Common use of Customer Data Clause in Contracts

Customer Data. 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such archiving procedure. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 The Supplier shall, in providing the Services, comply with its Data Protection Policy relating to the privacy and security of the Customer Data as may be notified to the Customer from time to time. 4.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇▇://▇▇▇▇▇▇▇.▇▇/GDPR/security-and-data- protection/servers-security#a174 as such document may be notified to amended by the Customer Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇▇://▇▇▇▇▇▇▇▇▇.▇▇/staffwise_privacy.pdf or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. The client will be notified 30 days before any amends. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored temporarily outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 10.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier 10.2 CoolCare shall follow its archiving procedures for Customer Data as set out in its Back- Up Policy available at ▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by CoolCare from time to time in its sole discretion (the “Back-Up Policy”). In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier CoolCare to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier CoolCare in accordance with such the archiving procedureprocedure described in the Back-Up Policy. The Supplier CoolCare shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier CoolCare to perform services related to Customer Data maintenance and back-up). 4.3 The Supplier 10.3 CoolCare shall, in providing the Services, comply with its Data Protection Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by CoolCare from time to time in its sole discretion. 4.4 If 10.4 The Customer grants CoolCare the Supplier processes any personal right to compile, collect, copy, modify, publish and use anonymous data on the in aggregate form that is generated from, or based upon, Customer’s behalf when performing its obligations under this agreement, use of the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such caseServices (“Aggregate Data”); provided that: (a) Aggregate Data does not include Customer Data or any of the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the SupplierCustomer’s other obligations under this agreementConfidential Information; (b) the Customer shall ensure Aggregate Data does not include any information that the Customer is entitled can be used directly, or in connection with other data, to transfer the relevant personal data to the Supplier so that the Supplier may lawfully useidentify, process and transfer the personal data in accordance with this agreement on the Customer's behalfcontact or locate an individual; (c) Aggregate Data is combined with data from other customers and cannot be used to identify, directly or indirectly, the Customer shall ensure that Customer; and Processors under Data Protection Legislation in respect of the relevant third parties have been informed of, performance of its obligations under this Agreement and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damageAgreement.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer as such document may be amended by the Supplier in its sole discretion from time to timetime the current version of which is set out at Schedule 3 of this Agreement. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data as such document may be notified to the Customer amended from time to timetime by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (cb) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (dc) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (ed) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 5.5 The Supplier and the Customer shall comply with their respective obligations as set out in Schedule 4 of this Agreement

Customer Data. 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier Siemens shall follow its archiving procedures for Customer Data as set out in its Data Management Principles for Stratos document available as a pdf at ▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇/Footer/Legalor such other website address as may be notified to the Customer from time to time, as such document may be amended by Siemens in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier Siemens to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier Siemens in accordance with such the archiving procedure. The Supplier shall not be responsible procedure described in its Data Management Principles for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up)Stratos document. 4.3 The Supplier Siemens shall, in providing the Services, comply with its Data Protection Policy Security Principles for Stratos document relating to the privacy and security of the Customer Data available as a pdf at ▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇/Footer/Legal or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by Siemens in its sole discretion. 4.4 If the Supplier processes any personal data on the Customer’s 's behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (cb) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (dc) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (ed) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 4.5 Siemens shall own the Siemens Data. During the Subscription Term, the Customer shall have access to the Siemens Data. At the end of the Subscription Term the Customer shall return to Siemens all the Siemens Data.

