This Data Protection Addendum, including all appendices (“DPA”), forms a part of the agreement, comprising the End User Agreement and the applicable Order, between Stellar Cyber Inc. (“Stellar Cyber”) and the Client (the “Agreement”). The Parties agree that this DPA sets forth their obligations with respect to the processing and security of Client Data in connection with Client’s use of the Deliverables.

1. OVERVIEW

This DPA applies only to the processing of Client Data in environments controlled by Stellar Cyber (including Stellar Cyber Subprocessors), which includes Client Data sent to Stellar Cyber by the Deliverables but does not include data that remains on Client’s premises or in any Client-selected third-party operating environments. This DPA will be effective on the Effective Date of the Agreement and will replace any terms previously applicable to the processing and security of Client Data. Capitalized terms used but not defined in this DPA have the meaning given to them in the Agreement.

2. DEFINITIONS

2.1. “Applicable Data Protection Law” means, as applicable to the processing of Client Data (including any personal data contained therein), any national, federal, European Union, state, provincial, or other privacy, data protection, or data security law or regulation.

2.2. “Client Data”, if not defined in the Agreement, means data ingested from Client endpoints, or otherwise provided, by or on behalf of Client to Stellar Cyber via Client’s use of the Deliverables, excluding System Data.

2.3. “Client Personal Data” means the personal data contained within the Client Data, including any special categories of personal data or sensitive data defined under Applicable Data Protection Law.

2.4. “EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

2.5. “Security Breach” means a breach of Stellar Cyber’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Data.

2.6. “Subprocessor” means a third party authorized as another processor under this DPA to process Client Data in order to provide the Deliverables.

2.7 “System Data” means technical, operational, diagnostic, usage, telemetry, performance, configuration, threat-intelligence, and similar data generated by or relating to the operation, performance, security, or use of the Deliverables, but excluding Client Personal Data.

2.8. The terms “personal data”, “data subject”, “controller”, and “processor” as used in this DPA have the meanings given by Applicable Data Protection Law or, absent any such meaning or law, by the EU GDPR.

2.9. The terms “personal data”, “data subject”, “controller”, and “processor” include “personal information”, “consumer”, “business”, and “service provider”, respectively, as required by Applicable Data Protection Law.

3. LEGAL COMPLIANCE AND JURISDICTION-SPECIFIC TERMS

3.1. Roles of the Parties. Stellar Cyber is a processor and Client is a controller or processor, as applicable, of Client Data.

3.2. Compliance with Law. Each Party will comply with its obligations related to the processing of Client Data under Applicable Data Protection Law.

3.3. Jurisdiction-Specific Terms. To the extent the processing of Client Data is subject to an Applicable Data Protection Law described in Appendix 3 (Jurisdiction-Specific Data Protection Laws), the corresponding terms in Appendix 3 shall also apply. In the event of a conflict between the general terms of this DPA and Appendix 3, Appendix 3 will prevail.

4. PROCESSING OF CLIENT DATA

4.1. Summary of the Processing. The subject matter and details of the processing of Client Data are described in Appendix 1 (Details of Processing of Client Data).

4.2. Stellar Cyber Obligation. Stellar Cyber shall: (a) not process Client Data other than to provide the Deliverables in accordance with the Agreement (including as set forth in this DPA and as described in Appendix 1 to this DPA) and applicable law (the “Permitted Purpose”); and (b) immediately notify Client if, in Stellar Cyber’s opinion, Applicable Data Protection Law prohibits Stellar Cyber from complying with the Permitted Purpose or Stellar Cyber is otherwise unable to comply with the Permitted Purpose.

4.3. Client Instructions and Obligation. Client hereby: (a) instructs Stellar Cyber to process Client Data for the Permitted Purpose; (b) warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out herein on behalf of each relevant controller of Client Data; and (c) warrants and represents that the relevant controller of Client Data has provided all notices and obtained all consents required by Applicable Data Protection Law to provide Client Data to Stellar Cyber under the Agreement.

5. SECURITY

5.1. Security Measures. Stellar Cyber will implement and maintain the technical and organizational measures set forth in Appendix 2 (Security Measures) (the “Security Measures”). Stellar Cyber may update the Security Measures from time to time provided that such updates do not result in a reduction of the security of the Deliverables or Stellar Cyber’s obligations under the Agreement.

5.2. Client’s Security Responsibilities. Without prejudice to Stellar Cyber’s obligations under Section 5.1 (Security Measures) and elsewhere in the Agreement, Client is responsible for its use of the Deliverables, including: (a) using the Deliverables to ensure a level of security appropriate to the risk to Client Data; (b) securing the authentication credentials, systems, and devices Client uses to access the Deliverables; and (c) backing up its Client Data as appropriate.

5.3. Client’s Security Assessment. Client agrees that the Deliverables and Security Measures implemented and maintained by Stellar Cyber provide a level of security appropriate to the risk to Client Data.

5.4. Confidentiality. Stellar Cyber shall ensure that its personnel engaged in the processing of Client Data (a) will process such data only on instructions from Client or as described in this DPA, and (b) will be obligated to maintain the confidentiality and security of such data even after their engagement ends. Stellar Cyber shall provide periodic and mandatory data privacy and security training and awareness to its employees in accordance with Applicable Data Protection Law and industry standards.

5.5. Security Breaches.

5.5.1. Notification. Stellar Cyber shall notify Client promptly and in any event within 72 hours upon becoming aware of a Security Breach, and promptly take reasonable steps to minimize harm and secure Client Data.

