the Technical Solution.

   4. Fail to protect the data relating to its End Users, which is collected and stored by the Company against unauthorised access. The Company shall immediately notify CBH if the Company reasonably believes that there has been any security breach including but not limited to instances of unauthorised access or attempt to access Transaction data or sensitive End-User data, where there is a suspected or confirmed damage, loss or theft of Transaction data or sensitive End-User data.

   5. Take actions or omissions that may expose CBH to credit risk, risk of fraud, breach of duties related to anti-money laundering and terrorist financing or other statutory obligations or a sudden increase of risk (assessed under the procedures adopted by CBH based on the Company Information and other information available).

   6. Take any actions, as a result of which the Technical Solution or any part of CBH's infrastructure will be negatively affected.

   7. Engage in misleading or deceptive conduct nor to use Services itself or permit others to use the Services for any improper, immoral, or unlawful purposes.

6. Data protection

1. Personal data processing in connection with this Agreement shall be governed by Schedule C, which forms an integral part of the Agreement.

2. The Company agrees to receive commercial and marketing information from CBH.

7. Representations and Warranties

1. The Company warrants to CBH that:

   1. at the date of this Agreement, it has full power and lawful authority to execute and deliver this Agreement and to perform its obligations under this Agreement;

   2. it is duly organised and validly existing under the laws of its domicile and has the legal capacity and corporate authority to own its property and carry on its business as now conducted and is not in breach of its by-laws;

   3. it is in all material respects in compliance with and has at all times been, and is not in material default or violation in any respect of any Applicable Law;

   4. there is no action, suit or proceeding at law or in equity now pending or, to the best of its knowledge, threatened by or against or affecting the Company which would impair its right to carry on its business as now conducted or affect its financial conditions or operations or its ability to perform the obligations required under this Agreement;

   5. any and all information and documentation provided by the Company is true, accurate, complete and updated and no information, document or statement provided or made available are untrue, false, incorrect, incomplete or misleading.

2. Each party warrants, represents, covenants and agrees that it has knowledge of all applicable Anti-Corruption Laws and that neither it nor any of its officers, directors, employees, agents, contractors, designees, ultimate beneficial owners or shareholders, nor any other party acting on its behalf, will directly or indirectly take any action that would constitute a violation of the Anti-Corruption Laws with respect to any activities related to any business for CBH or the Company. Each party warrants, represents, covenants and agrees that neither it nor any of its direct or indirect Representatives has or will pay, offer, promise to pay or authorize the payment of, offer or promise to pay, directly or indirectly, any monies or anything else of value to any current or former official, political party or official of a political party, or any candidate for public office in connection with this Agreement. Each party acknowledges that, for purposes of this Agreement, an "official" is (i) any officer or employee of a government or any department, agency or instrumentality of a government, (ii) any officer or employee of a public international organization such as the United Nations or the World Bank, (iii) any individual acting in an official capacity for or on behalf of a government agency, department, instrumentality or of a public international organization, (iv) any officer or employee of a company owned or controlled by a government or (v) any member of a royal family who may lack formal authority but who may otherwise be influential, including by owning or managing state-owned or controlled companies. Each party represents and warrants that all representations, warranties and covenants set forth in this clause are truthful and accurate. Each party shall notify the other party in writing immediately upon the occurrence of any event which would render the representations, warranties or covenants contained herein incorrect. If, in good faith, CBH believes that any action under this Agreement will likely cause a violation of the Anti-Corruption Laws, nonperformance shall be excused and this Agreement may be terminated at CBH's option.

