Common use of Customer Data Clause in Contracts

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance shall, in providing the Services, comply with its Data Protection and Information Security Policies relating to the privacy and security of the Customer Data available by written request to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretion. 5.5 If Security Alliance processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreement, the parties record their intention that the Customer shall be the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s other obligations under this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance so that Security Alliance may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalf; 5.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 6.1 The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance 6.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time to timePolicy. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against the Supplier shall be for Security Alliance the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance the Supplier in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by the Supplier to perform services related to Customer Data maintenance and back-upup for which it shall remain fully liable under clause 6.9). 5.4 Security Alliance 6.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data available by written request at ▇▇▇.▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to Security Alliancethe Customer from time to time, as such document may be amended from time to time by Security Alliance the Supplier in its sole discretion. 5.5 If Security Alliance 6.4 Both parties will follow all applicable requirements of the Data Protection Legislation. This clause 6 is in addition to, and does not relieve, remove or replace, a party's obligations under the Data Protection Legislation. 6.5 The parties acknowledge that: (a) if the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be is the data controller and Security Alliance shall be a the Supplier is the data processor for the purposes of the Data Protection Legislation (where Data Controller and Data Processor have the meanings as defined in any such case:the Data Protection Legislation). 5.5.1 (b) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this Agreement;agreement. If personal data is transferred or stored outside the UK, appropriate safeguards in accordance with UK GDPR, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), will be implemented to ensure compliance with UK data protection laws. 5.5.2 6.6 Without prejudice to the generality of clause 6.1, the Customer shall will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Customer is entitled Personal Data to transfer the relevant personal data to Security Alliance Supplier for the duration and purposes of this agreement so that Security Alliance the Supplier may lawfully use, process and transfer the personal data Personal Data in accordance with this Agreement agreement on the Customer's behalf. 6.7 Without prejudice to the generality of clause 6.1, the Supplier shall, in relation to any Personal Data processed in connection with the performance by the Supplier of its obligations under this agreement: (a) Process that Personal Data only on the written instructions of the Customer, unless the Supplier is required by the laws of the United Kingdom, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, or any applicable international laws to process Personal Data (Applicable Laws). In instances where the Supplier's data processing activities are subject to the laws of a member of the European Union due to cross-border operations or data transfers, and where such laws necessitate processing actions divergent from the Customer's instructions, the Supplier shall promptly notify the Customer of this requirement before commencing the processing required by the Applicable Laws, unless prohibited by those laws from providing such notification; 5.5.3 (b) Not transfer any Personal Data outside of the United Kingdom or to any country not deemed to have adequate data protection laws by the UK Information Commissioner's Office (ICO), unless the following conditions are fulfilled: (i) the Customer shall or the Supplier has provided appropriate safeguards in relation to the transfer such as Standard Contractual Clauses (SCCs) specifically adapted for the data transfer requirements under the UK GDPR, or any future UK adequacy decisions. When transferring personal data outside the UK, the Supplier will ensure the use of Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or ensure that the relevant third parties have destination country has been informed of, and have given their specific informed consent to, such use, processing, and transfer as required deemed to provide an adequate level of protection for personal data by all applicable data protection legislationthe UK government; 5.5.4 Security Alliance shall process (ii) the personal data only subject has enforceable rights and effective legal remedies in accordance with the terms UK GDPR and the Data Protection Act 2018; (iii) the Supplier ensures compliance with the UK Data Protection Legislation by providing an adequate level of this Agreement and protection to any lawful Personal Data transferred, including adhering to any additional requirements set forth by the UK Information Commissioner's Office (ICO); and (iv) the Supplier complies with reasonable instructions reasonably given notified to it in advance by the Customer with respect to the processing of the Personal Data; (c) assist the Customer, at the Customer's cost, in responding to any request from time a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to timesecurity, breach notifications, impact assessments and consultations with supervisory authorities or regulators; (d) notify the ICO within 72 hours of becoming aware of a data breach. Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, notify the affected data subjects without undue delay.; (e) at the written direction of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the agreement unless required by Applicable Law to store the Personal Data; and 5.5.5 each (f) maintain complete and accurate records and information to demonstrate its compliance with this clause 6. 6.8 Each party shall take ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the personal data harm that might result from the unauthorised or its unlawful processing or accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymisation and encr ypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). 6.9 The Supplier will ensure that any sub-contractors appointed to process personal data on behalf of the Customer are subject to written agreements that require them to process such data only on documented instructions from the Customer and in full compliance with the requirements of the UK GDPR, particularly Article 28. The Supplier confirms that it has entered or (as the case may be) will enter with the third- party processor into a written agreement substantially on that third party's standard terms of business. As between the Customer and the Supplier, the Supplier shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this clause 6. Full details of all third parties providing such services to the Supplier and who are processing Personal data under this agreement are available upon request. 6.10 The Supplier will update its Privacy Policy to reflect any changes in sub-processors or the addition of new sub-processors. It is the responsibility of the Customer to regularly review the Privacy Policy to stay informed of such changes. 6.11 The Customer acknowledges and agrees that the Supplier relies on third-party services for the hosting and processing of Customer Data pursuant to this agreement. Specifically, Amazon Web Services (AWS) is utilised as the primary infrastructure provider due to its robust data security measures and adherence to data protection legislation relevant to our operations. For comprehensive details regarding the use of AWS, including the location of data centres and the specific security and compliance measures in place, refer to Schedule 2 of this agreement. This schedule outlines how data storage and processing activities through AWS are conducted in strict conformity with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ensuring the highest standards of data protection and security are maintained. 6.12 The Supplier will ensure that any use of Customer Data in aggregated and anonymised form is done in a manner that fully ensures such data cannot be re-identified, adhering to the standards of anonymisation defined under the UK GDPR. 6.13 The supplier will assist the customer in ensuring compliance with the data subject rights under the Data Protection Legislation, including but not limited to rights of access, correction, deletion, and data portability. 6.14 The customer shall have the right to conduct an audit of the supplier's data processing activities related to this agreement once per year to ensure compliance with Data Protection Legislation and the terms of this agreement. Such audit shall be conducted at the customers expense, with reasonable prior notice, and shall not unreasonably interfere with the supplier's business operations 6.15 Any revisions to this clause related to data protection will be made in compliance with the latest data protection legislation and best practices, ensuring the protection of data subjects' rights. The Customer will be notified at least 30 days in advance of any such changes, which will only be implemented with the Customer's consent if they materially alter the data protection obligations of the parties.