5.5.2. Details of Notification. Stellar Cyber’s notification of a Security Breach will describe: (a) the nature of the Security Breach including the Client resources impacted; (b) the measures Stellar Cyber has taken, or plans to take, to address the Security Breach and mitigate its potential risk; (c) the measures, if any, Stellar Cyber recommends that Client take to address the Security Breach; and (d) the details of a contact point where more information can be obtained. If it is not possible to provide all such information at the same time, Stellar Cyber’s initial notification will contain the information then available and further information will be provided without undue delay as it becomes available.

5.5.3. No Acknowledgement of Fault or Liability. Stellar Cyber’s notification of or response to a Security Breach under this Section will not be construed as an acknowledgement by Stellar Cyber of any fault or liability with respect to the Security Breach.

6. SUBPROCESSING

6.1. Specific Consent. Client specifically authorizes Stellar Cyber to engage as Subprocessors those entities listed as of the effective date of this DPA as set out in Section 6.2 (Subprocessor Details). In addition, and without prejudice to Section 6.3 (Engagement of New Subprocessors), Client generally authorizes the engagement as Subprocessors of any other third parties (each a “New Subprocessor”).

6.2. Subprocessor Details. Information about Subprocessors, including their functions and locations, is available at section 6.3 (as may be updated by Stellar Cyber from time to time in accordance with this DPA).

6.3. Engagement of New Subprocessors. When any New Subprocessor is engaged while this DPA is in effect, Stellar Cyber shall provide Client at least thirty (30) days’ prior written notice of the engagement of any New Subprocessor, including details of the processing to be undertaken by the New Subprocessor. If, within thirty (30) days of receipt of that notice, Client notifies Stellar Cyber in writing of any objections to the proposed appointment, and further provides commercially reasonable justifications to such objections based on that New Subprocessor’s inability to adequately safeguard Client Data, then: (a) Stellar Cyber shall work with Client in good faith to address Client’s objections regarding the New Subprocessor; and (b) where Client’s concerns cannot be resolved within thirty (30) days from Stellar Cyber’s receipt of Client’s notice, notwithstanding anything in the Agreement, Client may, by providing Stellar Cyber with a written notice with immediate effect, terminate the Order(s) with respect to only those aspects which cannot be provided by Stellar Cyber without the use of the New Subprocessor.

6.4. Subprocessor Due Diligence Requirements. With respect to each Subprocessor, Stellar Cyber shall: (a) before the Subprocessor first processes Client Data, carry out adequate due diligence to ensure that the Subprocessor is capable of performing the obligations subcontracted to it in accordance with the Agreement (including this DPA); (b) periodically reassess the Subprocessor to ensure it remains capable of performing the obligations subcontracted to it in accordance with the Agreement (including this DPA); (c) ensure that the processing of Client Data by the Subprocessor is governed by a written contract including terms no less protective of Client Data than those set out in this DPA, including that the applicable data protection obligations in this DPA are imposed on the Subprocessor; and (d) remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.

7. COOPERATION

7.1. Individual Rights. Considering the nature of the processing, Stellar Cyber shall assist Client by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Client’s obligations, as reasonably understood by Client, to respond to requests to exercise individuals’ rights under Applicable Data Protection Law.

7.2. Individual Requests. Stellar Cyber shall: (a) promptly notify Client if Stellar Cyber receives a request from an individual under Applicable Data Protection Law with respect to Client Data to the extent that Stellar Cyber recognizes the request as relating to Client; and (b) ensure that Stellar Cyber does not respond to that request except on the documented instructions of Client or as required by applicable law, in which case Stellar Cyber shall to the extent permitted by applicable law inform Client of that legal requirement before Stellar Cyber responds to the request.

7.3. Impact Assessments and Consultation. To the extent Stellar Cyber is required by Applicable Data Protection Law, Stellar Cyber shall (taking into account the nature of the processing and the information available to Stellar Cyber) provide reasonable assistance to Client with any impact assessments or consultations with data protection regulators by providing information in accordance with Section 7.4 (Audits and Records).

7.4. Audits and Records. Stellar Cyber shall make available to Client upon request information necessary to demonstrate compliance with Applicable Data Protection Law and this DPA in accordance with the following procedures: (a) Stellar Cyber will provide Client with the most recent certifications and/or summary audit report(s) which Stellar Cyber has procured to regularly test, assess, and evaluate the effectiveness of the Security Measures; (b) Stellar Cyber will reasonably cooperate with Client by providing available additional information concerning the Security Measures to help Client better understand the Security Measures; and (c) if further information is required by Client to comply with its own or other controller’s audit obligations or a competent supervisory authority’s request, Client will inform Stellar Cyber and the Parties shall discuss in good faith the content and delivery of the required information.

8. DATA PROCESSING LOCATIONS

8.1. Data Hosting Location. Stellar Cyber will only host Client Data at rest in the regions offered by Stellar Cyber and selected by Client on an Order or as Client otherwise configured via the Deliverables (the “Hosting Location”).

8.2. Data Processing Location. Taking into account the safeguards set forth in this DPA, Client Data may be processed in the United States or any other country in which Stellar Cyber or its Subprocessors operate.

9. DATA DELETION

9.1. Deletion Upon Termination. Stellar Cyber shall promptly and in any event within sixty (60) days of the date of cessation of providing any Deliverables involving the processing of Client Data (the “Cessation Date”), delete all copies of Client Data, unless applicable law requires storage.

9.2. Certification of Deletion. Stellar Cyber shall provide written certification to Client that it has complied with this Section within ten (10) days of receiving Client’s written request to receive such certification.

10. GENERAL TERMS

10.1. Interpretation. With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and any other agreements between the Parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the Parties) agreements entered into or purported to be entered into after the date of this DPA, the provisions of this DPA shall prevail.