Customer Data. 4.1 5.1. The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2. The Supplier shall follow its archiving procedures for Customer Data as set out in its Back- Up Policy available at such website address as may be notified to the Customer from time to time, as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back- Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-sub- contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3. The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at such website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4. If the Supplier processes any personal data on the Customer’s 's behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) 5.4.1. the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) 5.4.2. the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) 5.4.3. the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) 5.4.4. each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. The customer being a contractor of DSA Airport, the customer shall not own the rights, title and interest in and to the Data which belongs to DSA Airport. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back- Up Policy available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted subcontracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to timeData. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours endeavors to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedure. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at the website assigned to the Customer by the Supplier, or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country state where the Customer and the Authorised Authorized Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational organizational measures against unauthorised unAuthorized or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy, as such document may be notified to amended by the Customer Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier customer shall not be hold the supplier responsible for any loss, destruction, alteration or disclosure of Customer Data if caused by any third party (except those under the subcontract of the customer. Likewise, the supplier is responsible for any loss, destruction, alteration or disclosure cause by any third parties sub-contracted by party under the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 subcontract of the supplier. The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data Data, as such document may be notified to the Customer amended from time to timetime by the Supplier in its sole discretion. 4.4 If 5.3 The parties acknowledge that, for the Supplier processes any personal data on the Customer’s behalf when performing its obligations under purposes of this agreementAgreement, the parties record their intention that the Customer shall be is the data controller and the Supplier shall be a is the data processor (each within the meaning of the DPA). The parties shall give each other all reasonable assistance as appropriate or necessary to enable each other to comply with their data protection duties under this Agreement and the DPA. Where the Supplier is Processing Personal Data on behalf of the Customer under or in any such caseconnection with this Agreement, the Supplier shall: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order only Process such Personal Data as is necessary to carry out the Services and the Supplier’s other perform its obligations under this agreementAgreement and only in accordance with any instructions given by the Customer under this Agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data put in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take place appropriate technical and organisational measures against any unauthorised or unlawful processing of Personal Data and against the personal accidental loss or destruction of or damage to such Personal Data having regard to the specific requirements of this clause 5.4, the state of technical development and the level of harm that may be suffered by a data subject (as defined by the DPA) whose Personal Data is affected by unauthorised Processing or by its loss, damage or destruction; (c) keep the Personal Data confidential and not disclose it to any third party without the prior written consent of the Customer; (d) take reasonable steps to ensure the reliability of any of the Supplier’s personnel who will have access to Personal Data and ensure that such personnel are aware of and comply with the terms of this clause 5; (e) report all incidents of data loss or breach of confidence to the Customer immediately and in accordance with industry best practice and cooperate with the Customer’s compliance and information security employees to support assessment, root cause analysis and identify any corrective action required; supporting the implementation of any required corrective action as agreed between the parties; (f) not cause or allow Personal Data to be transferred outside the European Economic Area without the prior written consent of the Customer; (g) where Personal Data is processed by a sub-contractor of the Supplier in connection with this Agreement, procure that such sub-contractor shall comply with the relevant obligations set out in this clause 5 as if such sub-contractor were the Supplier; (h) permit the Customer (or a representative) to inspect and audit the Supplier’s facilities, equipment, documents and electronic data relating to the Supplier’s data processing activities. Where the Suppliers facilities relating to the Customers data processing activities reside within a third party cloud solution (for example Azure or Amazon Web Services) then the Supplier agrees to the Customer auditing the procedures, documents and any interfaces that show how the data is being processed and the agreements with said third party. (i) at the end of this Agreement, howsoever arising, delete and/or destroy all Personal Data in accordance with clause 13.3(c) and provide confirmation of such deletion/destruction to the Customer; (j) indemnify and keep the Customer indemnified against any loss, damages, costs, expenses (including without limitation legal costs and expenses), claims or proceedings whatsoever or howsoever to the extent arising from the Supplier’s (or its accidental losssub-contractor’s) unlawful or unauthorised disclosure of, processing, destruction or damageand/or damage to Personal Data in connection with this Agreement.