3. Each party warrants, represents, covenants and agrees that it will comply at all times with all applicable laws, rules, regulations, decrees and prohibitions of whatsoever nature relating (a) to the sale, export or transfer of items or (b) to transactions of any kind with restricted or embargoed countries or territories, restricted or blocked persons or restricted or blocked entities (together, "Embargoed Targets"), including, without limitation, those of the United States, Switzerland and the European Union or its member states ((a) and (b) together, the "Sanctions Laws"). Each party warrants, represents and covenants that (c) it is not located, organized under, ordinarily resident in or acting on behalf of an Embargoed Target and (d) that it is not an Embargoed Target and is not owned or controlled by an Embargoed Target, as defined either expressly or substantively, by the Sanctions Laws. Each party warrants, represents and covenants that it is not aware of any reason why it should be named on any list identifying Embargoed Targets maintained by implementing authorities of, without limitation, the United States, Switzerland or the European Union or member states thereof (together, "Lists"), as such Lists may be amended from time to time. Each party agrees that it shall not (e) sell, directly or indirectly, resell or deliver any good, software or technology to an Embargoed Target, (f) transport any such item on any vessel or other carrier that is owned, operated, flagged or chartered by an Embargoed Target or (g) broker, finance or otherwise facilitate any sale or resale of any such item or transaction that would cause a violation of any Sanctions Law. Each party agrees that it will provide immediately to the other party all information, including, without limitation, information concerning end customer, transit and final destination, shipping and intended end-use, to enable an assessment of compliance with the Sanctions Laws. If, in good faith, CBH believes that any action under this Agreement will likely cause a violation of the Sanctions Laws, nonperformance shall be excused and this Agreement may be terminated at CBH's option.

4. Each Party undertakes that it shall not for the term of the Agreement and for a period of 2 years thereafter on its own behalf, or on behalf of any person directly or indirectly, canvass, solicit or endeavour to entice away from the other Party any person who has at any time during the term of the Agreement been employed or engaged by that Party.

5. If any of those representations and warranties may be affected at any time from the date of this Agreement, immediately, but no later than in 5 Business Days, the Company shall inform CBH on any changes, including regarding the Company Information, in particular changes regarding its legal form, address, bank data, significant changes in the privacy policy or terms and conditions of delivery of Goods.

6. Except as expressly stated in this Agreement, no representation, inducement or warranty was, prior to the execution of this Agreement, given or made by one of the Parties hereto with the intent of inducing the other Party to enter into this Agreement, and any representations, inducements or warranties that may have been so given are hereby denied and negated.

8. Liability

1. Neither Party (or either of its affiliates, directors, officers, employees, contractors or representatives) shall be liable for special, incidental or consequential damages or lost profits (however arising, including negligence) arising out of or in any way relating to this agreement, even if there was prior notice of the possibility of such damage arising.

2. In no event shall CBH or its affiliates, directors, officers, employees, contractors, or representatives be liable for an amount exceeding any amounts paid to CBH under this agreement in the 6 (six) months preceding the occurrence of facts that first give rise to any liability hereunder. The existence of more than one claim or event from which liability arises will not enlarge this aggregate limitation. This aggregate limit is a single, global limit that applies to CBH.

3. Neither CBH, nor its affiliates, directors, officers, employees, contractors, or representatives shall bear contractual or non-contractual liability for any delay or failure to perform its obligations under this Agreement to the extent that the delay or failure is caused by any of the following:

   1. failure, interruption, infiltration or corruption of any hardware, software or other telecommunications or data transmission system; or

   2. CBH's belief that the Transaction is unauthorised or fraudulent or poses a security risk.

4. The Company shall during the term of this Agreement and after its termination continue to bear responsibility for the Chargebacks and other penalties, fees, and adjustments resulting in any way from receiving Services and all other amounts then due or which thereafter may become due under this Agreement.

5. Any compensation claim for faults or damages must be presented in writing by the Company to CBH within 60 (sixty) days after the occurring of the alleged fault or damage. Otherwise the claim shall be considered invalid.