10.2. Liability. Any liability associated with failure to comply with this DPA will be subject to the limitations of liability provisions stated in the Agreement.

10.3. Invalid or Unenforceable Provisions. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (a) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible, or if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein.

IN WITNESS WHEREOF, the Parties hereto have caused this Stellar Cyber Data Protection Addendum to be executed by their duly authorized officers or representatives as of the Effective Date of the Agreement.

APPENDIX 1:

DETAILS OF PROCESSING OF CLIENT DATA

Subject matter and duration of processing

Stellar Cyber will process Client Data, including any personal data contained therein, exclusively to provide the Deliverables pursuant to the Agreement, including any retention period(s) purchased by Client for specific Deliverables. The duration of the processing will be until the expiration or termination of the Agreement, after which Stellar Cyber will delete Client Data in accordance with Section 9 (Data Deletion).

Nature and purpose of processing

Stellar Cyber will process Client Data only for the Permitted Purpose.

Categories of Data

The specific nature of Client Data processed by Stellar Cyber depends upon the Deliverables Client purchases, but broadly relates to the following categories of data:

Any log data and unstructured data from applications pulled through APIs provided to Stellar Cyber by Client in furtherance of the Deliverables.

Endpoint and endpoint log data (e.g., device name, OS information, username, IP address, processes’ name, applications’ name, logs and events).

Network and network usage data (e.g., 5-tuple in IP packets including IP addresses, URLs, certificate information, username, email address, packet size).

File data (e.g., file name, file hash, file type, file size)

User data (e.g. username, email address)

Special categories of data

The Deliverables are not intended to process special categories of personal data, and special categories of personal data are not required to deliver the Deliverables to Client. Notwithstanding the foregoing, when Client controls the data sent to Stellar Cyber, or in specific services engagements (e.g., forensic investigations requiring analysis of the underlying data), Stellar Cyber may process special categories of personal data on behalf of Client. The nature and scope of any special categories of sensitive personal data transferred may not be known until after the processing has taken place but may include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Data subjects

Data subjects include the individuals about whom data is provided to Stellar Cyber via the Deliverables by (or at the direction of) Client, and may include Client’s employees, agents, advisors, contractors, and consultants; the contact persons, customers, prospects, and business partners of Client’s channel partners and vendors; and any other authorized users of Client’s endpoints on which the Deliverables are installed or of the Deliverables.

APPENDIX 2:

SECURITY MEASURES

Stellar Cyber maintains an information security program that is designed to protect the confidentiality, integrity, and availability of Client Data (the “Stellar Cyber Information Security Program”). The Stellar Cyber Information Security Program is implemented on an organization-wide basis and is designed to ensure Stellar Cyber’s compliance with Applicable Data Protection Law. As of the Effective Date, Stellar Cyber will implement and maintain the Security Measures described in this Appendix 2, which include, but are not limited to, the following measures for ensuring the ongoing confidentiality, integrity, and availability of data and to prevent unauthorized access, use, modification, or disclosure of data:

APPENDIX 3:

JURISDICTION-SPECIFIC DATA PROTECTION LAWS

The terms in each Module of this Appendix 3 apply only where the corresponding law applies to the processing of Client Data.

MODULE 1: EUROPEAN DATA PROTECTION LAW

1. ADDITIONAL DEFINITIONS

1.1. “Adequate Country” means: (a) for data processed subject to the EU GDPR: any country within the EEA, or a country or territory that is the subject of an adequacy decision by the European Commission under Article 45(1) of the EU GDPR; (b) for data processed subject to the UK GDPR: the UK or a country or territory that is the subject of adequacy regulations under Article 45(1) of the UK GDPR and Section 17A of the Data Protection Act 2018; and/or (c) for data processed subject to the Swiss FDPA: Switzerland or a country or territory that (i) is included in the list of states whose legislation ensures an adequate level of protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) is the subject of an adequacy decision by the Swiss Federal Council under the Swiss FDPA.

1.2. “Alternative Transfer Mechanism” means a mechanism, other than the SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law (for example, the EU-U.S. Data Privacy Framework, including the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, or any other framework recognized as ensuring that participating entities provide an adequate level of protection).

1.3. “European Data Protection Law” means, as applicable: (a) the EU GDPR; (b) the UK GDPR; or (c) the Swiss FDPA.

1.4. “European Law” means, as applicable: (a) EU or EU member State law (if the EU GDPR applies to the processing of Client Data); (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Client Data); or (c) the law of Switzerland (if the Swiss FDPA applies to the processing of Client Data).

1.5. “Restricted Transfer” means the transfer or processing of Client Personal Data to or in a country that is not an Adequate Country.

1.6. “SCCs” means the SCCs (Controller-to-Processor) or the SCCs (Processor-to-Processor), as applicable.

1.7. “SCCs (Controller-to-Processor)” means the EU Standard Contractual Clauses operating under Module Two (controller to processor), as set out in Appendix 4 to this DPA.

1.8. “SCCs (Processor-to-Processor)” means the EU Standard Contractual Clauses operating under Module Three (processor to processor), as set out in Appendix 4 to this DPA.

1.9. “Swiss FDPA” means the Federal Data Protection Act of 19 June 1992 (Switzerland), as amended or replaced.

1.10. “UK GDPR” means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, and applicable secondary legislation made under the same.

1.11. “UK IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, as set out in Appendix 6 to this DPA.