Customer Data. 4.1 9.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The 9.2 In relation to Services which involve the Supplier shall follow its archiving procedures for storing Customer Data as may be notified to the Customer from time to time. In and in the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore ensure that the lost or damaged Customer Data from is secure and backed up and that the latest back-up of such Customer has electronic access to the Customer Data maintained stored by the Supplier to retrieve or manipulate at any time. If the Customer has no access to the Customer Data electronically, the Supplier shall, upon the Customer’s request grant such access necessary to retrieve/manipulate Customer Data within 7 working days from the request. In the event that the Customer requires Customer Data on physical media, the Customer can raise a request and the Supplier will apply reasonable endeavours to assist the Customer with the physical retrieval of Customer Data. 9.3 On the billing anniversary following the termination date of a Service which involves the storing or hosting of Customer Data by the Supplier, all Customer Data held within the Service shall cease to be available to the Customer to access. Any Customer Data will be retained in accordance with such archiving procedure. to the extent set out in the applicable Service Option and can be retrieved by the Supplier (and then provided to the Customer in the format reasonably required) through the submission of a request to the Supplier by email. 9.4 The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 9.5 The Supplier shall, in providing the Services, comply with its Data Protection Privacy Policy relating to available on the privacy and security of the Customer Data smartCLOUD Website or such other website address as may be notified to the Customer from time to timetime and such policy may be amended from time to time by the Supplier in its sole discretion. 4.4 9.6 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) 9.6.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreementAgreement; (b) 9.6.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's behalf; (c) 9.6.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) 9.6.4 the Supplier shall process the personal data only in accordance with the terms of this agreement Agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party 9.6.5 the Supplier shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available on request in writing as such document may be notified to amended by the Customer Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-back- up). 4.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 If the Supplier processes any personal data on the Customer’s 's behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s 's other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 9.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 9.2 The Supplier shall follow its archiving the procedures for Customer Data as set out in applicable Service Option, and such procedure may be notified to amended by the Customer Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest last available back-up of such Customer Data maintained by the Supplier in accordance with such archiving procedureData. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 9.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy Policy relating to available on the privacy and security of the Customer Data InsightCloud Website or such other website address as may be notified to the Customer from time to timetime and such policy may be amended from time to time by the Supplier in its sole discretion. 4.4 9.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) 9.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreementAgreement; (b) 9.4.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's behalf; (c) 9.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) 9.4.4 the Supplier shall process the personal data only in accordance with the terms of this agreement Agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party 9.4.5 the Supplier shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 9.5 On termination of this Agreement, any Service Option or User Subscription (as the care may be) the Customer shall have 30 days to request a copy of the last back-up of the Customer Data. Thereafter, the Supplier shall be entitled to destroy the Customer Data at its discretion.

Customer Data. 4.1 5.1 The Customer and Supplier shall jointly own all rightrights, title and interest in and to all of the Customer Data and Data, the customer or its nominated users shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Policy [Privacy and Security Policy] relating to the privacy and security of the Customer Data available at Care ▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer or its users shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement, subject to customers user agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer Customer’s Group shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier 5.2 SDS shall follow its archiving procedures for Customer Data as set out in its back-up policy available at ▇▇▇.▇-▇-▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by SDS in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for the Supplier SDS to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier SDS in accordance with such the archiving procedureprocedure described in its back-up policy. The Supplier SDS shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier SDS to perform services related to Customer Data maintenance and back-up). 4.3 The Supplier 5.3 SDS shall, in providing the Services, comply with its Data Protection Policy privacy and security policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇-▇-▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by SDS in its sole discretion. 4.4 5.4 If the Supplier SDS processes any personal data on the Customer’s Group’s behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier SDS shall be a data processor and in any such case: (a) 5.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the SupplierSDS’s other obligations under this agreementAgreement. SDS will choose a UK data centre as its preferred data storage location. Should any transfer be required this will always be done subject to the implementation of the same or better legal protection as the UK; (b) 5.4.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier SDS so that the Supplier SDS may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's ’s behalf; (c) 5.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) 5.4.4 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to timeData. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours endeavors to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedure. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at the website assigned to the Customer by the Supplier, or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country state where the Customer and the Authorised Authorized Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational organizational measures against unauthorised unAuthorized or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and Authorised users shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer their Data. 4.2 The supplier and customer shall fulfil its obligations of GDPR compliance as a ‘controllers’ and ‘processors’ of data which includes ( but not limited to) • Data protection impact assessments • Data protection officers • The right to be informed • The right to erasure • The right to rectification • The right to restrict processing 4.3 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to timedescribed in Schedule 4. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in Schedule 4. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 4.4 The Supplier shall, in providing the Services, comply with its Data Protection Policy relating will need to the privacy and security of the Customer Data as may be notified to the Customer from time to time. 4.4 If the Supplier processes any process Authorised users personal data on the Customer’s their behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer users shall ensure that the Customer is they are entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's ’s behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (db) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (ec) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 4.5 The Supplier will ensure that all Health Companion Ltd Staff are aware of their responsibilities to fully comply with the provisions of the Data Protection Act (1998), including related Caldicott Guardian principles and the Computer Misuse Act (1990) and GDPR compliance. The Supplier may, at times, be required to access patient identifiable data in order to investigate and resolve system errors or data quality issues. It is the responsibility of the Supplier to ensure that its staff can: • fully justify the purpose of access, • do not access patient identifiable information unless it is absolutely necessary • access or use the minimum necessary patient identifiable information. Details of the Supplier’s Information Governance Policy can be obtained from the Operations Director at Health Companion Ltd. The Customers Security Principles should be provided to the Supplier at the Project Initiation meeting. The Supplier will be responsible for ensuring these are followed. The Customer will confirm whether explicit permissions will be required to access any patient identifiable information in order to carry out appropriate changes or investigations. The supplier will ensure that its processes enable the patient to actually consent to their data being extracted from clinical systems to populate their patient portal.