Customer Data. 5.1 10.1 The Customer shall own all right, title and interest in and to all of the data inputted by the Customer, Authorised Users, or IO Data on the Customer’s behalf for the purpose of using the Services or facilitating the Customer’s use of the Services (the “Customer Data Data”) and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time to time. 10.2 In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance IO Data to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance IO Data in accordance with the its archiving procedure described in its Back-Up Policy. 5.3 Security Alliance from time to time. IO Data shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by IO Data to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 10.3 IO Data shall, in providing the Services, comply with its Data Protection and Information Security Policies Privacy Policy relating to the privacy and security of the Customer Data available by written request at ▇▇▇▇▇▇.▇▇.▇▇ or such other website address as may be notified to Security Alliancethe Customer from time to time, as such document may be amended from time to time by Security Alliance IO Data in its sole discretion. 5.5 10.4 The Customer agrees that IO Data may process its personal data and that of its Authorised Users to enable it to provide the Services to the Customer. 10.5 If Security Alliance IO Data processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreement, the parties record their intention that the Customer shall be the data controller and Security Alliance IO Data shall be a data processor and in any such case: 5.5.1 (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s IO Data's other obligations under this Agreement; 5.5.2 (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance IO Data so that Security Alliance IO Data may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalf; 5.5.3 (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance (d) IO Data shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Back- Up Policy as Policy; such document may be amended by Security Alliance the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance the Supplier in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance subcontracted by the Supplier to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 5.3 The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data available by written request to Security Alliance, Data; such document may be amended from time to time by Security Alliance the Supplier in its sole discretion. 5.5 5.4 If Security Alliance the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance the Supplier shall be a data processor and in any such case: 5.5.1 (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliancethe Supplier’s other obligations under this Agreementagreement; 5.5.2 (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance the Supplier so that Security Alliance the Supplier may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's ’s behalf; 5.5.3 (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance (d) the Supplier shall process the personal data only in accordance with the terms of this Agreement agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 6.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance 6.2 Where the Customer stores the Customer Data on its own systems, the Customer shall follow its archiving own back-up procedures for such Customer Data and Protean shall have no responsibility for any loss, destruction, alteration or disclosure of Customer Data that is held on the Customer’s own systems. 6.3 Where Protean is hosting the Customer Data, Protean shall follow its back-up procedures for Customer Data (details of which are available on request from Protean) or such other website address as set out in its Back-Up Policy may be notified to the Customer from time to time, as such document procedures may be amended by Security Alliance Protean in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance Protean to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance Protean in accordance with the archiving back-up procedure described in its Back-Up Policy. 5.3 Security Alliance above. Protean shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by Protean to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 6.4 Protean shall, in providing supplying the Services, Software to the Customer comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data available by written on request to Security Alliancethe Customer and on such website address as may be notified to the Customer from time to time, as such document may be amended from time to time by Security Alliance Protean in its sole discretion. 5.5 6.5 If Security Alliance Protean processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance Protean shall be a data processor and in any such case: 5.5.1 6.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services Cloud Service and Security Alliance▇▇▇▇▇▇▇’s other obligations under this Agreementagreement; 5.5.2 6.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance Protean so that Security Alliance Protean may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's ’s behalf; 5.5.3 6.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance 6.5.4 Protean shall process the personal data only in accordance with the terms of this Agreement agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 6.5.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 6.6 Without prejudice to clause 4.2, the Customer acknowledges and agrees that: 6.6.1 Protean is reliant upon third party providers in order to supply the Cloud Service; and 6.6.2 Protean shall have no liability to the Customer for any loss (including any loss arising from the loss or misuse of Customer Data) to the Customer which is caused by an act or omission of such third party providers. 6.7 The Customer acknowledges and agrees that when using the Software: 6.7.1 it is able to integrate with third party software (such as accounting software) in order to submit and exchange Customer Data; and 6.7.2 it shall indemnify Protean for any claim against Protean by such third party software suppliers arising from the Customer’s submission and exchange of Customer Data pursuant to clause 6.7.1. 6.8 The Customer hereby gives consent to Protean to allow Protean to collate and use its Customer Data for Protean’s own marketing and other commercial purposes, provided that such Customer Data is anonymised by Protean prior to its use, and such use is subject to Protean’s obligations of confidentiality under clause 11.

Customer Data. 5.1 The Customer shall own all rightrights, title and interest in and to all of the Customer Data and shall have sole responsibility for the legalitylegality , reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance The Customer shall follow its have sole responsibility for the security, back-up, archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time to time. In the event and recovery of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance in accordance with the archiving procedure described in its Back-Up Policy. 5.3 If the Customer utilises the customer service icon provided by the Supplier within the Software the Customer acknowledges that any Customer Data uploaded via such service will be subject to the relevant third party supplier’s Security Alliance Policy. The Supplier currently utilises the Fresh Desk application. For a copy of the Fresh Desk Security Policy see ▇▇▇▇▇://▇▇▇▇▇▇▇▇▇.▇▇▇/security. The Supplier accepts no liability for any Customer Data transferred through the customer service icon provided within the Software. 5.4 The Supplier shall not be responsible for any loss, loss suffered by the Customer as a result of or arising from the destruction, alteration alteration, or disclosure of any Customer Data caused by any third party (including any third-party providing customer service functionality in connection with the Software), except those third parties sub- contracted Security Alliance to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance shall, in providing the Services, comply with its Data Protection and Information Security Policies relating to the privacy extent that the Supplier is entitled to recover and security has so recovered an amount (net of the Customer Data available by written request costs of recovery) equal to Security Alliance, such document may be amended loss from time to time by Security Alliance in its sole discretionthe relevant third party. 5.5 If Security Alliance the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreementthese Terms and Conditions of Use, the parties record their intention that the Customer shall be the data controller and Security Alliance the Supplier shall be a data processor and in any such case: 5.5.1 (a) the Customer undertakes to comply with all the requirements of the Data Protection Act 1998 in connection with any personal data processed by the Supplier on the Customer's behalf when performing its obligations under these Terms and Conditions of Use ; (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully process the personal data in accordance with these Terms and Conditions of Use on the Customer's behalf; (c) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this Agreementthese Terms and Conditions of Use; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance so that Security Alliance may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalf; 5.5.3 (d) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, processing and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance (e) the Supplier shall process the personal data only in accordance with the terms these Terms and Conditions of this Agreement Use and any lawful instructions reasonably given by the Customer from time to time; and; 5.5.5 (f) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage; and (g) the Customer shall make and maintain all necessary registration applications within all appropriate categories under the DPA as are required in relation to any personal data processed by the Supplier on the Customer's behalf when performing its obligations under these Terms and Conditions of Use. 5.6 The Customer shall indemnify and keep indemnified the Supplier against all actions, proceedings , costs, claims, demands , liabilities , losses and expenses whatsoever arising out of or in connection with the Supplier 's processing of personal data on the Customer's behalf when performing its obligations under these Terms and Conditions of Use, save to the extent that the same is caused by or arises from the Supplier’s (or its directors, employees or sub-contractors’) negligence or breach of its obligations under these Terms and Conditions of Use.