9. Indemnification

1. Company agrees to defend, indemnify and hold CBH harmless from any claim or demand (including reasonable legal fees) made or incurred by any third party due to or arising out of:

   1. Company's breach of this Agreement;

   2. Company's improper use of the Services;

   3. Company's negligence or willful misconduct, and/or

   4. Company's violation of Applicable Laws or the rights of a third party.

10. Remedies

1. Each Party agrees that breach of this Agreement will give rise to irreparable injury for which:

   1. money damages may not be a sufficient remedy for any breach of this Agreement by such Party;

   2. the other Party may be entitled to specific performance and injunction and other equitable relief with respect to any such breach;

   3. such remedies will not be the exclusive remedies for any such breach, but will be in addition to all other remedies available at law or in equity; and

   4. in the event of litigation relating to this Agreement, if a court of competent jurisdiction determines in a final non-appealable order that one Party, or any of its representatives, has breached this Agreement, such Party will be liable for reasonable legal fees and expenses incurred by the other Party in connection with such litigation, including, but not limited to, any appeals.

11. Intellectual property

1. CBH or its licensors own the Proprietary Information.

2. Except as expressly stated herein, this Agreement does not transfer any right, title or interest in the Services or the Proprietary Information to the Company.

3. The Company acknowledges that the unauthorised use or release of the Proprietary Information or any part thereof, except as provided herein, would result in damages to CBH, which could not be adequately compensated for in damages by monetary award.

4. CBH grants to the Company a limited, revocable, non-exclusive, non-transferable, worldwide right to use the Services and the Proprietary Information, solely for the Company's own internal business purposes and subject to the terms of this Agreement.

5. The Company acknowledges that it is prohibited from any use, reproduction, decompilation, reverse engineering, modification or distribution of any Proprietary Information that is not expressly authorised in this Agreement. The Company may not sell, resell, assign or otherwise transfer rights to CBH Services or any Proprietary Information.

12. Confidentiality

1. Each Party agrees to maintain all Confidential Information of the other Party in confidence to the same extent that it protects its similar confidential information and to use such Confidential Information only as permitted under the Agreement. Each Party agrees to take all reasonable precautions to prevent any unauthorised disclosure or use of the Confidential Information of the other Party including, without limitation, disclosing such Confidential Information only to its employees or contractors with a need to know and who are parties to appropriate agreements sufficient to comply with this section.

2. The obligation of confidentiality shall extend for a period of three years after the termination of this Agreement, but shall not apply with respect to information that lawfully becomes a part of the public domain, or of which the Parties gained knowledge or possession free of any confidentiality obligation.

13. Governing law and dispute resolution

1. This Agreement shall be governed by the Applicable Law. Each Party to this Agreement irrevocably agrees that the courts of England shall have exclusive jurisdiction to hear, settle and/or determine any dispute, controversy or claim (including any non-contractual dispute, controversy or claim) arising out of or in connection with this Agreement, including any question regarding its existence, validity, formation or termination. For these purposes, each Party irrevocably submits to the jurisdiction of the English courts.

14. Entire Agreement

1. This Agreement represents the entire understanding of the Parties concerning the subject matter hereof and supersedes any other prior or contemporaneous agreements or understandings, whether written or oral.

2. If any provision of the Agreement is found by a proper authority to be unenforceable or invalid, such unenforceability or invalidity shall not affect the other provisions of this Agreement, and this Agreement shall be construed as if such unenforceable or invalid provision had never been contained herein.

15. Assignment

1. This Agreement will bind and inure to the benefit of each Party's permitted successors and assigns.

2. Partner may not assign the rights and obligations under this Agreement without the written consent of CBH.

3. CBH may assign the rights and obligations under this Agreement.

16. Notices

1. All communication, notices or reports permitted or required under this Agreement shall be in writing and in English.

2. All notices shall be by personal delivery, nationally recognized overnight courier service or by certified or registered mail, return receipt requested or by email, stated herein, and shall be deemed given upon the earlier of actual receipt or 1 (one) day after deposit with the courier service, 5 (five) days after deposit in the mail, or receipt by sender of confirmation of electronic transmission or on the date when the email has been sent. Notices shall be sent to the addresses set forth herein or such other address as either Party may specify in writing.