Customer Data. 4.1 6.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier 6.2 Iplicit shall follow its archiving procedures for Customer Data as set out in its Back- Up Policy available at ▇▇▇.▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇▇▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by Iplicit in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for the Supplier Iplicit to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier Iplicit in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier Iplicit shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up)party. 4.3 The Supplier 6.3 Iplicit shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇▇▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by Iplicit in its sole discretion. 4.4 6.4 If the Supplier Iplicit processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier Iplicit shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the SupplierIplicit’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier Iplicit so that the Supplier Iplicit may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's ’s behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier Iplicit shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 9.1. The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The 9.2. In relation to Services which involve the Supplier shall follow its archiving procedures for storing Customer Data as may be notified to the Customer from time to time. In and in the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore ensure that the lost or damaged Customer Data from is secure and backed up and that the latest back-up of such Customer has electronic access to the Customer Data maintained stored by the Supplier to retrieve or manipulate at any time. If the Customer has no access to the Customer Data electronically, the Supplier shall, upon the Customer’s request grant such access necessary to retrieve/manipulate Customer Data within 7 working days from the request. In the event that the Customer requires Customer Data on physical media, the Customer can raise a request and the Supplier will apply reasonable endeavours to assist the Customer with the physical retrieval of Customer Data. 9.3. On the billing anniversary following the termination date of a Service which involves the storing or hosting of Customer Data by the Supplier, all Customer Data held within the Service shall cease to be available to the Customer to access. Any Customer Data will be retained in accordance with such archiving procedureto the extent set out in the applicable Service Option and can be retrieved by the Supplier (and then provided to the Customer in the format reasonably required) through the submission of a request to the Supplier by email. 9.4. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 9.5. The Supplier shall, in providing the Services, comply with its Data Protection Privacy Policy relating to available on the privacy and security of the Customer Data InsightCloud Website or such other website address as may be notified to the Customer from time to timetime and such policy may be amended from time to time by the Supplier in its sole discretion. 4.4 9.6. If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) 9.6.1. the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreementAgreement; (b) 9.6.2. the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's behalf; (c) 9.6.3. the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) 9.6.4. the Supplier shall process the personal data only in accordance with the terms of this agreement Agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party 9.6.5. the Supplier shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to time. 5.2 In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such archiving procedurethe ESC Cloud Database. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-upthe upkeep of the ESC Cloud Database). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Policy privacy policy relating to the privacy and security of the Customer Data available on the ESC Website or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 By agreeing to these Terms and Conditions the Customer agrees to the Suppliers Privacy Policy. 5.5 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) 5.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) 5.5.4 the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) 5.5.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-sub- contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 6.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Profile Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Profile Data. 4.2 6.2 The Supplier Service Provider shall follow its archiving procedures for Customer Data (Customer Profile Data and Customer Submitted Data) performing daily-automated back-ups of the entire member data as may be notified to the Customer from time to timedescribed in Schedule 3 below. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier Service Provider to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such archiving procedureService Provider. The Supplier Service Provider shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier Service Provider to perform services related to Customer Data maintenance and back-up). 4.3 6.3 The Supplier Service Provider shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data as may be notified to the Customer from time to time.required by all applicable General Data Protection Regulation (Regulation EU 2016/679 “GDPR”); 4.4 6.4 If the Supplier Service Provider processes any personal data on the Customer’s behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier Service Provider shall be a data processor (as agreed and defined in the Data Protection Agreement signed between the two parties and included as Annex 1 to this main contract) and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier Service Provider so that the Supplier Service Provider may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's behalf; (cb) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (c) the Service Provider agrees that the personal data may not be transferred or stored outside the client’s chosen data storage region in order to carry out the Services and the Service Provider’s other obligations under this Agreement; (d) the Supplier Service Provider shall process the personal data only in accordance with the terms of this agreement Agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. (f) Regardless of the Agreement documents’ application hierarchy, Appendix 1 (Data Protection Agreement annex) will always be primarily applied in matters concerning data protection. 6.5 The Service Provider undertakes that the Services will be performed both by it and its duly authorised contractors, assigns or agents in accordance with the Documentation and with reasonable skill and care.