Customer Data. 5.1 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all Customer Data. 5.2 Security Alliance 4.2 The Customer acknowledges and agrees that the Customer Data shall follow its be transferred to and stored by the PaaS Supplier. 4.3 The archiving procedures for Customer Data as set out in its Back-Up Policy as such document may shall be amended notified to the Customer by Security Alliance in its sole discretion from time to timethe Supplier. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against the Supplier shall be for Security Alliance the Supplier to use reasonable commercial endeavours to require the PaaS Supplier to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance the PaaS Supplier in accordance with the PaaS Supplier’s then current archiving procedure described in its Back-Up Policy. 5.3 Security Alliance procedure. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance to perform services related to Customer Data maintenance and back-up)party. 5.4 Security Alliance 4.4 The Supplier shall, in providing the Services, comply with its Data Protection privacy and Information Security Policies IT and communications system policies relating to the privacy and security of the Customer Data available by written request to Security Alliance, as such document policies may be amended from time to time by Security Alliance the Supplier in its sole discretion. 5.5 4.5 If Security Alliance the Supplier and/or the PaaS Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its the Supplier’s obligations under this Agreementagreement (including the processing set out in Schedule 6), the parties record their intention that the Customer shall be the data controller and Security Alliance the Supplier and/or PaaS Supplier as appropriate shall be a data processor and in any such case: 5.5.1 (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA United Kingdom or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this Agreementagreement; 5.5.2 (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance the Supplier and/or PaaS Supplier as appropriate for the duration and purposes of this agreement so that Security Alliance the Supplier and/or PaaS Supplier as appropriate may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's behalf;; and 5.5.3 (c) the Customer shall ensure that the all relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable Data Protection Legislation. 4.6 The Supplier shall, in relation to any personal data protection legislation;processed by it on the Customer’s behalf when performing its obligations under this agreement: 5.5.4 Security Alliance shall (a) process the that personal data only on the documented written instructions of the Customer unless the Supplier is required by the laws of any member of the European Union or by the laws of the European Union applicable to the Supplier and/or Domestic UK Law (where Domestic UK Law means the UK Data Protection Legislation and any other law that applies in accordance with the terms UK) to process personal data (Applicable Laws). Where the Supplier is relying on Applicable Laws as the basis for processing personal data, the Supplier shall promptly notify the Customer of this Agreement before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Supplier from so notifying the Customer; (b) not transfer any personal data outside of the United Kingdom unless the following conditions are fulfilled: (i) the Customer or the Supplier has provided appropriate safeguards in relation to the transfer; (ii) the data subject has enforceable rights and effective legal remedies; (iii) the Supplier complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any lawful personal data that is transferred; and (iv) the Supplier complies with reasonable instructions reasonably given notified to it in advance by the Customer with respect to the processing of the personal data; (c) assist the Customer, at the Customer's cost, in responding to any request from time a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to timesecurity, breach notifications, impact assessments and consultations with supervisory authorities or regulators; (d) notify the Customer without undue delay on becoming aware of a personal data breach; (e) at the written direction of the Customer take all reasonable steps to delete or return personal data to the Customer on termination of the agreement unless required by Applicable Law to store the personal data; and 5.5.5 each (f) maintain complete and accurate records and information to demonstrate its compliance with this clause 4 and immediately inform the Customer if an instruction infringes the Data Protection Legislation. 4.7 Each party shall take ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of the personal data and against accidental loss or its destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). 4.8 The Customer consents to the Supplier appointing the PaaS Supplier as a third-party processor of personal data under this agreement. The Supplier confirms that it has entered into a written agreement on that third party's standard terms of business which reflect the requirements of the Data Protection Legislation. 4.9 Either party may, at any time on not less than 30 days' notice, revise this clause 4 by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to this agreement). 4.10 Both parties will comply with all applicable requirements of the Data Protection Legislation and acknowledge that this obligation is in addition to, and does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance Boomerang shall follow its archiving procedures for Customer Data as set out in its Back-Up Boomerang’s Policy as such document may be amended by Security Alliance Boomerang in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance Boomerang to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance Boomerang in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance Boomerang’s Policies. Boomerang shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except to the extent that those third parties sub- have been sub-contracted Security Alliance by Boomerang to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 5.3 Boomerang shall, in providing the Services, comply with its Data Protection and Information Security Policies Policy relating to the privacy and security of the Customer Data available by written request to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretionData. 5.5 5.4 If Security Alliance Boomerang processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreement, the parties hereby record their intention and agreement that the Customer shall be the data controller and Security Alliance Boomerang shall be a data processor. The obligations of the data controller and the data processor and are set out in Schedule 1. In any such case: 5.5.1 5.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside within the EEA or the country where the Customer and and/or the Authorised Users and/or recipients are located in order to carry out the Services and Security Alliance’s Boomerang's other obligations under this Agreement; 5.5.2 5.4.2 the Customer shall ensure at all times that the Customer is entitled to process and transfer the relevant information and personal data to Security Alliance so Boomerang and that Security Alliance may Boomerang can lawfully use, process and transfer the relevant information and personal data in accordance with order to provide the Services and/or in relation to this Agreement on the Customer's behalfAgreement; 5.5.3 5.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed irrevocable and explicit consent to, to such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by . In particular, the Customer from agrees that Messages must only be delivered to recipients and third parties who have given their prior explicit consent to the quantity, frequency and type of Messages to be delivered via the Services. Customer shall have informed recipients and/or third parties beforehand and on an ongoing basis about their right at any time to timeopt-out of receiving Messages and will comply at all times with such instructions from recipients and/or third parties; and 5.5.5 5.4.4 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damagedamage and the Customer will at all times keep the information and personal data which it uses in relation to the Services up to date and not keep it for any longer than is necessary under applicable data protection legislation.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance The Customer acknowledges and agrees to create, assign and maintain the Unique Identifier assigned to their Customer Data across all types of Data Sources for the duration of this agreement. 5.3 Activ8 Intelligence shall follow its archiving procedures for Customer Data as set out in its BackBackup Policy (available at ▇▇▇▇▇://▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇/en_US/saas-Up Policy terms-and-conditions) or such other website address as may be notified to the Customer, as such a document may be amended by Security Alliance Activ8 Intelligence in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance Activ8 Intelligence to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up backup of such Customer Data maintained by Security Alliance Activ8 Intelligence in accordance with the archiving procedure described in its Back-Up Backup Policy. 5.3 Security Alliance . Activ8 Intelligence shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance to perform services related to Customer Data maintenance and back-up)party. 5.4 Security Alliance Activ8 Intelligence shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data (available by written request at ▇▇▇▇▇://▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇/en_US/saas- terms-and-conditions) and the Activ8 Intelligence Data Protection Agreement attached to Security Alliancethese terms, or such document other website address as may be notified to the Customer from time to time, as such documents may be amended from time to time by Security Alliance Activ8 Intelligence in its sole discretion. 5.5 If Security Alliance Activ8 Intelligence processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance Activ8 Intelligence shall be a data processor and in any such case: 5.5.1 a) unless agreed otherwise in writing by the Company, the Customer acknowledges and agrees that the personal data may not be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security AllianceActiv8 Intelligence’s other obligations under this Agreementagreement; 5.5.2 b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance Activ8 Intelligence so that Security Alliance Activ8 Intelligence may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's ’s behalf; 5.5.3 c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance d) Activ8 Intelligence shall process the personal data only in accordance with the terms of this Agreement agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. f) Activ8 Intelligence may collect, use, and disclose data derived from Customer’s use of the Service for industry analysis, benchmarking, analytics, marketing, and other business purposes in support of the provision of the Service. Any such data will be in aggregate form only and will not contain Customer identifiable data unless agreed in writing.