17. Execution

1. This Agreement may be executed in two or more counterparts in English (which both Parties understand properly), all of which when taken together shall be considered one and the same agreement and shall become effective when counterparts of the Schedule have been signed by each Party and delivered to each other Party, it being understood that the parties need not sign the same counterpart. In the event that any signature is delivered by facsimile transmission or by e-mail delivery of a ".pdf" format data file, such signature shall create a valid and binding obligation of the Party executing (or on whose behalf such signature is executed) with the same force and effect as if such facsimile or ".pdf" signature page were an original thereof.

2. The Agreement can be accepted and thus executed in electronic form (e.g., by an electronic or other means of demonstrating assent) and Company's acceptance will be deemed binding between the Parties. The Company cannot contest the validity or enforceability of this Agreement, including under any applicable statute of frauds, because it was accepted or signed in electronic form. Electronically maintained records when produced in hard copy form shall constitute business records and shall have the same validity as any other generally recognized business records.

3. For the avoidance of doubt, should either party fail to sign these Agreement, and despite the lack of signature by authorized signatory of the Company, the Services under this Agreement are still provided by CBH to the Company, the performance of the Services shall constitute the Company's acceptance of the terms and conditions of this Agreement. Further may inter alia confirm the Company's acceptance to this Agreement:

   1. completing integration with CBH through the Technical Solution;

   2. starting receiving Services through the Technical Solution;

   3. payment of the Fees by the Company to CBH for the Services; and

   4. other activities, conducted by the Company and/or CBH, reflecting the performance of this Agreement.

18. Term and Termination

1. The term of this Agreement shall commence on the Effective Date and shall continue until terminated by either Party upon 30 (thirty) days notice in writing to the other Party.

2. Without derogating from the aforesaid, CBH may terminate this Agreement immediately:

   1. if the Company fails to perform any obligation required under this Agreement and does not remedy such breach within 5 (five) days from a written request to such effect made by CBH;

   2. if CBH reasonably suspects or believes that the Company is using the Services in connection with any unauthorised, dishonest or criminal activities or upon notice from the Card Schemes that the Company is suspended or violated any of their rules;

   3. if CBH is required to do so by any Card Schemes or regulatory authority;

   4. if the Company becomes insolvent, fails to pay its debts due to CBH, makes a general assignment for the benefit of creditors, commences procedures for voluntary winding up, suffers or permits the appointment of a receiver for its business assets, or is wound up or liquidated, voluntary or otherwise.

3. In case the Agreement is terminated by any Party, all Fees due to CBH under the Agreement shall become payable the day before such termination of the Agreement.

4. Any termination of this Agreement shall not relieve the Company from any liability arising prior to the termination of this Agreement.

19. No agency

1. It is agreed and understood that either Party is not the agent or representative of the other Party and has no authority or power to bind or contract in the name of or to create any liability against the other Party in any way or for any purpose. Nothing contained herein shall be construed to create a partnership or joint venture between the Parties.

20. Expenses

1. Notwithstanding any other provision in this Agreement to the contrary, in no event will CBH be obligated to pay any expenses, fees, costs or other amounts to any subcontractor, person, or entity under this Agreement.

21. No waiver

1. No failure or delay by either Party in enforcing any provision of this Agreement will be deemed a waiver of such Party's ability to enforce the same provision of this Agreement at a future date.

22. Force Majeure

1. The Parties shall not be responsible for any failure to perform its obligations under this Agreement if such failure is caused by acts of God, war, terrorism, civil insurrection, acts of militia or military, strikes, revolutions, lack or failure of transportation or communications facilities, changes to the Applicable Law, or other causes that are beyond Parties' reasonable control. In the event of such a failure, Parties' obligations shall be suspended until such time as the cessation of all causes of such failure.

