1.10 “ex-UK Transfer” means the transfer of Personal Data, which is processed in accordance with the UK GDPR
and the Data Protection Act 2018, from the Data Exporter to the Data Importer (or its premises) outside the United
Kingdom (the “UK”), and such transfer is not governed by an adequacy decision made by the Secretary of State in
accordance with the relevant provisions of the UK GDPR and the Data Protection Act 2018.
1.11 “Services” shall have the meaning set forth in the Agreement.
1.12 “Standard Contractual Clauses” means the EU SCCs and the UK SCCs.
1.13 “UK SCCs” means the standard contractual clauses approved by the European Commission for transfers of
personal data to countries not otherwise recognized as offering an adequate level of protection for personal data
by the European Commission, being either (i) controller-to-processor clauses as approved by the European
Commission in Commission Decision 2010/87/EU, dated 5 February 2010 (as amended and updated from time to
time) (“UK Controller-to-Processor SCCs”); or (ii) controller-to-controller clauses as approved by the European
Commission in Commission Decision 2004/915/EC, dated 27 December 2004 (as amended and updated from time
to time) (“UK Controller-to-Controller SCCs”).
2. Relationship of the Parties; Processing of Data
2.1 The parties acknowledge and agree that with regard to the processing of Personal Data, Customer may act
either as a controller or processor and, except as expressly set forth in this Addendum or the Agreement, Company
is a processor. Customer shall, in its use of the Services, at all times process Personal Data, and provide instructions
for the processing of Personal Data, in compliance with Data Protection Laws. Customer shall ensure that the
processing of Personal Data in accordance with Customer’s instructions will not cause Company to be in breach of
the Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of (i) the Personal
Data provided to Company by or on behalf of Customer, (ii) the means by which Customer acquired any such
Personal Data, and (iii) the instructions it provides to Company regarding the processing of such Personal Data.
Customer shall not provide or make available to Company any Personal Data in violation of the Agreement or
otherwise inappropriate for the nature of the Services, and shall indemnify Company from all claims and losses in
connection therewith.
2.2 Company shall not process Personal Data (i) for purposes other than those set forth in the Agreement
and/or Exhibit A, (ii) in a manner inconsistent with the terms and conditions set forth in this Addendum or any
other documented instructions provided by Customer, including with regard to transfers of personal data to a third
country or an international organization, unless required to do so by Supervisory Authority to which the Company
is subject; in such a case, the Company shall inform the Customer of that legal requirement before processing,
unless that law prohibits such information on important grounds of public interest, or (iii) in violation of Data
Protection Laws. Customer hereby instructs Company to process Personal Data in accordance with the foregoing
and as part of any processing initiated by Customer in its use of the Services.
2.3 The subject matter, nature, purpose, and duration of this processing, as well as the types of Personal Data
collected and categories of Data Subjects, are described in Exhibit A to this Addendum.
2.4 Following completion of the Services, at Customer’s choice, Company shall return or delete Customer’s
Personal Data, unless further storage of such Personal Data is required or authorized by applicable law. If return or
destruction is impracticable or prohibited by law, rule or regulation, Company shall take measures to block such
Personal Data from any further processing (except to the extent necessary for its continued hosting or processing
required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its
possession, custody, or control. If Customer and Company have entered into Standard Contractual Clauses as
described in Section 6 (Transfers of Personal Data), the parties agree that the certification of deletion of Personal
Data that is described in Clause 12(1) of the UK SCCs and Clause 8.1(d) and Clause 8.5 of the EU SCCs (as applicable)
shall be provided by Company to Customer only upon Customer’s request.
2.5 CCPA. Except with respect to Customer Account Data and Customer Usage Data, the parties acknowledge
and agree that Company is a service provider for the purposes of the CCPA (to the extent it applies) and is receiving
personal information from Customer in order to provide the Services pursuant to the Agreement, which constitutes
a business purpose. Company shall not sell any such personal information. Company shall not retain, use or