Customer Data. 5.1 The Parties acknowledge the Customer shall own all right, title and interest in and to all is the owner of the Customer Data and the data controller of the Customer Personal Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance AH shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy back- up policy as may be notified to the Customer from time to time, as such document may be amended by Security Alliance AH in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance AH to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance AH in accordance with the archiving procedure described in its Backback-Up Policy. 5.3 Security Alliance up policy. AH shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by AH to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance shall, in providing the Services, comply with its Data Protection and Information Security Policies relating 5.3 Subject to the privacy terms and security conditions of this Agreement and clause 5.8 below, Customer hereby grants to AH a non-exclusive, limited, royalty-free licence, to use the Customer Data available by written request as necessary to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretionprovide the Software and perform the Services under this Agreement. 5.5 If Security Alliance processes any personal data (as such term is defined in 5.4 To the General Data Protection Regulation (GDPR) on extent applicable to the Customer's behalf when performing its obligations Services provided by AH to Customer under this Agreement, AH will having regard to the parties record their intention that the Customer shall be the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer state of technological development and the Authorised Users are located cost of implementing any measures, implement and maintain commercially reasonable security measures designed to meet the following objectives (collectively, the "AH Security Program"): 5.4.1 ensure the security and confidentiality of Customer Data in order to carry out the Services custody and Security Alliance’s other obligations under this Agreementthe control of AH; 5.5.2 5.4.2 protect against any anticipated threats or hazards to the security or integrity of such Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance so that Security Alliance may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalfData; 5.5.3 the 5.4.3 protect against unauthorised access to or use of such Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislationData; 5.5.4 Security Alliance shall process the personal data only 5.4.4 encrypt Customer Data as specified in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to timeclause 5.5 below; and 5.5.5 5.4.5 save as provided in clause 5.8 below, ensure that AH’s return or disposal of such Customer Data is performed in a manner consistent with AH’s obligations under clauses 5.4.1 to 5.4.5 above. 5.5 AH will encrypt Customer Data in AH’s possession or under its control when transmitted, using any then current industry standard encryption technology. Where applicable, Customer is solely responsible for safeguarding all encryption keys applicable to Customer Data. Customer may not provide any such keys to AH without AH’s express, prior written consent in each instance. 5.6 AH will notify Customer of unauthorised access to, or use or disclosure of Customer Data within AH’s custody and control within ten (10) Business Days of AH’s confirmation of the same; each party shall take appropriate technical will reasonably cooperate with the other with respect to the investigation and organisational measures against resolution of such unauthorised access, use or unlawful processing disclosure. Upon confirmation of any vulnerability or breach of AH’s security affecting Customer Data in AH’s custody and control, AH will modify its processes and security program as necessary to mitigate the effects of the personal vulnerability or breach upon such Customer Data. Customer will notify AH of any security compromise affecting its Authorised Users' authentication credentials used to access the Software and any Customer systems or networks that interoperate with or transmit data or its accidental loss, destruction or damageto AH within two (2) Business Days of confirmation of the same.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance MY DIGITAL shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy Policy, as such document may be amended by Security Alliance MY DIGITAL in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against MY DIGITAL shall be for Security Alliance MY DIGITAL to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such ofsuch Customer Data maintained by Security Alliance MY DIGITAL in accordance with the archiving procedure archivingprocedure described in its Back-Up Policy. 5.3 Security Alliance . MY DIGITAL shall not be responsible for any lossanyloss, destruction, alteration or disclosure of Customer Data caused by any third party (except party(except those third parties sub- sub-contracted Security Alliance by MY DIGITAL to perform services related to Customer Data maintenance and back-upup forwhich it shall remain fully liable under clause 5.10). The Customer shall ensure that each of its Authorised Users is aware of the Back Up Policy and MY DIGITAL’s obligations withregard to the restoration of Customer Data. 5.4 Security Alliance 5.3 The Privacy Policy is incorporated into this contract by reference and applies to the Subscription Services. The Customer acknowledges and agrees that Customer Data shall be collected and used by MY DIGITAL in accordance with the Privacy Policy and shall ensure that each Authorised User is aware of the Privacy Policy and provides its prior written consent to the Customer which shall confirm that each Contractor User and End Client User hasseen and agrees to that party’s personal data being used by MY DIGITAL in accordance with the Privacy Policy. MY DIGITAL shall, in providing the Services, comply with its Data Protection and Information Security Policies Privacy Policy relating to the privacy and security of the Customer Data. 5.4 Both parties will comply with all applicable requirements of the Data available by written request to Security AllianceProtection Legislation. This clause 5 is in addition to, such document may be amended from time to time by Security Alliance in its sole discretionand does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation. 5.5 If Security Alliance The Customer shall not disclose (and shall not permit any data subject to disclose), any sensitive personal data/special categories of personal data to MY DIGITAL for processing. 5.6 The parties acknowledge that where MY DIGITAL processes any personal data (as such term is defined described in the General Data Protection Regulation (GDPR) this contract on the Customer's ’s behalf when performing its obligations under this Agreementcontract, and for the purposes of this Contract, the parties record their intention that Customer is the controller and MY DIGITAL is the processor for the purposes of the Data Protection Legislation. 5.7 Without prejudice to the generality of clause 5.4, the Customer shall be will ensure that it has all necessary appropriate consents and notices in place to enable the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that lawful transfer of the personal data may be transferred or stored outside to MY DIGITAL for the EEA or the country where the Customer duration and the Authorised Users are located in order to carry out the Services and Security Alliance’s other obligations under purposes of this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance contract so that Security Alliance MY DIGITAL may lawfully use, process and transfer the personal data in accordance with accordancewith this Agreement contract on the Customer's behalf. 5.8 Without prejudice to the generality of clause 5.4, MY DIGITAL shall, in relation to anypersonal data processed in connection with the performance by MY DIGITAL of its obligations under this contract: (a) process that personal data only on the documented written instructions of the Customer unless MY DIGITAL is required by the laws of any member of the European Union or by the laws of the European Union applicable to MY DIGITAL and/or Domestic UK Law (where Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK) to process personal data (Applicable Laws). Where MY DIGITAL is relyingon Applicable Laws as the basis for processing personal data, MY DIGITAL shall promptly notify the Customer ofthis before performing the processingrequired by the Applicable Laws unless those Applicable Laws prohibit MYDIGITAL from so notifying the Customer; 5.5.3 (b) not transfer any personal data outside of the European Economic Area andthe United Kingdom unless the following conditions are fulfilled: (i) the Customer or MY DIGITAL has provided appropriate safeguards in relation to the transfer; (ii) the data subject has enforceable rights and effective legal remedies; (iii) MY DIGITAL complies with its obligations under the Data Protection Legislation by providingan adequate level of protection to any personal data that is transferred; and (iv) MY DIGITAL complies withreasonable instructions notified to it in advance by the Customer withrespect to the processing of the personal data; (c) assist the Customer, at the Customer's cost, in responding to any request from a data subject and in ensuringcompliance with its obligations under the Data Protection Legislation with respect to security, breach notifications,impact assessments and consultations with supervisory authorities or regulators; (d) notify the Customer without undue delay on becoming aware of a personaldata breach; (e) at the written direction of the Customer, delete or return personal data and copies thereof to the Customer on termination of this contract unless required by Applicable Law to store the personal data; and (f) maintain complete and accuraterecords and information to demonstrate its compliance with this clause 5 and immediately inform the Company if, in the opinion of the MY DIGITAL, an instruction infringes the Data Protection Legislation. 5.9 Each party shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only it has in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take place appropriate technical and organisational measures measures, reviewed and approved by the other party, to protect against unauthorisedor unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personaldata, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). 5.10 The Customer consents to MY DIGITAL appointing AWS Europe as a third-party processor of personal data under this contract. MY DIGITAL confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement substantially on that third party's standard terms of business and which reflectthe requirements of the Data Protection Legislation. As between the Customer and MY DIGITAL, MY DIGITAL shall remain fully liable for all acts or omissions of any third- party processor appointed by it pursuant to this clause 5. 5.11 The Customer acknowledges and agrees that internet transmissions are never completely private or secure and that any message or information which is sent or received using the Services may be read or intercepted by others, even if a particular transmission is encrypted. 5.12 The Customer consents (on behalf of itself and each Authorised User) to MY DIGITAL collecting and using technical informationabout the devices and related software, hardware and peripherals for services that are internet or wireless based to improve its products and to provide any Services to the Customer.

Customer Data. 5.1 The Customer Customer’s Group shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance SDS shall follow its archiving procedures for not archive Customer Data as set out in its Back-Up Policy as such document may without prior written notification. Customer Data will be amended by Security Alliance in its sole discretion from time backed up every night and the Customer will have the right to timeget data restored upon request. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance SDS to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance SDS. SDS shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by SDS to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 5.3 SDS shall, in providing the Services, comply with its Data Protection privacy and Information Security Policies security policy relating to the privacy and security of the Customer Data available by written request at ▇▇▇.▇-▇-▇.▇▇.▇▇ or such other website address as may be notified to Security Alliancethe Customer from time to time, as such document may be amended from time to time by Security Alliance SDS in its sole discretion. 5.5 5.4 If Security Alliance SDS processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s Group’s behalf when performing its obligations under this Agreement, the parties record their intention that the Customer shall be the data controller and Security Alliance SDS shall be a data processor and in any such case: 5.5.1 5.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security AllianceSDS’s other obligations under this Agreement, where this is the case SDS will only use service providers which adhere to Standard Contract Clauses (SCCs, also referred to as Model Contract Clauses) to ensure any such data transfers are provided with at least the same level of statutory protection as GDPR; 5.5.2 5.4.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance SDS so that Security Alliance SDS may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's ’s behalf; 5.5.3 5.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 5.4.4 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 5.5 The Customer agrees that Customer Data may be processed by SDS as SDS deems necessary for its Business Interests. To the extent that any of the Customer Data comprise any personal data as defined under any applicable data protection legislation, SDS confirms that, prior to carrying out any necessary processing for its Business Interest, the relevant Customer Data will be anonymised to the extent that no natural person is identifiable or will become identifiable by the use of additional information.