2. NOTIFICATION OF COMPLIANCE

Without prejudice to Stellar Cyber’s obligations under Section 4.3 (Client Instructions and Obligation) of the DPA or any other rights or obligations of either Party under the Agreement, Stellar Cyber will immediately notify Client if, and to the extent such notice is not otherwise prohibited by European Law, in Stellar Cyber’s opinion: (a) European Law prohibits Stellar Cyber from complying with an instruction; (b) an instruction does not comply with European Data Protection Law; or (c) Stellar Cyber is otherwise unable to comply with an instruction. If Client is a processor, Client will immediately forward to the relevant controller any notice provided by Stellar Cyber under this Section.

3. DATA TRANSFERS

3.1. Restricted Transfers; Primary Mechanism. Where the processing of Client Personal Data constitutes a Restricted Transfer, Stellar Cyber will in the first instance rely on an Alternative Transfer Mechanism to provide a lawful basis for that Restricted Transfer, provided that such a mechanism has been adopted by Stellar Cyber and is available and valid for that Restricted Transfer. Stellar Cyber will, upon request, provide Client with information about the Alternative Transfer Mechanism on which it relies.

3.2. SCCs as Fallback. If and to the extent no Alternative Transfer Mechanism is available, adopted, or valid for a Restricted Transfer — including where an Alternative Transfer Mechanism on which Stellar Cyber relied is invalidated or suspended or otherwise ceases to provide a lawful basis for the Restricted Transfer — the SCCs will apply (according to whether Client is a controller and/or a processor) with respect to such Restricted Transfer between Stellar Cyber and Client. Where the UK GDPR applies to a Restricted Transfer, the SCCs are supplemented and amended by the UK IDTA set out in Appendix 6. Where the Swiss FDPA applies to a Restricted Transfer, the SCCs are supplemented by the Swiss amendments set out at the end of Appendix 4.

3.3. Information About Restricted Transfers. Stellar Cyber will provide Client with information relevant to a Restricted Transfer as described in Section 7.4 (Audits and Records) of the DPA.

3.4. SCCs Audit. If the SCCs apply as described in Section 3.2 of this Module 1, Stellar Cyber will allow Client, or an independent auditor appointed by Client, to conduct audits as described in those SCCs and, during an audit, make available all information required by those SCCs, both in accordance with Section 7.4 (Audits and Records) of the DPA.

3.5. No Modification of SCCs. Nothing in the Agreement (including this Appendix 3) is intended to modify or contradict any SCCs or prejudice the fundamental rights or freedoms of data subjects under European Data Protection Law.

3.6. Precedence of SCCs. To the extent the SCCs apply and there is any conflict or inconsistency between any SCCs and the remainder of the Agreement, including this Appendix, the SCCs will prevail.

MODULE 2: U.S. STATE DATA PROTECTION LAWS

1. ADDITIONAL DEFINITIONS

1.1. “CCPA” means the California Consumer Privacy Act of 2018, as amended, including as amended by the California Privacy Rights Act of 2020, together with all implementing regulations.

1.2. “CPA” means the Colorado Privacy Act, Colo. Rev. Stat. §§ 6-1-1301 et seq., and all implementing regulations.

1.3. “CTDPA” means the Connecticut Data Privacy Act and all implementing regulations.

1.4. “UCPA” means the Utah Consumer Privacy Act, Utah Code Ann. §§ 13-61-101 et seq., and all implementing regulations.

1.5. “VCDPA” means the Virginia Consumer Data Protection Act, Va. Code Ann. §§ 59.1-575 et seq., and all implementing regulations.

1.6. “U.S. Data Protection Law” means, as applicable, the CCPA, the CPA, the CTDPA, the UCPA, the VCDPA, and all other laws and regulations relating to data protection, the processing of personal data, privacy, and/or electronic communications in force from time to time in the United States.

2. PROHIBITIONS

Without prejudice to Stellar Cyber’s obligations under Section 4.3 (Client Instructions and Obligation) of the DPA, with respect to the processing of Client Data in accordance with the CCPA, Stellar Cyber will not, unless otherwise permitted under U.S. Data Protection Law: (a) sell or share Client Data; (b) retain, use, or disclose Client Data for any purpose other than those specified in the Agreement and the DPA; (c) retain, use, or disclose Client Data for any commercial purpose other than the business purpose specified in the Agreement and the DPA, including in the servicing of a different business; (d) retain, use, or disclose Client Data outside the direct business relationship between Stellar Cyber and Client; or (e) combine or update Client Data with any other personal information that Stellar Cyber receives from or on behalf of a third party or collects from its own interactions with the consumer.

3. NOTIFICATION OF COMPLIANCE

Without prejudice to Stellar Cyber’s obligations under Section 4.3 (Client Instructions and Obligation) of the DPA, or any other rights or obligations of either Party under the Agreement, Stellar Cyber will notify Client if, in Stellar Cyber’s opinion, Stellar Cyber is unable to meet its obligations under U.S. Data Protection Law, unless such notice is prohibited by applicable law.

4. DEIDENTIFIED DATA

If Client Data contains deidentified data, Stellar Cyber will (a) take reasonable measures to ensure the information cannot be associated with a consumer; (b) publicly commit to process deidentified data solely in deidentified form and not attempt to reidentify the information; and (c) contractually obligate any recipients of deidentified data to comply with the foregoing requirements and U.S. Data Protection Law.

5. CLIENT REMEDIATION

Stellar Cyber grants Client the right, upon reasonable notice, to take reasonable and appropriate steps to stop and remediate any and all unauthorized use of Client Data.

APPENDIX 4:

EU STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1

Purpose and scope

The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

The Parties: (i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (“entity/ies”) transferring the personal data, as listed in Annex I.A. (each “data exporter”), and (ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (each “data importer”) have agreed to these standard contractual clauses (“Clauses”).