23. Survival

1. The following sections shall survive termination of this Agreement: Intellectual Property, Confidentiality, Term and Termination, and Definitions, as well as any other terms which by their nature should survive termination of this Agreement.

SCHEDULE B TO THE ALERT SERVICES AGREEMENT

Interpretations and Definitions

1. Interpretations

1. In this Agreement, unless the context otherwise requires:

   1. headings are for convenience only and do not affect the interpretation of this Agreement;

   2. words denoting the singular include the plural and vice versa;

   3. a reference to a person includes a reference to any individual or legal entity and any governmental authority;

   4. if the numeric and literal versions of a number differ – the literal version shall have precedence;

   5. a reference to a specific Clause, Subsection, Annex, Schedule or Preamble is a reference to the applicable Clause, Subsection, Annex, Schedule or Preamble hereof;

   6. references to any law or normative act shall include any changes, amendments, supplements or substitutions of such law or normative act (in whole or in part);

   7. a reference to any agreement or document is a reference to that agreement or document as may be amended, novated, supplemented, extended or restated, however, to the exclusion of any amendments and supplements made in breach of this Agreement; and

   8. a reference to a party to any document (including to this Agreement) includes that party's successors and permitted assigns.

2. Definitions

SCHEDULE C TO THE ALERT SERVICES AGREEMENT

Data Processing Agreement

This Data Processing Agreement (the "DPA"), presented below is the part of the Agreement between the Company (the "Data Controller") and the Provider (the "Data Processor") that has the reference to this DPA and form an integral part of the Agreement.

1. Definitions

The following definitions shall apply in this DPA in addition to other defined in the Agreement; and, for the avoidance of doubt, in the event of any inconsistency or conflict, the applicable special definitions below shall supersede and/or amend the definitions in the Agreement.

2. General provisions

1. The Company attests that it is the Data Controller of Personal Data within the meaning of the Data Protection Laws and the Provider determines that it will be acting as a Data Processor in respect of the Personal Data that is the subject of the Agreement.

2. Personal data processing shall be entrusted to the Data Processor for the purposes and period of the performance of the Agreement and/or until no further processing is required by the Agreement or Applicable Law.

3. The subject matter, duration, nature and purpose(s) of the processing of Personal Data, as well as type of Personal Data and categories of Data Subjects are specified in Annex A.

4. The Data Processor shall refrain from processing Personal Data that is beyond the scope set forth in Annex A.

5. In case the Data Processor receives additional information that is not needed to fulfil the Agreement, it must inform the Data Controller immediately and stop the processing of the additional Personal Data.

3. Instructions

1. The Data Processor shall process the Personal Data only on instructions from the Data Controller and for no other purpose than the purpose(s) defined in Annex A.

2. The Data Processor shall inform the Data Controller if, in its opinion, an instruction infringes the Data Protection Laws. The processing of the Personal Data required in said instruction shall be delayed.

3. If the Data Processor is required to transfer Personal Data to a law enforcement agency, it shall inform the Data Controller of that legal requirement before processing the Personal Data, unless that law prohibits such information on important grounds of public interest.

4. Technical and organisational measures

1. The Data Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk before starting to process Personal Data.

2. In assessing the appropriate level of security, the Data Processor shall take into account the risks that are presented by Processing Personal Data, in particular risks arising from a Data Breach.

3. The Data Processor undertakes to ensure the security of Personal Data entrusted for personal data processing in accordance with the Data Protection Laws and industry practices, in particular, to formulate and apply appropriate documentation and procedures for personal data processing, as well as technical, informational and legal security measures, as required by the Data Protection Laws, including inter alia:

   1. the pseudonymisation and encryption of personal data;

   2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of technical problems or any other incident; a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of personal data processing.