Customer Data. 5.1 4.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance 4.2 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy back- up policy available on request in writing as such document may be amended by Security Alliance the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance the Supplier in accordance with the archiving procedure described in its Backback-Up Policy. 5.3 Security Alliance up policy. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by the Supplier to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 4.3 The Supplier shall, in providing the Services: (a) comply with all Data Protection Laws in connection with the processing of Customer Data, the Services and the exercise and performance of its respective rights and obligations under this Contract, including maintaining all relevant regulatory registrations and notifications as required under Data Protection Laws; and (b) comply with its Data Protection and Information Security Policies relating to the privacy and security of the Customer Data available by written request to Security Alliance, such document data protection policy as may be amended updated from time to time by Security Alliance in its sole discretionthe Supplier. 5.5 4.4 If Security Alliance the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this AgreementContract, the parties record their intention that the Customer shall be the data controller and Security Alliance the Supplier shall be a data processor and in any such case: 5.5.1 (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this AgreementContract; 5.5.2 (b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance the Supplier so that Security Alliance the Supplier may lawfully use, process and transfer the personal data in accordance with this Agreement Contract on the Customer's behalf; 5.5.3 (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance (d) the Supplier shall process the personal data only in accordance with the terms of this Agreement Contract and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 (e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance The Customer acknowledges and agrees to create, assign and maintain the Unique Identifier assigned to their Customer Data across all types of Data Sources for the duration of this agreement 5.3 Activ8 Intelligence shall follow its archiving procedures for Customer Data as set out in its BackBackup Policy (available at ▇▇▇▇▇://▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇/en_US/saas-Up Policy terms-and-conditions)) or such other website address as may be notified to the Customer, as such a document may be amended by Security Alliance Activ8 Intelligence in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance Activ8 Intelligence to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up backup of such Customer Data maintained by Security Alliance Activ8 Intelligence in accordance with the archiving procedure described in its Back-Up Backup Policy. 5.3 Security Alliance . Activ8 Intelligence shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance to perform services related to Customer Data maintenance and back-up)party. 5.4 Security Alliance Activ8 Intelligence shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data (available by written request at ▇▇▇▇▇://▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇/en_US/saas- terms-and-conditions) and the Activ8 Intelligence Data Protection Agreement attached to Security Alliancethese terms, or such document other website address as may be notified to the Customer from time to time, as such documents may be amended from time to time by Security Alliance Activ8 Intelligence in its sole discretion. 5.5 If Security Alliance Activ8 Intelligence processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance Activ8 Intelligence shall be a data processor and in any such case: 5.5.1 a) Unless agreed otherwise in writing by the Company, the Customer acknowledges and agrees that the personal data may not be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security AllianceActiv8 Intelligence’s other obligations under this Agreementagreement; 5.5.2 b) the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance Activ8 Intelligence so that Security Alliance Activ8 Intelligence may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's ’s behalf; 5.5.3 c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance d) Activ8 Intelligence shall process the personal data only in accordance with the terms of this Agreement agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 e) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. f) Activ8 Intelligence may collect, use, and disclose data derived from Customer’s use of the Service for industry analysis, benchmarking, analytics, marketing, and other business purposes in support of the provision of the Service. Any such data will be in aggregate form only and will not contain Customer identifiable data unless agreed in writing.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance MY DIGITAL shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy Policy, as such document may be amended by Security Alliance MY DIGITAL in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against MY DIGITAL shall be for Security Alliance MY DIGITAL to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance MY DIGITAL in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . MY DIGITAL shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by MY DIGITAL to perform services related to Customer Data maintenance and back-upup for which it shall remain fully liable under clause 5.10). The Customer shall ensure that each of its Authorised Users is aware of the Back Up Policy and MY DIGITAL’s obligations with regard to the restoration of Customer Data. 5.4 Security Alliance 5.3 The Privacy Policy is incorporated into this contract by reference and applies to the Subscription Services. The Customer acknowledges and agrees that Customer Data shall be collected and used by MY DIGITAL in accordance with the Privacy Policy and shall ensure that each Authorised User is aware of the Privacy Policy and provides its prior written consent to the Customer which shall confirm that each Contractor User and End Client User has seen and agrees to that party’s personal data being used by MY DIGITAL in accordance with the Privacy Policy. MY DIGITAL shall, in providing the Services, comply with its Data Protection and Information Security Policies Privacy Policy relating to the privacy and security of the Customer Data. 5.4 Both parties will comply with all applicable requirements of the Data available by written request to Security AllianceProtection Legislation. This clause 5 is in addition to, such document may be amended from time to time by Security Alliance in its sole discretionand does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation. 5.5 If Security Alliance The Customer shall not disclose (and shall not permit any data subject to disclose), any sensitive personal data/special categories of personal data to MY DIGITAL for processing. 5.6 The parties acknowledge that where MY DIGITAL processes any personal data (as such term is defined described in the General Data Protection Regulation (GDPR) this contract on the Customer's ’s behalf when performing its obligations under this Agreementcontract, and for the purposes of this Contract, the parties record their intention that Customer is the controller and MY DIGITAL is the processor for the purposes of the Data Protection Legislation. 5.7 Without prejudice to the generality of clause 5.4, the Customer shall be will ensure that it has all necessary appropriate consents and notices in place to enable the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that lawful transfer of the personal data may be transferred or stored outside to MY DIGITAL for the EEA or the country where the Customer duration and the Authorised Users are located in order to carry out the Services and Security Alliance’s other obligations under purposes of this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance contract so that Security Alliance MY DIGITAL may lawfully use, process and transfer the personal data in accordance with this Agreement contract on the Customer's behalf. 5.8 Without prejudice to the generality of clause 5.4, MY DIGITAL shall, in relation to any personal data processed in connection with the performance by MY DIGITAL of its obligations under this contract: (a) process that personal data only on the documented written instructions of the Customer unless MY DIGITAL is required by the laws of any member of the European Union or by the laws of the European Union applicable to MY DIGITAL and/or Domestic UK Law (where Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK) to process personal data (Applicable Laws). Where MY DIGITAL is relying on Applicable Laws as the basis for processing personal data, MY DIGITAL shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit MY DIGITAL from so notifying the Customer; 5.5.3 (b) not transfer any personal data outside of the European Economic Area and the United Kingdom unless the following conditions are fulfilled: (i) the Customer or MY DIGITAL has provided appropriate safeguards in relation to the transfer; (ii) the data subject has enforceable rights and effective legal remedies; (iii) MY DIGITAL complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and (iv) MY DIGITAL complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the personal data; (c) assist the Customer, at the Customer's cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; (d) notify the Customer without undue delay on becoming aware of a personal data breach; (e) at the written direction of the Customer, delete or return personal data and copies thereof to the Customer on termination of this contract unless required by Applicable Law to store the personal data; and (f) maintain complete and accurate records and information to demonstrate its compliance with this clause 5 and immediately inform the Company if, in the opinion of the MY DIGITAL, an instruction infringes the Data Protection Legislation. 5.9 Each party shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only it has in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take place appropriate technical and organisational measures measures, reviewed and approved by the other party, to protect against unauthorised or unlawful processing of the personal data and against accidental loss or its destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). 5.10 The Customer consents to MY DIGITAL appointing AWS Europe as a third-party processor of personal data under this contract. MY DIGITAL confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement substantially on that third party's standard terms of business and which reflect the requirements of the Data Protection Legislation. As between the Customer and MY DIGITAL, MY DIGITAL shall remain fully liable for all acts or omissions of any third- party processor appointed by it pursuant to this clause 5. 5.11 The Customer acknowledges and agrees that internet transmissions are never completely private or secure and that any message or information which is sent or received using the Services may be read or intercepted by others, even if a particular transmission is encrypted. 5.12 The Customer consents (on behalf of itself and each Authorised User) to MY DIGITAL collecting and using technical information about the devices and related software, hardware and peripherals for services that are internet or wireless based to improve its products and to provide any Services to the Customer.