These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2

Effect and invariability of the Clauses

These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions: (i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7; (ii) Clause 8 — Module One: Clause 8.5(e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1(b) and Clause 8.3(b); (iii) Clause 9 — Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e); (iv) Clause 12 — Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d) and (f); (v) Clause 13; (vi) Clause 15.1(c), (d) and (e); (vii) Clause 16(e); (viii) Clause 18 — Modules One, Two and Three: Clause 18(a) and (b); Module Four: Clause 18.

Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7 — Optional

Docking clause

An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II — OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

MODULE ONE: Transfer controller to controller

8.1 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose: (i) where it has obtained the data subject’s prior consent; (ii) where necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or (iii) where necessary in order to protect the vital interests of the data subject or of another natural person.

8.2 Transparency

In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter, of its identity and contact details; of the categories of personal data processed; of the right to obtain a copy of these Clauses; and, where it intends to onward transfer the personal data, of the recipient or categories of recipients, the purpose of such onward transfer and the ground therefor pursuant to Clause 8.7. This obligation does not apply where the data subject already has the information or where providing it proves impossible or would involve a disproportionate effort, in which case the data importer shall, to the extent possible, make the information publicly available. On request, the Parties shall make a copy of these Clauses available to the data subject free of charge, subject to appropriate redactions to protect business secrets or other confidential information. These paragraphs are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.3 Accuracy and data minimization

Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date, and shall take every reasonable step to ensure that inaccurate data is erased or rectified without delay. Where a Party becomes aware that personal data it has transferred or received is inaccurate or outdated, it shall inform the other Party without undue delay. The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.

8.4 Storage limitation

The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed, and shall put in place appropriate technical or organizational measures to ensure compliance with this obligation, including erasure or anonymization of the data and all back-ups at the end of the retention period.

8.5 Security of processing

The data importer and, during transmission, also the data exporter shall implement appropriate technical and organizational measures to ensure the security of the personal data, including protection against a personal data breach, taking due account of the state of the art, the costs of implementation, and the nature, scope, context and purpose(s) of processing and the risks involved. The Parties have agreed on the measures set out in Annex II, and the data importer shall carry out regular checks to ensure they continue to provide an appropriate level of security. The data importer shall ensure that persons authorized to process the personal data are subject to confidentiality. In the event of a personal data breach, the data importer shall take appropriate measures to address it and, where it is likely to result in a risk to the rights and freedoms of natural persons, shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13, with the information required by the Clauses; where likely to result in a high risk, it shall also notify the affected data subjects unless mitigating measures have been applied. The data importer shall document all relevant facts relating to the breach.

8.6 Sensitive data

Where the transfer involves sensitive data, the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved.

8.7 Onward transfers

The data importer shall not disclose the personal data to a third party located outside the European Union unless the third party is or agrees to be bound by these Clauses, under the appropriate Module, or unless one of the conditions set out in Clause 8.7(i)–(vi) of the Approved EU SCCs applies (including transfer to an adequate country, appropriate safeguards under Articles 46 or 47, a binding instrument ensuring equivalent protection, necessity for legal claims, protection of vital interests, or the data subject’s explicit consent). Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.8 Processing under the authority of the data importer

The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.

8.9 Documentation and compliance

Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility and shall make such documentation available to the competent supervisory authority on request.

MODULE TWO: Transfer controller to processor

8.1 Instructions

The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract. The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge, subject to appropriate redactions. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify that it has done so, or return all such personal data and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. Where local laws prohibit return or deletion, the data importer warrants it will continue to ensure compliance and will only process the data to the extent and for as long as required under that local law.

8.6 Security of processing

The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, taking due account of the state of the art, costs, and the nature, scope, context and purpose(s) of processing and the risks involved. The data importer shall at least implement the measures specified in Annex II and shall carry out regular checks. It shall grant access to personal data to members of its personnel only to the extent strictly necessary and shall ensure they are subject to confidentiality. In the event of a personal data breach, the data importer shall take appropriate measures to address it and shall notify the data exporter without undue delay after becoming aware, with the information required by the Clauses; where not all information is available at once, it may be provided in phases without undue further delay. The data importer shall cooperate with and assist the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and affected data subjects.

8.7 Sensitive data

Where the transfer involves sensitive data, the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if one of the conditions in Clause 8.8(i)–(iv) applies (adequacy, appropriate safeguards under Articles 46 or 47, necessity for legal claims, or protection of vital interests). Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses. The Parties shall be able to demonstrate compliance with these Clauses, and the data importer shall keep appropriate documentation. The data importer shall make available to the data exporter all information necessary to demonstrate compliance and shall allow for and contribute to audits, at reasonable intervals or where there are indications of non-compliance; the data exporter may conduct the audit itself or mandate an independent auditor, and may take into account relevant certifications held by the data importer. The Parties shall make audit results available to the competent supervisory authority on request.

MODULE THREE: Transfer processor to processor

8.1 Instructions

The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing. The data importer shall process the personal data only on documented instructions from the controller as communicated by the data exporter, and any additional documented instructions from the data exporter that do not conflict with the controller’s instructions. The data importer shall immediately inform the data exporter if it is unable to follow those instructions. The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act between the controller and the data exporter.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller (as communicated by the data exporter) or from the data exporter.

8.3 – 8.4 Transparency and accuracy

On request, the data exporter shall make a copy of these Clauses available to the data subject free of charge, subject to appropriate redactions. If the data importer becomes aware that the personal data is inaccurate or outdated, it shall inform the data exporter without undue delay and cooperate to rectify or erase the data.

