Common use of DESCRIPTION OF PROCESSING AND TRANSFERS Clause in Contracts

DESCRIPTION OF PROCESSING AND TRANSFERS. Categories of data subjects: • Prospects, customers, business partners, and vendors of the Controller (who are natural persons). • Controller’s users authorized by the Controller. Categories of personal data: The Controller may submit Personal Data to the Services, the extent of which is determined and controlled by the Controller. The Processor is not made aware of the types of data Customer backs up. The Customer may submit Personal Data to its ▇▇▇▇▇▇▇▇▇.▇▇▇ account, the extent of which is determined and controlled by the Customer in its sole discretion.Personal Data includes, but is not limited to the following: • First and last name • Title• Position • Employer • Contact information (company, email, phone, physical business address) • ID data Sensitive Data: No sensitive data will be processed or transferred and may not be contained in the content of or attachments to emails. The frequency of the processing and transfer (e.g. whether the data is transferred on a one- off or continuous basis): Continuous basis for the duration of the Agreement. Nature of the processing: The Processor processes Personal Data to the extent necessary to perform the Services under the Agreement, as further instructed by Customer pursuant to this DPA. Purpose(s) of the data transfer and further processing: Personal Data is transferred to sub-contractors who need to process some of Personal Data in order to provide their services to the Processor as part of the Services provided by the Processor to the Controller. The period for which Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: Unless agreed otherwise in writing, for the duration of the Agreement, subject to Section 11 of this DPA. For transfers to (Sub-) processors, also specify subject matter, nature and duration of the processing: The Sub-processor list set forth in Schedule 3 sets out Personal Data processed by each Sub-processor and the services provided by each Sub-processor.

DESCRIPTION OF PROCESSING AND TRANSFERS. Categories of data subjects: • Prospects, customers, business partners, and vendors of the Controller (who are natural persons). • Controller’s users authorized by the Controller. Categories of personal data: The Controller may submit Personal Data to the Services, the extent of which is determined and controlled by the Controller. The Processor is not made aware of the types of data Customer backs up. The Customer may submit Personal Data to its ▇▇▇▇▇▇▇▇▇.▇▇▇ account, the extent of which is determined and controlled by the Customer in its sole discretion.. Personal Data includes, but is not limited to the following: • First and last name • Title• Title • Position • Employer • Contact information (company, email, phone, physical business address) • ID data Sensitive Data: No sensitive data will be processed or transferred and may not be contained in the content of or attachments to emails. The frequency of the processing and transfer (e.g. whether the data is transferred on a one- one-off or continuous basis): Continuous basis for the duration of the Agreement. Nature of the processing: The Processor ActiveNav processes Personal Data to the extent necessary to perform the Services under the Agreement, as further instructed by Customer pursuant to this DPA. Purpose(s) of the data transfer and further processing: Personal Data is transferred to subSub-contractors processors who need to process some of Personal Data in order to provide their services to the Processor as part of the Services provided by the Processor to the Controller. The period for which Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: Unless agreed otherwise in writing, for the duration of the Agreement, subject to Section 11 of this DPA. For transfers to (Sub-) processors, also specify subject matter, nature and duration of the processing: The Sub-processor list set forth in Schedule 3 sets out Personal Data processed by each Sub-processor and the services provided by each Sub-Sub- processor.