Customer Data. 5.1 7.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance 7.2 IMU shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy Policy, as such document may be amended by Security Alliance IMU in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's ’s sole and exclusive remedy shall be for Security Alliance IMU to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance IMU in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . IMU shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by IMU to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance 7.3 IMU shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies relating to the privacy and security of the Customer Data available by written request to Security AlliancePolicy, as such document docu- ment may be amended from time to time by Security Alliance IMU in its sole discretion. 5.5 7.4 If Security Alliance IMU processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this AgreementContract, the parties record their intention that the Customer shall be the data controller control- ler and Security Alliance IMU shall be a data processor and in any such case: 5.5.1 7.4.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA United Kingdom or the country where the Customer and the Authorised Autho- rised Users are located in order to carry out the Services and Security AllianceIMU’s other obligations under this AgreementContract; 5.5.2 7.4.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal person- al data to Security Alliance IMU so that Security Alliance IMU may lawfully use, process and transfer the personal data in accordance with this Agreement Contract on the Customer's ’s behalf; 5.5.3 7.4.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable applica- ble data protection legislation; 5.5.4 Security Alliance 7.4.4 IMU shall process the personal data only in accordance with the terms of this Agreement Contract and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 7.4.5 each party shall take appropriate technical and organisational measures against unauthorised unau- thorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 6.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance 6.2 Smartway2 Ltd shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion notified to the Customer from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance Smartway2 Ltd to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance in accordance Smartway2 Ltd. For the avoidance of doubt, back-up procedures do not form part of the Services and are offered to the Customer with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance no warranty or guarantee of their date, accuracy or integrity. Smartway2 Ltd shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- contracted Security Alliance party. 6.3 The Customer grants to perform services related the Supplier a non-exclusive, non-transferable licence to access and view the Customer Data maintenance for the purposes assessing and back-up). 5.4 Security Alliance improving the Services during the Subscription Term. Smartway2 Ltd shall not modify the Customer Data and shall, in providing the Services, comply with its Data Protection and Information Security Policies commercially prudent practices relating to the privacy and security of the Customer Data available by written request to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretionData. 5.5 6.4 If Security Alliance Smartway2 Ltd processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's ’s behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance Smartway2 Ltd shall be a data processor and in any such case: 5.5.1 (a) the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security AllianceSmartway2 Ltd’s other obligations under this Agreementagreement; 5.5.2 (b) the Customer shall ensure that the Customer it is entitled to transfer the relevant personal data to Security Alliance Smartway2 Ltd so that Security Alliance Smartway2 Ltd may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's behalf; 5.5.3 (c) the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 (d) each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance MY DIGITAL shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy Policy, as such document may be amended by Security Alliance MY DIGITAL in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against MY DIGITAL shall be for Security Alliance MY DIGITAL to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance MY DIGITAL in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . MY DIGITAL shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by MY DIGITAL to perform services related to Customer Data maintenance and back-upup for which it shall remain fully liable under clause 5.10). The Customer shall ensure that each of its Authorised Users is aware of the Back Up Policy and MY DIGITAL’s obligations with regard to the restoration of Customer Data. 5.4 Security Alliance 5.3 The Privacy Policy is incorporated into this contract by reference and applies to the Subscription Services. The Customer acknowledges and agrees that Customer Data shall be collected and used by MY DIGITAL in accordance with the Privacy Policy and shall ensure that each Authorised User is aware of the Privacy Policy and provides its prior written consent to the Customer which shall confirm that each Contractor User and End Client User has seen and agrees to that party’s personal data being used by MY DIGITAL in accordance with the Privacy Policy. MY DIGITAL shall, in providing the Services, comply with its Data Protection and Information Security Policies Privacy Policy relating to the privacy and security of the Customer Data. 5.4 Both parties will comply with all applicable requirements of the Data available by written request to Security AllianceProtection Legislation. This clause 5 is in addition to, such document may be amended from time to time by Security Alliance in its sole discretionand does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation. 5.5 If Security Alliance The Customer shall not disclose (and shall not permit any data subject to disclose), any sensitive personal data/special categories of personal data to MY DIGITAL for processing. 5.6 The parties acknowledge that where MY DIGITAL processes any personal data (as such term is defined described in the General Data Protection Regulation (GDPR) this contract on the Customer's ’s behalf when performing its obligations under this Agreementcontract, and for the purposes of this Contract, the parties record their intention that Customer is the controller and MY DIGITAL is the processor for the purposes of the Data Protection Legislation. 5.7 Without prejudice to the generality of clause 5.4, the Customer shall be will ensure that it has all necessary appropriate consents and notices in place to enable the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that lawful transfer of the personal data may be transferred or stored outside to MY DIGITAL for the EEA or the country where the Customer duration and the Authorised Users are located in order to carry out the Services and Security Alliance’s other obligations under purposes of this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance contract so that Security Alliance MY DIGITAL may lawfully use, process and transfer the personal data in accordance with this Agreement contract on the Customer's behalf. 5.8 Without prejudice to the generality of clause 5.4, MY DIGITAL shall, in relation to any personal data processed in connection with the performance by MY DIGITAL of its obligations under this contract: (a) process that personal data only on the documented written instructions of the Customer unless MY DIGITAL is required by the laws of any member of the European Union or by the laws of the European Union applicable to MY DIGITAL and/or Domestic UK Law (where Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK) to process personal data (Applicable Laws). Where MY DIGITAL is relying on Applicable Laws as the basis for processing personal data, MY DIGITAL shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit MY DIGITAL from so notifying theCustomer; 5.5.3 (b) not transfer any personal data outside of the European Economic Area and the United Kingdom unless the following conditions are fulfilled: (i) the Customer or MY DIGITAL has provided appropriate safeguards in relation to the transfer; (ii) the data subject has enforceable rights and effective legal remedies; (iii) MY DIGITAL complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and (iv) MY DIGITAL complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the personal data; (c) assist the Customer, at the Customer's cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; (d) notify the Customer without undue delay on becoming aware of a personal data breach; (e) at the written direction of the Customer, delete or return personal data and copies thereof to the Customer on termination of this contract unless required by Applicable Law to store the personal data; and (f) maintain complete and accurate records and information to demonstrate its compliance with this clause 5 and immediately inform the Company if, in the opinion of the MY DIGITAL, an instruction infringes the Data Protection Legislation. 5.9 Each party shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only it has in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take place appropriate technical and organisational measures measures, reviewed and approved by the other party, to protect against unauthorised or unlawful processing of the personal data and against accidental loss or its destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it). 5.10 The Customer consents to MY DIGITAL appointing AWS Europe as a third-party processor of personal data under this contract. MY DIGITAL confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement substantially on that third party's standard terms of business and which reflect the requirements of the Data Protection Legislation. As between the Customer and MY DIGITAL, MY DIGITAL shall remain fully liable for all acts or omissions of any third- party processor appointed by it pursuant to this clause 5. 5.11 The Customer acknowledges and agrees that internet transmissions are never completely private or secure and that any message or information which is sent or received using the Services may be read or intercepted by others, even if a particular transmission is encrypted. 5.12 The Customer consents (on behalf of itself and each Authorised User) to MY DIGITAL collecting and using technical information about the devices and related software, hardware and peripherals for services that are internet or wireless based to improve its products and to provide any Services to the Customer.