Customer Data. 4.1 3.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier 3.2 Orpheus shall follow its archiving procedures for Customer Data and the Analytical Data as set out in its Back-Up Policy available at ▇▇▇▇▇://▇▇▇▇▇▇▇-▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by ▇▇▇▇▇▇▇ in its sole discretion from time to time. In the event of any loss or damage to Customer Data or Analytical Data, the Customer's sole and exclusive remedy shall be for the Supplier Orpheus to use reasonable commercial endeavours to restore the lost or damaged Customer Data or Analytical Data from the latest back-up of such Customer Data or Analytical Data maintained by the Supplier Orpheus in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier Orpheus shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-sub- contracted by the Supplier Orpheus to perform services related to Customer Data maintenance and back-back- up). 4.3 The Supplier 3.3 Orpheus shall, in providing the Services, comply with its Data Protection Privacy Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇▇://▇▇▇▇▇▇▇-▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by ▇▇▇▇▇▇▇ in its sole discretion. 4.4 3.4 If the Supplier Orpheus processes any personal data Personal Data on the Customer’s 's behalf when performing its obligations under this agreement▇▇▇▇, the parties record their intention that the Customer shall be the data controller and the Supplier Orpheus shall be a data processor and processor. 3.5 Orpheus shall comply with all Data Protection Laws (which apply to it in any such case: (aits capacity as a data processor) in connection with the Customer acknowledges and agrees that processing of Personal Data in respect of the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out delivery of the Services and the Supplier’s other exercise and performance of its rights and obligations under this agreement;Agreement. (b) the 3.6 The Customer shall ensure that comply with all Data Protection Laws (which apply to it in its capacity as a data controller) in connection with the Customer is entitled processing of Personal Data in respect of the exercise and performance of its rights and obligations under this Agreement, and to transfer enable Orpheus to deliver the relevant personal data to the Supplier so that the Supplier may lawfully use, process Services. 3.7 Instructions and transfer the personal data in accordance with this agreement details of processing - Insofar as Orpheus processes Personal Data on behalf of the Customer's behalf;: 3.7.1 unless required to do otherwise by applicable laws, Orpheus shall (c) the Customer and shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (deach person acting under its authority shall) the Supplier shall process the personal data Personal Data only on and in accordance with the terms of Customer’s documented instructions as set out in this agreement clause 3 and any lawful instructions reasonably given by the Customer Schedule 2 (Data Processing Details), and as updated from time to timetime by the written agreement of the parties (Processing Instructions); and 3.7.2 if any applicable laws require it to process Personal Data other than in accordance with the Processing Instructions, Orpheus shall notify the Customer of any such requirement before processing the Personal Data (eunless any of the applicable laws prohibit such information on important grounds of public interest). 3.8 Technical and organisational measures - Orpheus shall implement and maintain, at its cost and expense (taking into account those factors which it is entitled to take into account pursuant to the Data Protection Laws) each party shall take appropriate technical and organisational measures against unauthorised in relation to the processing of Personal Data by ▇▇▇▇▇▇▇: 3.8.1 so as to ensure a level of security in respect of the Personal Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed; and 3.8.2 without prejudice to clause 3.11, insofar as is possible, to assist the Customer in the fulfilment of the Customer’s obligations to respond to Data Subject Requests relating to Personal Data. 3.9 Using staff and other processors - Orpheus shall not engage another Data Processor for carrying out any processing activities in respect of the Personal Data without the Customer’s prior written consent. The Customer consents to the processing of Personal Data by the personal data Authorised Reseller in accordance with the Data Processing Instructions. 3.10 Orpheus shall ensure that all Orpheus personnel processing Personal Data: 3.10.1 are subject to obligations of confidentiality which apply, generally or specifically, to the Personal Data; and 3.10.2 are reliable and have received appropriate training on compliance with the Data Protection Laws. 3.11 Assistance with Customer’s Compliance with Data Subject Rights - Orpheus shall: 3.11.1 record and then refer all Data Subject Requests it receives to the Customer, without undue delay; 3.11.2 provide such assistance to the Customer as the Customer reasonably requests in relation to a Data Subject Request; and 3.11.3 not respond to any Data Subject Request or Complaint without the Customer’s prior written approval. 3.12 Without prejudice to clause 3.11 Orpheus shall, at its accidental losscost and expense, destruction or damageprovide such assistance to the Customer as the Customer reasonably requires (taking into account the nature of processing and 3.12.1 security of processing; 3.12.2 Data Protection Impact Assessments (as such term is defined in the Data Protection Laws); 3.12.3 prior consultation with a Supervisory Authority regarding high risk processing.