8.5 Duration of processing and erasure or return of data

Processing shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete or return all personal data processed on behalf of the controller and delete existing copies, and shall continue to ensure compliance with these Clauses until the data is deleted or returned. Where local laws prohibit return or deletion, the data importer warrants it will continue to ensure compliance and only process the data to the extent and for as long as required under that local law.

8.6 Security of processing

The Parties shall implement appropriate technical and organizational measures to ensure the security of the data, taking due account of the state of the art, costs, and the nature, scope, context and purpose(s) of processing and the risks involved. The data importer shall at least implement the measures in Annex II, grant personnel access only as strictly necessary, ensure confidentiality, and in the event of a personal data breach take appropriate measures and notify the data exporter (and, where appropriate and feasible, the controller) without undue delay with the information required by the Clauses. The data importer shall cooperate with and assist the data exporter so that the controller may notify the competent supervisory authority and affected data subjects.

8.7 – 8.8 Sensitive data and onward transfers

Where the transfer involves sensitive data, the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B. The data importer shall only disclose the personal data to a third party on documented instructions from the controller as communicated by the data exporter, and only to a third party outside the European Union where the third party is or agrees to be bound by these Clauses, under the appropriate Module, or where adequacy, appropriate safeguards under Articles 46 or 47, necessity for legal claims, or protection of vital interests applies. Any onward transfer is subject to compliance with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller, keep appropriate documentation, make all information necessary to demonstrate compliance available to the data exporter (which shall provide it to the controller), and allow for and contribute to audits by the data exporter (including on the controller’s instructions), at reasonable intervals or where there are indications of non-compliance. The data exporter may conduct the audit itself or mandate an independent auditor. The Parties shall make audit results available to the competent supervisory authority on request.

MODULE FOUR: Transfer processor to controller

8.1 Instructions

The data exporter shall process the personal data only on documented instructions from the data importer acting as its controller, and shall immediately inform the data importer if it is unable to follow those instructions, including if they infringe Regulation (EU) 2016/679 or other Union or Member State data protection law. The data importer shall refrain from any action that would prevent the data exporter from fulfilling its obligations under Regulation (EU) 2016/679. After the end of the provision of the processing services, the data exporter shall, at the choice of the data importer, delete or return all personal data processed on its behalf and delete existing copies.

8.2 – 8.3 Security of processing and confidentiality

The Parties shall implement appropriate technical and organisational measures to ensure the security of the data, including during transmission. The data exporter shall assist the data importer in ensuring appropriate security and, in case of a personal data breach concerning the data it processes, shall notify the data importer without undue delay and assist in addressing it. The data exporter shall ensure that persons authorised to process the personal data are subject to confidentiality.

Clause 9

Use of sub-processors

MODULE TWO and MODULE THREE

OPTION 2: GENERAL WRITTEN AUTHORISATION. The data importer has the data exporter’s (Module Two) or controller’s (Module Three) general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter (or, for Module Three, the controller, and shall inform the data exporter) in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving sufficient time to object prior to the engagement of the sub-processor(s), and shall provide the information necessary to enable the exercise of the right to object. The list of authorised sub-processors is set out in Annex III, which the Parties shall keep up to date.

Where the data importer engages a sub-processor, it shall do so by way of a written contract providing, in substance, the same data protection obligations as those binding the data importer under these Clauses, including third-party beneficiary rights for data subjects. By complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure the sub-processor complies with the obligations to which the data importer is subject.

The data importer shall provide, at the data exporter’s (or, for Module Three, the data exporter’s or controller’s) request, a copy of the sub-processor agreement and any subsequent amendments, subject to appropriate redactions.

The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations and shall notify the data exporter of any failure by the sub-processor to fulfil its obligations.

The data importer shall agree a third-party beneficiary clause with the sub-processor whereby, if the data importer has factually disappeared, ceased to exist in law or become insolvent, the data exporter shall have the right to terminate the sub-processor contract and instruct the sub-processor to erase or return the personal data. This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module in accordance with Clause 7.

Clause 10

Data subject rights

MODULE TWO: Transfer controller to processor

The data importer shall promptly notify the data exporter of any request it has received from a data subject, and shall not respond to that request itself unless authorised to do so by the data exporter.

The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests under Regulation (EU) 2016/679. The Parties shall set out in Annex II the appropriate technical and organisational measures by which the assistance shall be provided, and the scope and extent of the assistance required.

In fulfilling its obligations, the data importer shall comply with the instructions from the data exporter.

MODULE THREE: Transfer processor to processor

The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request received from a data subject, without responding unless authorised to do so by the controller.

The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests. The Parties shall set out in Annex II the appropriate measures and the scope and extent of assistance required.

In fulfilling its obligations, the data importer shall comply with the instructions from the controller, as communicated by the data exporter.

Clause 11

Redress

The data importer shall inform data subjects, in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints, and shall deal promptly with any complaints. In case of a dispute between a data subject and a Party regarding compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion, and the Parties shall keep each other informed and cooperate. Where a data subject invokes a third-party beneficiary right, the data importer shall accept the data subject’s decision to lodge a complaint with the competent supervisory authority or to refer the dispute to the competent courts within the meaning of Clause 18. The data subject may be represented by a not-for-profit body, organisation or association under Article 80(1) of Regulation (EU) 2016/679.

Clause 12

Liability

MODULE TWO and MODULE THREE

Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

Notwithstanding the foregoing, the data exporter shall be liable to the data subject for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes by breaching the third-party beneficiary rights, without prejudice to the liability of the data exporter (and, where it is a processor acting for a controller, the controller) under Regulation (EU) 2016/679.