4. The Data Processor or its representative shall maintain a record (in writing or electronic form) of all categories of processing activities carried out on behalf of the Data Controller, containing:

   1. the name and contact details of the Data Processor or its Sub-Processors and of the Data Controller, and, where applicable, of the Data Controller's or the Data Processor's representative, and the data protection officer;

   2. the categories of Personal Data processing carried out on behalf of the Data Controller;

   3. where applicable, transfers of Personal Data to a third country or an international organisation, including the identification of that third country or international organisation and including, where applicable, the documentation of suitable safeguards;

   4. where possible, a general description of the technical and organisational security measures.

5. Data Processor's Employees

1. The Data Processor shall ensure that all Employees with access to the Personal Data, are legally bound by confidentiality obligations during and after the termination of the DPA, including after the termination of their employment and/or other contractual arrangements with the Data Processor.

2. The Data Processor shall provide access to Personal Data to its Employees on a need-to-know basis only and shall make sure that the Employees are aware and compliant with the DPA, Data Controller's written instructions and the Data Protection Laws.

3. The Data Processor shall keep records of persons authorised for Personal Data processing.

4. The Data Processor shall train its Employees involved in the processing of the Personal Data to comply with the Data Protection Laws and with the requirements established in this DPA.

6. Sub-Processors

1. Data Controller authorizes Data Processor to appoint (and permit each Sub-Processor appointed in accordance with this clause 6 to appoint) Sub-Processors in accordance with this clause 6 and any restrictions in the Agreement.

2. The Data Controller hereby grants general written authorization to the Data Processor to engage an additional or replace existing Sub-Processors for the processing of the Personal Data under the Agreement. Upon request of the Data Controller, the Data Processor will provide a list of such Sub-Processors. The Data Controller has the right to object to any Sub-Processor. The objection shall be made by written communication within 10 business days after receipt of requested list of Sub-Processors. The Data Processor shall use reasonable efforts to replace the Sub-Processor.

3. Where the Data Processor engages Sub-Processors, the Data Processor shall ensure that Sub-Processors comply with data protection obligations compatible with those of the Data Processor under this clause 6 as applicable to their processing of Personal Data. The Sub-Processor in particular shall provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Data Protection Laws. Where a Sub-Processor fails to fulfil its data protection obligations, the Data Processor shall remain fully liable to the Data Controller for the performance of that Sub-Processor's obligations.

7. Data Breaches

1. The Data Processor shall notify the Data Controller on Data Breach without undue delay. The notification shall include:

   1. description of the Data Breach, including, if possible, the categories of data and records concerned, the category and number of Data Subjects affected;

   2. likely consequences of the Data Breach;

   3. measures taken or proposed to address and/or mitigate the effects of the Data Breach.

2. The Data Processor shall, without undue delay, take all urgent measures as are agreed by the Parties or necessary under the Data Protection Laws, to investigate, mitigate and remedy the Data Breach and to protect the Personal Data.

3. Each Party needs the prior approval of the other Party to include and identify it in the breach notifications. The other Party should not delay or withhold the approval without a reasonable cause.

8. Cooperation

1. Upon request, the Data Processor shall assist the Data Controller to comply with its obligations under the Data Protection Laws when related to the processing of the Personal Data, including but not limited to:

   1. Data Breaches;

   2. data protection impact assessments (DPIA);

   3. consultations with the Data Protection Authority; and

   4. enquiries, complaints, audits, or claims from any court, government official, or Data Protection Authority.

2. Taking into account the nature of the processing, the Data Processor shall assist the Data Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Data Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in the Data Protection Laws.

3. The Data Processor shall make available to the Data Controller all information necessary to comply with its obligations under the DPA and the Data Protection Laws.

4. The Data Processor shall notify the Data Controller of any requirements from an official authority as soon as possible.

5. The Data Processor shall assist the Data Controller in fulfilling its obligations concerning the requests to exercise Data Subject rights under the Data Protection Laws.