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to set out in the Customer from time to timeService Definition. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in the Service Definition. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services specifically related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy at Schedule 5 relating to the privacy and security of the Customer Data Data, as such document may be notified to the Customer amended from time to timetime by the Supplier in agreement with the accreditor of the RMADS referred to in Schedule 5. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may only be transferred or stored outside in the EEA or UK without prejudice to the country where the Customer and ability of the Authorised Users are located to access such data from anywhere in order to carry out the Services and the Supplier’s other obligations under this agreementworld; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified described in the relevant Service Level Agreement or the Supplier’s Hosting Policy (as applicable). The Supplier may, without obligation to the Customer from time to time. Customer, make such additional backup or archiving arrangements as it sees fit. 5.3 In the event of any loss or damage to Customer DataData during the Licence Term, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with the archiving and retrieval procedure described in the relevant Service Level Agreement or the Supplier’s Hosting Policy (as applicable). 5.4 Save as expressly set out in the relevant Service Level Agreement, the Supplier shall not be required to maintain, back-up, protect or retrieve any Customer Data after the expiry of the Licence Term. 5.5 If the Customer utilises the customer service icon provided within the Software, the Customer acknowledges that any Customer Data uploaded via such archiving procedureservice will be subject to the relevant third-party supplier’s security policy. The Supplier currently utilises the Fresh Desk application. For a copy of the Fresh Desk Security Policy see ▇▇▇▇://▇▇▇▇▇▇▇▇▇.▇▇▇/security. The Supplier accepts no liability for any Customer Data transferred through the customer service icon provided within the Software. 5.6 The Supplier shall not be responsible for any loss, loss suffered by the Customer as a result of or arising from the destruction, alteration alteration, or disclosure of any Customer Data caused by any third party (including any third-party providing customer service functionality in connection with the Software), except those third parties sub-contracted by and to the extent that the Supplier is entitled to perform services related recover and has so recovered an amount (net of the costs of recovery) equal to Customer Data maintenance and back-up)such loss from the relevant third party. 4.3 The Supplier shall, in providing the Services, comply with its Data Protection Policy relating to the privacy and security of the Customer Data as may be notified to the Customer from time to time. 4.4 5.7 If the Supplier processes any personal data on the Customer’s 's behalf when performing its obligations under this agreementthese Terms and Conditions of Use, the parties record their intention that for the purposes of the Data Protection Legislation the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer undertakes to comply with all the requirements of the Data Protection Legislation in connection with any personal data processed by the Supplier on the Customer's behalf when performing its obligations under these Terms and Conditions of Use. Without prejudice to the generality of the foregoing, the Customer will ensure that it has all necessary and appropriate consents and notices in place to enable lawful processing of any such personal data by the Supplier for the duration and purposes of this agreement; (b) the Customer shall ensure that the Customer has all necessary and appropriate consents and notices in place to enable lawful transfer of the relevant personal data to the Supplier so that the Supplier may lawfully process the personal data in accordance with these Terms and Conditions of Use on the Customer's behalf; (c) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s 's other obligations under this agreementthese Terms and Conditions of Use; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (cd) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, processing and transfer as required by all applicable data protection legislationData Protection Legislation; (de) the Supplier shall process the personal data only in accordance with the terms these Terms and Conditions of this agreement and Use, any lawful instructions reasonably given by the Customer from time to time; andtime or any lawful instruction received from any relevant government authority; (ef) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (g) the Customer shall make and maintain all necessary registration applications within all appropriate categories under the Date Protection Legislation as are required in relation to any personal data processed by the Supplier on the Customer's behalf when performing its obligations under these Terms and Conditions of Use. 5.8 The Customer shall indemnify and keep indemnified the Supplier against all actions, proceedings , costs, claims, demands , liabilities , losses and expenses whatsoever arising out of or in connection with the Supplier 's processing of personal data on the Customer's behalf when performing its obligations under these Terms and Conditions of Use, save to the extent that the same is caused by or arises from the Supplier’s (or its directors, employees or sub-contractors’) negligence or breach of its obligations under these Terms and Conditions of Use.