Where the data exporter is held liable for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer the corresponding part of the compensation. Where more than one Party is responsible, all responsible Parties shall be jointly and severally liable, with rights of contribution between them. The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13

Supervision

The competent supervisory authority is identified in Annex I.C. The data importer agrees to submit to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses, including responding to enquiries, submitting to audits, and complying with measures adopted by the authority, and shall provide written confirmation that the necessary actions have been taken.

SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. In providing this warranty, the Parties have taken due account in particular of: the specific circumstances of the transfer; the laws and practices of the third country of destination relevant in light of those circumstances, and the applicable limitations and safeguards; and any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses. The data importer warrants that it has made its best efforts to provide the data exporter with relevant information and will continue to cooperate. The Parties agree to document the assessment and make it available to the competent supervisory authority on request. The data importer agrees to notify the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with these requirements; following such notification, or where the data exporter otherwise has reason to believe the data importer can no longer fulfil its obligations, the data exporter shall promptly identify appropriate measures and, if no appropriate safeguards can be ensured (or if instructed by the competent supervisory authority), shall suspend the transfer and may terminate the contract insofar as it concerns the processing of personal data under these Clauses.

Clause 15

Obligations of the data importer in case of access by public authorities

15.1 Notification

The data importer agrees to notify the data exporter and, where possible, the data subject promptly if it receives a legally binding request from a public authority for disclosure of personal data transferred pursuant to these Clauses, or becomes aware of any direct access by public authorities, including the information specified in the Clauses. If prohibited from notifying, the data importer agrees to use its best efforts to obtain a waiver of the prohibition and to document those efforts. Where permissible, the data importer shall provide the data exporter, at regular intervals, with relevant information on the requests received, and shall preserve such information for the duration of the contract and make it available to the competent supervisory authority on request.

15.2 Review of legality and data minimisation

The data importer agrees to review the legality of any request for disclosure, to challenge the request where it concludes on reasonable grounds that it is unlawful, and to pursue possibilities of appeal, seeking interim measures and not disclosing the requested personal data until required to do so under the applicable procedural rules. The data importer agrees to document its legal assessment and any challenge and, to the extent permissible, make it available to the data exporter and the competent supervisory authority. The data importer agrees to provide the minimum amount of information permissible when responding to a request, based on a reasonable interpretation of it.

SECTION IV — FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses. Where the data importer is in breach or unable to comply, the data exporter shall suspend the transfer until compliance is again ensured or the contract is terminated. The data exporter may terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where: (i) it has suspended the transfer and compliance is not restored within a reasonable time and in any event within one month of suspension; (ii) the data importer is in substantial or persistent breach; or (iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority. Personal data transferred prior to termination shall, at the choice of the data exporter, be returned or deleted in its entirety, including copies, and the data importer shall certify deletion. Either Party may revoke its agreement to be bound where the European Commission adopts an adequacy decision covering the transfer or Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the data is transferred.

Clause 17

Governing law

These Clauses are governed by the law of an EU Member State, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Netherlands.

Clause 18

Choice of forum and jurisdiction

Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State, and the Parties agree that those shall be the courts of the Netherlands. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence. The Parties agree to submit to the jurisdiction of such courts.

APPENDIX TO THE STANDARD CONTRACTUAL CLAUSES

ANNEX I.A — LIST OF PARTIES

Data exporter: Client, as identified in the Agreement. Data importer: Stellar Cyber Inc., as identified in the Agreement.

ANNEX I.B — DESCRIPTION OF TRANSFER

Categories of data subjects: all of the data exporter’s employees, agents, advisors, subcontractors, or contact persons of Client’s channel partners, customers, prospects, business partners and vendors, and any other users of Client’s endpoints on which the Deliverables are installed, or other authorized users of the Deliverables.

Categories of personal data transferred:

Client company details; titles, emails, phone numbers, and names of Client representatives; billing information; business information; and other data or information that Client decides to provide to Stellar Cyber by or through the Deliverables or any other means.

User and endpoint data: agent ID, endpoint name, active directory user ID, user name, installed applications (installation time, size, publisher, and version), SMTP user name, and configuration data related to active directory integration.

File full path (will only include personal data if the file name as named by Client includes personal data).

Network data (internal network IP address, public IP address, MAC address).

Reconstructed files: files reconstructed over the network.

System settings received from the Management Console (user names, emails, and phone numbers).

Threat information (file path, intrusion detection signature, which may include user names, IP addresses, and file names).

Live network monitoring (URLs, URL headers, time stamps).

Where Client triggers functionality of the Deliverables that enables Client or Client’s administrators to cause files to be retrieved, collected, or transmitted to Stellar Cyber for analysis.

Sensitive data transferred: see Appendix 1 (Details of Processing of Client Data), “Special categories of data.” Frequency of the transfer: continuous during the term of the Agreement. Purpose(s) of the data transfer and further processing: Stellar Cyber is engaged to provide the Deliverables to Client, which involve the processing of personal data as necessary to deliver the Deliverables and comply with the Agreement and this DPA. Retention period: the duration of the processing will be until the expiration or termination of the Agreement, after which Client Data is deleted in accordance with Section 9 (Data Deletion). For transfers to sub-processors: Stellar Cyber uses sub-processors to support its infrastructure environment, telecommunications and networking, and data storage and content delivery; personal data is processed by sub-processors for the purposes and duration of the relevant Stellar Cyber services agreement or ordering document. See the list of sub-processors in Annex III.

Frequency of transfer: continuous during the term of the Agreement.

ANNEX I.C — COMPETENT SUPERVISORY AUTHORITY

For matters related to data transfers pursuant to Regulation (EU) 2016/679: the Autoriteit Persoonsgegevens of the Netherlands (https://www.autoriteitpersoonsgegevens.nl/en).