Customer Data. 5.1 5.1. The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance 5.2. The Supplier shall follow its archiving procedures for maintenance of metadata related to Customer Data as set out in its BackPrivacy and Security Policy available at ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇/privacy- security-Up Policy policy or such other website address as may be notified to the Customer from time to time, as such document may be amended by Security Alliance the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against the Supplier shall be for Security Alliance the Supplier to use reasonable commercial endeavours endeavors to provide the Customer with available Customer comprehensible metadata to restore the lost or damaged Customer Data from the latest back-up version of such metadata related to Customer Data maintained by Security Alliance the Supplier in accordance with the archiving procedure described in its Back-Up Metadata Maintenance Policy. 5.3 Security Alliance . The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by the Supplier to perform services related to Customer Data maintenance and back-upup for which it shall remain fully liable under clause 5.9). 5.4 Security Alliance 5.3. The Supplier shall, in providing the Services, comply with its Data Protection Privacy and Information Security Policies Policy relating to the privacy and security of the Customer Data available by written request at ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇/privacy-security-policy or such other website address as may be notified to Security Alliancethe Customer from time to time, as such document may be amended from time to time by Security Alliance the Supplier in its sole discretion. 5.5 If Security Alliance 5.4. Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 5 is in addition to, and does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation. 5.5. The parties acknowledge that: (a) if the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreementagreement, the parties record their intention that Customer is the Customer shall be the data controller and Security Alliance shall be a the Supplier is the processor for the purposes of the Data Protection Legislation. (b) Schedule 2 sets out the scope, nature and purpose of processing by the Supplier, the duration of the processing and the types of personal data processor and in any such case:categories of data subject. 5.5.1 the Customer acknowledges and agrees that (c) the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Authorized Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this Agreement;agreement. 5.5.2 5.6. Without prejudice to the generality of clause 5.4, the Customer shall will ensure that it has all necessary and appropriate consents and notices in place to enable lawful transfer of the Customer is entitled to transfer the relevant personal data to Security Alliance the Supplier for the duration and purposes of this agreement so that Security Alliance the Supplier may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's behalf. 5.7. Without prejudice to the generality of clause 5.4, the Supplier shall, in relation to any personal data processed in connection with the performance by the Supplier of its obligations under this agreement: (a) process that personal data only on the documented written instructions of the Customer unless the Supplier is required by the laws of any member of the European Union or by the laws of the European Union applicable to the Supplier and/or Domestic UK Law (where Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK) to process personal data (Applicable Laws). Where the Supplier is relying on Applicable Laws as the basis for processing personal data, the Supplier shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Supplier from so notifying the Customer; 5.5.3 (b) not transfer any personal data outside of the European Economic Area and the United Kingdom unless the following conditions are fulfilled: (i) the Customer or the Supplier has provided appropriate safeguards in relation to the transfer; (ii) the data subject has enforceable rights and effective legal remedies; (iii) the Supplier complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and (iv) the Supplier complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the personal data; (c) assist the Customer, at the Customer's cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; (d) notify the Customer without undue delay on becoming aware of a personal data breach; (e) in accordance with clause 14.1 (b), delete or return personal data on termination of the agreement unless required by Applicable Law to store the personal data (and for these purposes the term "delete" shall mean to put such data beyond use); and (f) maintain complete and accurate records and information to demonstrate its compliance with this clause 5 and immediately inform the Customer if, in the opinion of the Supplier, an instruction infringes the Data Protection Legislation. 5.8. Each party shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only it has in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take place appropriate technical and organisational organizational measures to protect against unauthorised unauthorized or unlawful processing of the personal data and against accidental loss or its destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorized or unlawful processing or accidental loss, destruction or damagedamage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organizational measures adopted by it). 5.9. The Customer consents to the Supplier appointing or otherwise hosting its Software with

Customer Data. 5.1 The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance The Supplier retains primary responsibility for taking and maintaining backups of the Customer Data and shall take regular backups to protect against data loss, corruption or other damage. 5.3 The Supplier shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy Privacy Policy, as such document may be amended by Security Alliance the Supplier in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance the Supplier in accordance with the archiving procedure described in its Back-Up Privacy Policy. 5.3 Security Alliance . The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by the Supplier to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance The Supplier shall, in providing the Services, comply with its Data Protection and Information Security Policies Privacy Policy relating to the privacy and security of the Customer Data available by written request at the Website or such other website address as may be notified to Security Alliancethe Customer from time to time, as such document may be amended from time to time by Security Alliance the Supplier in its sole discretion. 5.5 If Security Alliance the Supplier processes any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreementagreement, the parties record their intention that the Customer shall be the data controller and Security Alliance the Supplier shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s the Supplier's other obligations under this Agreementagreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance the Supplier so that Security Alliance the Supplier may lawfully use, process and transfer the personal data in accordance with this Agreement agreement on the Customer's behalf; 5.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage. 5.6 The Customer hereby grants to the Supplier a non-exclusive licence to use the Customer Data for the purposes of internal software improvements, including for the purpose of optimising the Services provided by the Supplier by way of comparisons across any and all Customer projects. The Supplier undertakes not to release details of the Customer projects arising from such improvements.

Customer Data. 5.1 The 13.1 Except for Pattern Data that is owned by REDi, the Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data. 5.2 Security Alliance 13.2 The Customer hereby grants REDi a worldwide, royalty-free, and non-exclusive license during the term of its subscription to access Customer Data in order to provide the Services, including storing, hosting and management of such content (“Content License”) 13.3 Unless otherwise agreed to under a Contract, REDi shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may Policy, which policy shall be amended by Security Alliance in its sole discretion from time to timemade available on receipt of Customer’s written request. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance REDi to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by Security Alliance REDi in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance . REDi shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by REDi to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance shall13.4 The Customer understands that REDi, in providing performing the required technical steps to provide the Services, comply with its may (a) transmit or distribute Customer Data Protection over various public or private networks and Information Security Policies relating in various media; and (b) make such changes to Customer Data as are necessary to conform and adapt that Customer Data to the privacy and security technical requirements of connecting networks, devices, Services or media; 13.5 Where the use of the Customer Data available by written request to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretion. 5.5 If Security Alliance processes involves the Processing of any personal data (as such term is defined in the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this AgreementPersonal Information, the parties record their intention that the Customer shall be the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located in order Parties agree to carry out the Services and Security Alliance’s other obligations under this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance so that Security Alliance may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalf; 5.5.3 the Customer shall ensure that the relevant third parties have been informed of, and have given their specific informed consent to, such use, processing, and transfer as required by execute all applicable data protection legislation; 5.5.4 Security Alliance shall process the personal data only Processing in accordance with the terms Data Processing Legislation. REDi’s processing shall take place in accordance with its Privacy Policy. 13.6 Where any Processing needs to be executed by a Third Party Service Provider on behalf of the Customer or as instructed by the Customer, such Processing shall only take place subsequent to i) receipt by ▇▇▇▇ of a written consent from Customer to allow sharing of Customer Data to said Third Party Service Provider and ii) the signing of the REDi Data Processing Agreement by the Third Party Service Provider; 13.7 The accuracy and maintenance of the Customer Data (Customer and/or Authorised User data or End User data) in the Services is the responsibility of the Customer and/or Authorised – or End Users. REDi will however provide (where reasonably possible) advice and assistance wherever possible, within the limits of this Agreement and any lawful instructions reasonably given by Main Agreement, to improve the Customer from time to time; and 5.5.5 each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing accuracy of the personal data or its accidental loss, destruction or damageinformation at all time.