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 The Supplier 5.2 Yotta shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended by Yotta in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier Yotta to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier Yotta in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier ▇▇▇▇▇ shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier Yotta to perform services related to Customer Data maintenance and back-up). 4.3 The Supplier 5.3 Yotta shall, in providing the Services, comply with its Data Protection Privacy Policy relating to the privacy and security of the Customer Data available at ▇▇▇.▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by Yotta in its sole discretion. 4.4 5.4 If the Supplier Yotta processes any personal data on the Customer’s 's behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier Yotta shall be a data processor and in any such case: (a) 5.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside within the EEA or the country where the Customer and the Authorised Users are located in order inorder to carry out the Services and the Supplier’s Yotta's other obligations under this agreement; (b) 5.4.2 the Customer shall ensure that the Customer it complies with its obligations under applicable Data Protection Legislation and that it is entitled to transfer the relevant personal data to the Supplier Yotta so that the Supplier ▇▇▇▇▇ may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) 5.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislationData Protection Legislation; (d) the Supplier 5.4.4 Yotta shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to timeprovisions of applicable Data Protection Legislation; and (e) 5.4.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 . The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time], as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours endeavors to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 . The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ or such other website address as may be notified to the Customer from time to time. 4.4 , as such document may be amended from time to time by the Supplier in its sole discretion. If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: : (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; ; (cb) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; ; (de) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as may be notified to the Customer from time to time, as such document may be amended by the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-back- up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s 's behalf when performing its obligations under this agreementAgreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s 's other obligations under this agreementAgreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement Agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 6.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Profile Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Profile Data. 4.2 6.2 The Supplier Service Provider shall follow its archiving procedures for Customer Data (Customer Profile Data and Customer Submitted Data) performing daily-automated back-ups of the entire member data as may be notified to the Customer from time to timedescribed in Schedule 3 below. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier Service Provider to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such archiving procedureService Provider. The Supplier Service Provider shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier Service Provider to perform services related to Customer Data maintenance and back-up). 4.3 6.3 The Supplier Service Provider shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data as may be notified to the Customer from time to time.required by all applicable General Data Protection Regulation (Regulation EU 2016/679 “GDPR”); 4.4 6.4 If the Supplier Service Provider processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier Service Provider shall be a data processor (as agreed and defined in the Data Protection Agreement signed between the two parties and included as Annex 1 to this main contract) and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier Service Provider so that the Supplier Service Provider may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (cb) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (c) the Service Provider agrees that the personal data may not be transferred or stored outside the client’s chosen data storage region in order to carry out the Services and the Service Provider’s other obligations under this agreement; (d) the Supplier Service Provider shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. (f) Regardless of the agreement documents’ application hierarchy, Appendix 1 (Data Protection Agreement annex) will always be primarily applied in matters concerning data protection. 