ANNEX II — TECHNICAL AND ORGANISATIONAL MEASURES

The technical and organisational measures implemented by the data importer are those set out in Appendix 2 (Security Measures) to this DPA. For transfers to sub-processors, Stellar Cyber requires its sub-processors to comply with materially equivalent technical and organisational measures as those adopted by Stellar Cyber.

ANNEX III — LIST OF SUB-PROCESSORS

The controller has authorized the use of the sub-processors which is found and updated at section 6.3.

SWISS SUPPLEMENT

The following terms supplement the Standard Contractual Clauses only if and to the extent the Standard Contractual Clauses apply with respect to data transfers subject to the Federal Data Protection Act of 19 June 1992 (Switzerland): the term “Member State” will be interpreted in such a way as to allow a data subject in Switzerland to exercise their rights under the Clauses in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of these Clauses.

APPENDIX 5:

UK INTERNATIONAL DATA TRANSFER ADDENDUM

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1 (Parties): The Exporter (who sends the Restricted Transfer) and the Importer (who receives the Restricted Transfer) and their details are as specified in the Agreement. Start Date: the Effective Date of the Agreement.

Table 2 (Selected SCCs, Modules and Selected Clauses): The version of the Approved EU SCCs to which this Addendum is appended, including the Appendix Information, is the version set out in Appendix 4 to this DPA.

Table 3 (Appendix Information): “Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in the Annexes to the Standard Contractual Clauses in Appendix 4 to this DPA.

Table 4 (Ending this Addendum when the Approved Addendum changes): Either the Importer or the Exporter may end this Addendum as set out in Section 19 of the Mandatory Clauses.

Part 2: Mandatory Clauses

Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum. Although Annex 1.A. and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

When this Addendum uses terms that are defined in the Approved EU SCCs, those terms shall have the same meaning as in the Approved EU SCCs. In addition: “Addendum” means this International Data Transfer Addendum, incorporating the Addendum EU SCCs; “Addendum EU SCCs” means the version(s) of the Approved EU SCCs to which this Addendum is appended, including the Appendix Information; “Appropriate Safeguards” means the standard of protection over the personal data and of data subjects’ rights required by UK Data Protection Laws when making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR; “Approved Addendum” means the template Addendum issued by the ICO and laid before Parliament under s119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18; “Approved EU SCCs” means the Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021; “ICO” means the Information Commissioner; “Restricted Transfer” means a transfer which is covered by Chapter V of the UK GDPR; “UK” means the United Kingdom of Great Britain and Northern Ireland; “UK Data Protection Laws” means all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018; and “UK GDPR” has the meaning given in section 3 of the Data Protection Act 2018.

This Addendum must always be interpreted in a manner consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligations to provide the Appropriate Safeguards. If any provision of the Addendum EU SCCs amends the Approved EU SCCs in a way not permitted under the Approved EU SCCs or the Approved Addendum, that amendment will not be incorporated and the equivalent provision of the Approved EU SCCs will take its place. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws apply; and where the meaning is unclear, the meaning that most closely aligns with UK Data Protection Laws applies. References to legislation mean that legislation as it may change over time.

Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements, the Parties agree that, for Restricted Transfers, the hierarchy in Section 10 of the Mandatory Clauses will prevail. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs, the Approved Addendum overrides the Addendum EU SCCs, except where the conflicting terms of the Addendum EU SCCs provide greater protection for data subjects, in which case those terms override the Approved Addendum.

Incorporation of and changes to the EU SCCs

This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that: (a) together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing, and they provide Appropriate Safeguards for those transfers; (b) Sections 9 to 11 of the Mandatory Clauses override Clause 5 (Hierarchy) of the Addendum EU SCCs; and (c) this Addendum is governed by the laws of England and Wales and any dispute arising from it is resolved by the courts of England and Wales, unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

The following amendments to the Addendum EU SCCs are made: references to the “Clauses” mean this Addendum, incorporating the Addendum EU SCCs; in Clause 2, the words “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679” are deleted; Clause 6 is replaced with: “The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer”; Clause 8.7(i) of Module One and Clause 8.8(i) of Modules Two and Three are replaced to refer to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR; references to “Regulation (EU) 2016/679” and “that Regulation” are replaced by “UK Data Protection Laws,” and references to specific Articles by the equivalent Article or Section of UK Data Protection Laws; references to Regulation (EU) 2018/1725 are removed; references to the “European Union,” “Union,” “EU,” “EU Member State,” “Member State” and “EU or Member State” are replaced with the “UK”; the reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module One is replaced with “Clause 11(c)(i)”; Clause 13(a) and Part C of Annex I are not used; “competent supervisory authority” and “supervisory authority” are replaced with the “Information Commissioner”; in Clause 16(e), subsection (i) is replaced with “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these Clauses apply”; Clause 17 is replaced with “These Clauses are governed by the laws of England and Wales”; and Clause 18 is replaced with “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.” The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

The Parties may agree to change Clause 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland, and may change the format of the information in Part 1: Tables by written agreement, provided the change does not reduce the Appropriate Safeguards. From time to time the ICO may issue a revised Approved Addendum that makes reasonable and proportionate changes and/or reflects changes to UK Data Protection Laws; this Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified. Where a revised Approved Addendum would, as a direct result, cause a Party selected in Table 4 to incur a substantial, disproportionate and demonstrable increase in its direct costs and/or risk under the Addendum (having first taken reasonable steps to reduce them), that Party may end this Addendum at the end of a reasonable notice period by written notice given before the start date of the revised Approved Addendum. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

SCHEDULE 6.3