Customer Data. 5.1 3.1 The Customer Supplier shall own all right, title and interest in and to all of promptly notify the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality in writing of any actual or suspected loss or damage to the Customer Data. 5.2 Security Alliance shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time to time. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy shall be for Security Alliance the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up backup of such Customer Data maintained by Security Alliance in accordance with the archiving procedure described in its Back-Up Policy. 5.3 Security Alliance Data. The Supplier shall not be responsible for any loss, destruction, alteration or unauthorised access to or disclosure of Customer Data caused by any third party (except those third parties sub- sub-contracted Security Alliance by the Supplier to perform services related to Customer Data maintenance and back-up). 5.4 Security Alliance shall, in providing the Services, 3.2 Each party undertakes that it shall comply with the DPA and all applicable changes in law, including any subsequent legislation that may amend and/or supersede the DPA, when performing its Data Protection and Information Security Policies relating to obligations under this agreement. The parties acknowledge that the privacy and security of the Customer Data available by written request to Security Alliance, such document may be amended from time to time by Security Alliance in its sole discretion. 5.5 If Security Alliance processes any personal data (as such term is defined in the European General Data Protection Regulation (GDPR) shall apply during the term of this agreement. The parties agree that they shall enter into such variation of this agreement and execute such additional documentation and make any required changes to the Services as is reasonably required to reflect their obligations under the GDPR and in order for the Supplier to provide the Services in a manner that would allow the Customer to be compliant with the GDPR, based on the Customer's behalf when performing its ’s obligations under this Agreementas a Data Controller and the Supplier’s obligations as a Data Processor or each party’s obligations as a Data Controller, the parties record their intention that the as applicable. 3.3 The Customer shall be the Data Controller, and the parties acknowledge that the Supplier will be acting as Data Processor in respect of all data controller and Security Alliance shall be a data processor and processing activities in any such caserelation to Customer Personal Data that the Supplier carries out under this agreement. 3.4 The Supplier undertakes to the Customer that: 5.5.1 (a) it shall process the Customer acknowledges Personal Data, including updating, correcting and agrees that the personal data may be transferred or stored outside the EEA or the country where the deleting such Customer and the Authorised Users are located in order to carry out the Services and Security Alliance’s other obligations under this Agreement; 5.5.2 the Customer shall ensure that the Customer is entitled to transfer the relevant personal data to Security Alliance so that Security Alliance may lawfully usePersonal Data, process and transfer the personal data only in accordance with this Agreement on agreement and the Customer's behalf; 5.5.3 written instructions of the Customer shall ensure that and to the relevant third parties have been informed ofextent, and have given their specific informed consent toin such a manner, such use, processing, and transfer as required by all applicable data protection legislation; 5.5.4 Security Alliance shall process is reasonably necessary to supply the personal data only Services in accordance with this agreement or as is required by any applicable law; (b) in respect of Customer Personal Data which is in the terms possession or under the control of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party Supplier, it shall take implement appropriate technical and organisational measures to protect this Customer Personal Data against unauthorised or unlawful processing of the personal data or its and accidental loss, destruction destruction, damage, alteration or damagedisclosure; (c) it shall not (and shall ensure that its Representatives do not) publish, disclose or divulge any Customer Personal Data to any third party, nor allow any third party to process Customer Personal Data on the Supplier's behalf, without the prior written consent of the Customer; (d) it shall not transfer Customer Personal Data outside the European Economic Area without the prior written consent of the Customer; (e) it shall take reasonable steps to ensure the reliability of any employee, agent or sub-contractor who has access to Customer Data, and ensure all employees, agents and sub-contractors undergo training on data protection and information security; (f) it shall use reasonable endeavours to assist the Customer at the Customer's cost with any subject access request that the Customer receives relating to Customer Personal Data processed by the Supplier under this agreement; and (g) it shall use reasonable endeavours to assist the Customer in responding to regulatory requirements.

Customer Data. 5.1 The Customer 6.1 You shall own all right, title and interest in and to all of the your Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the all such Customer Data. 5.2 Security Alliance shall follow its archiving procedures for Customer Data as set out in its Back-Up Policy as such document may be amended by Security Alliance in its sole discretion from time 6.2 Millpledge will maintain commercially appropriate technical and organisational measures to timeensure a level of security appropriate to the risk to protect Patient Records. In the event of any loss or damage to your Customer DataData and/or Patient Records, the Customer's your sole and exclusive remedy against Millpledge shall be for Security Alliance Millpledge to use reasonable commercial endeavours to restore the lost or damaged Customer Data and/or Patient Records from the latest back-up of such Customer Data maintained by Security Alliance in accordance with the archiving procedure described in Millpledge (or its Back-Up Policyhosting provider). 5.3 Security Alliance 6.3 Millpledge shall not be responsible for any loss, destruction, alteration or disclosure of your Customer Data caused by any third party (except those third parties sub- contracted Security Alliance party. 6.4 Millpledge strongly encourages you to perform services related take appropriate measures to secure, store and backup your important information and Customer Data maintenance and back-up(including Patient Records). 5.4 Security Alliance 6.5 Millpledge shall, in providing the ServicesService, comply with follow its Data Protection standard privacy and Information Security Policies relating security procedures to protect the privacy and security of the your Customer Data available by written request to Security AllianceData, as such document procedures may be amended from time to time by Security Alliance Millpledge in its sole discretion. 5.5 If Security Alliance processes any personal data 6.6 Millpledge has no duty (as such term is defined in unless applicable laws or regulations provide otherwise) to pre- screen, control, monitor or edit your Customer Data. 6.7 You agree that Millpledge may access and use your Customer Data for the General Data Protection Regulation (GDPR) on the Customer's behalf when performing its obligations under this Agreement, the parties record their intention that the Customer shall be the data controller and Security Alliance shall be a data processor and in any such case: 5.5.1 the Customer acknowledges and agrees that the personal data may be transferred purposes of providing support to you or stored outside the EEA or the country where the Customer and the your Authorised Users are located when requested, for security purposes, to develop and improve the Service as part of internal data processes, as permitted by applicable law and these Terms of Service and/or for the purposes of collecting and aggregating data as described in order clause 6.8. 6.8 Millpledge may monitor use of the Service by all of its customers and use the information gathered in an aggregate and anonymous manner. You agree that Millpledge may use and publish such information, provided that such information does not identify you. For clarity, any data provided to carry out the Services other customers or third parties will only be in an aggregated and Security Alliance’s other obligations under this Agreement; 5.5.2 the anonymous manner. Millpledge uses Customer shall ensure that the Customer is entitled to transfer the relevant personal Data in an anonymised manner for reporting purposes, including providing aggregated data to Security Alliance so that Security Alliance may lawfully use, process and transfer the personal data in accordance with this Agreement on the Customer's behalf; 5.5.3 the Customer shall ensure that the relevant third parties have been informed ofcorporate groups of their member veterinary practices, and have given their specific informed consent to, such use, processing, and transfer as required by all applicable data protection legislation;for machine learning that supports certain product features and/or functionality within the Service. 5.5.4 Security Alliance 6.9 This clause 6 shall process the personal data only in accordance with the terms of this Agreement and any lawful instructions reasonably given by the Customer from time to time; and 5.5.5 each party shall take appropriate technical and organisational measures against unauthorised survive termination or unlawful processing expiry of the personal data or its accidental loss, destruction or damageSubscription Term.