6. The Data Processor shall promptly transfer to the Data Controller any request received from the Data Subjects and shall inform the Data Subjects that they can direct their requests directly to the Data Controller. The Data Processor will only handle the requests of the Data Subjects according to the Data Controller's instructions.

9. Audit

1. Upon prior notice and no more than once a year, the Data Controller has the right to conduct an audit to verify the Data Processor's compliance with the DPA.

2. The Data Processor shall make available to the Data Controller documentation necessary to demonstrate compliance with this DPA and Data Protection Laws, in particular, to provide information about appropriate technical and organizational measures that have been implemented.

3. The Data Controller shall schedule the audit with the Data Processor at least 2 weeks in advance. The Parties shall agree upon the scope, the timing, and the duration of the audit.

4. The audit might be carried out by the Data Controller directly or by a third-party auditor appointed by the Data Controller. The Data Processor has the right to object the use of a particular third-party auditor, if it could be considered a competitor of the Data Processor.

10. Cross-border transfer of Personal Data

1. The Data Processor may transfer or otherwise process Personal Data outside the European Economic Area ("EEA") without obtaining the Data Controller's prior written consent.

2. The Data Processor may only process, or permit the processing, of Personal Data outside the EEA under the following conditions:

   1. the Data Processor is processing Personal Data in a territory in relation to which the European Commission has made an adequacy decision; or

   2. the Parties have executed Standard Contractual Clauses.

3. If the transfer requires execution of the SCC, the unchanged version of the SCC shall be deemed incorporated by reference hereto and completed as follows:

   1. Module Two will apply;

   2. in Clause 7, the optional docking clause will apply;

   3. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes shall be at least 5 (five) business days;

   4. in Clause 11, the optional language will not apply;

   5. in Clause 17, Option 1 will apply, and the SCC will be governed by the law of Ireland;

   6. in Clause 18(b), disputes shall be resolved before the courts of Ireland;

   7. Annex I of the SCC shall be deemed completed with the information set out in Annex A to this DPA and in the Agreement, Data Controller is the data exporter, Data Processor is the data importer;

   8. Annex II of the SCC shall be deemed completed with the information set out in Annex B to this DPA and in the Agreement.

11. California Consumers Privacy Rights

1. This Clause 11 is applicable to processing of Personal Information of Consumers. The terms "Personal Information" and "Consumer" shall have the meanings stipulated in the California Consumer Privacy Act of 2018, as amended from time to time ("CCPA").

2. The Data Processor shall not retain, use, or disclose Personal Information for any purpose other than for the specific purpose of performing the services specified in the Agreement.

3. The Data Processor shall not retain, use, or disclose Personal Information for a commercial purpose other than providing the services specified in the Agreement.

4. The Data Processor shall not retain, use, or disclose Personal Information outside of the direct business relationship between the Data Processor and the Data Controller.

5. The Data Processor shall refrain from selling Personal Information, as the term "sell" is defined in the CCPA.

6. The Data Processor certifies that it understands the restrictions in Clauses 11.2 – 11.5 hereof and will comply with them.

12. Termination

1. Termination of this DPA shall not affect Parties' accrued rights and obligations before or at the date of termination.

2. Upon the termination of the Agreement, whereby no further processing is required by the Agreement or Applicable Law, the Data Processor shall promptly return or irrevocably delete or remove the Personal Data.

3. The Data Processor may retain Personal Data to the extent required by Applicable Law and only to the extent and for such period as required by Data Protection Laws and always provided that Data Processor shall ensure the confidentiality of such Personal Data and shall ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the Data Protection Laws requiring its storage and for no other purpose.

13. Miscellaneous

1. In the case of conflict or ambiguity between:

   1. any provision of the DPA and any other provision of the Agreement, the provisions of the DPA shall prevail;

   2. any provision of this DPA and the SCC, the provisions of the SCC shall prevail.

Annex A to Schedule C

Details of Personal Data Processing

Annex B to Schedule C

Technical and Organizational Security Measures