6.5 The Service Provider undertakes that the Services will be performed in accordance with the Documentation and with reasonable skill and care. 6.6 The undertaking at clause 6.5 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Service Provider's instructions, or modification or alteration of the Services by any party other than the Service Provider or the Service Provider's duly authorised contractors or agents. If the Services do not conform with the foregoing undertaking, Service Provider will, at its expense, use all reasonable commercial endeavours to correct any such non-conformance promptly, or provide the Customer with an alternative means of accomplishing the desired performance. Such correction or substitution constitutes the Customer's sole and exclusive remedy for any breach of the undertaking set out in clause 6.5. Notwithstanding the foregoing, the Service Provider: (a) does not warrant that the Customer's use of the Services will be uninterrupted or error- free; nor that the Services, Documentation and/or the information obtained by the Customer through the Services will meet the Customer's requirements; and (b) is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and the Customer acknowledges that the Services and Documentation may be subject to limitations, delays and other problems inherent in the use of such communications facilities. 6.7 This agreement shall not prevent the Service Provider from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this agreement. 6.8 The Service Provider warrants that it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this agreement.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to timeData. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedure. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇▇://▇▇▇▇▇-▇▇▇▇▇▇.▇▇▇/privacy-policy or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 4.1 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 4.2 5.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy available at ▇▇▇▇://▇▇▇▇▇▇▇.▇▇/GDPR/security-and-data- protection/servers-security#a174 as such document may be notified to amended by the Customer Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in its Back-Up Policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Security Policy relating to the privacy and security of the Customer Data available at ▇▇▇▇▇://▇▇▇▇▇▇▇▇▇.▇▇/staffwise_privacy.pdf or such other website address as may be notified to the Customer from time to time, as such document may be amended from time to time by the Supplier in its sole discretion. The client will be notified 30 days before any amends. 4.4 5.4 If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and , the Supplier’s other obligations under this agreement; (b) the Customer processing activities shall ensure that the Customer is entitled be subject to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (d) the Supplier shall process the personal data only in accordance with the terms of the separate data processing agreement to be entered into between the parties on or around the Effective Date of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damageagreement.:

Customer Data. 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and Authorised users shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer their Data. 4.2 The supplier and customer shall fulfil its obligations of GDPR compliance as a ‘controllers’ and ‘processors’ of data which includes ( but not limited to) • Data protection impact assessments • Data protection officers • The right to be informed • The right to erasure • The right to rectification • The right to restrict processing 4.3 The Supplier shall follow its archiving procedures for Customer Data as may be notified to the Customer from time to timedescribed in Schedule 4. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with such the archiving procedureprocedure described in Schedule 4. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up). 4.3 4.4 The Supplier shall, in providing the Services, comply with its Data Protection Policy relating will need to the privacy and security of the Customer Data as may be notified to the Customer from time to time. 4.4 If the Supplier processes any process Authorised users personal data on the Customer’s their behalf when performing its obligations under this agreement, the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case: (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under this agreement; (b) the Customer users shall ensure that the Customer is they are entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully use, process and transfer the personal data in accordance with this agreement on the Customer's ’s behalf; (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation; (db) the Supplier shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the Customer from time to time; and (ec) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 4.5 The Supplier will ensure that all Health Companion Ltd Staff are aware of their responsibilities to fully comply with the provisions of the Data Protection Act (2018), including related Caldicott Guardian principles and the Computer Misuse Act and GDPR compliance. The Supplier may, at times, be required to access patient identifiable data in order to investigate and resolve system errors or data quality issues. It is the responsibility of the Supplier to ensure that its staff can: • fully justify the purpose of access, • do not access patient identifiable information unless it is absolutely necessary • access or use the minimum necessary patient identifiable information. Details of the Supplier’s Information Governance Policy can be obtained from the Operations Director at Health Companion Ltd. The Customers Security Principles should be provided to the Supplier at the Project Initiation meeting. The Supplier will be responsible for ensuring these are followed. The Customer will confirm whether explicit permissions will be required to access any patient identifiable information in order to carry out appropriate changes or investigations. The supplier will ensure that its processes enable the patient to actually consent to their data being extracted from clinical systems to populate their patient portal.