Common use of LIST OF PARTIES SEE APPENDIX 7 Clause in Contracts

LIST OF PARTIES SEE APPENDIX 7. B. DESCRIPTION OF TRANSFER SEE APPENDIX 8 APPENDIX 6 – SUB-PROCESSORS A CURRENT LIST OF OUR PROCESSORS CAN BE FOUND ON OUR WEBSITE OR CAN BE REQUESTED SEPARATELY. Our list contains the following information on all processors: Company name, Link to website, Service or transmission details, Country of processing, Subject matter of (sub-) processing, Nature of (sub-) processing, Duration of (sub-) processing, Concluded contract or appropriate safeguards according to Art. 44ff GDPR. IF YOU USE OTHER PROCESSORS NOT MENTIONED IN OUR LIST AND / OR APPROVED BY US, PLEASE SEND US A LIST OF THEIR PROCESSORS FOR VERIFICATION AND / OR APPROVAL. APPENDIX 7 – LIST OF PARTIES Party Number 1: Name: Provider name, see Main-Agreement Address: Provider address, see Main-Agreement Contact person’s name, position and contact details: Provider contact person, see Main-Agreement Activities relevant to the data transferred under these Clauses: All activities in which personal data are processed or transmitted If applicable, the controller’s data protection officer: If applicable, see website of Provider If applicable, the representative in the European Union: If applicable, see website of Provider Accession date/date: See date of Main-Agreement Role: Controller and/or Processor, based on the applicable SCCs Party Number 2: Name: Business Partner name, see Main-Agreement Address: Business Partner address, see Main-Agreement Contact person’s name, position and contact details: Business Partner contact person, see Main- Agreement Activities relevant to the data transferred under these Clauses: All activities in which personal data are processed or transmitted If applicable, the controller’s data protection officer: If applicable, see website of Business Partner If applicable, the representative in the European Union: If applicable, see website of Business Partner Accession date/date: See date of Main-Agreement Role: Controller and/or Processor, based on the applicable SCCs APPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER Categories of data subjects whose personal data is processed or transferred Customers, potential customers, employees, business partners, suppliers. Categories of personal data processed or transferred Customer data, data of potential customers, employee data, data of business partners, supplier data. Sensitive data processed or transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. Sensitive data processed or transferred None. Applied restrictions or safeguards None, because no sensitive data is processed or transferred.

LIST OF PARTIES SEE APPENDIX 7. B. DESCRIPTION OF TRANSFER SEE APPENDIX 8 APPENDIX 6 – SUB-PROCESSORS A CURRENT LIST OF OUR PROCESSORS CAN BE FOUND ON OUR WEBSITE OR CAN BE REQUESTED SEPARATELY. Our list contains the following information on all processors: Company name, Link to website, Service or transmission details, Country of processing, Subject matter of (sub-) processing, Nature of (sub-) processing, Duration of (sub-) processing, Concluded contract or appropriate safeguards according to Art. 44ff GDPR. IF YOU USE OTHER PROCESSORS NOT MENTIONED IN OUR LIST AND / OR APPROVED BY US, PLEASE SEND US A LIST OF THEIR PROCESSORS FOR VERIFICATION AND / OR APPROVAL. APPENDIX 7 – LIST OF PARTIES Party Number 1: Name: Provider name, see Main-Agreement Address: Provider address, see Main-Agreement Contact person’s name, position and contact details: Provider contact person, see Main-Agreement Activities relevant to the data transferred under these Clauses: All activities in which personal data are processed or transmitted If applicable, the controller’s data protection officer: If applicable, see website of Provider If applicable, the representative in the European Union: If applicable, see website of Provider Accession date/date: See date of Main-Agreement Role: Controller and/or Processor, based on the applicable SCCs or other contract, or Overseas Recipient Party Number 2: Name: Business Partner name, see Main-Agreement Address: Business Partner address, see Main-Agreement Contact person’s name, position and contact details: Business Partner contact person, see Main- Agreement Activities relevant to the data transferred under these Clauses: All activities in which personal data are processed or transmitted If applicable, the controller’s data protection officer: If applicable, see website of Business Partner If applicable, the representative in the European Union: If applicable, see website of Business Partner Accession date/date: See date of Main-Agreement Role: Controller and/or Processor, based on the applicable SCCs or other contract, or Overseas Recipient APPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER Categories of data subjects / personal information subjects whose personal data is processed or transferred transferred: Customers, potential customers, employees, business partners, suppliers. Categories of personal data / personal information processed or transferred transferred: Customer data, data of potential customers, employee data, data of business partners, supplier data. Sensitive data processed or transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. Sensitive data / sensitive personal information processed or transferred transferred: None. Applied restrictions or safeguards safeguards: None, because no sensitive data is processed or transferred. Frequency of transfer: The data is transferred on a continuous basis as long as the Main-Agreement is in force. Nature of the processing: See Main-Agreement, the following processing could occur: collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, otherwise making available, alignment, combination, restriction, erasure, destruction. Purpose(s) for which the personal data / personal information is processed on behalf of the controller or Purpose(s) of the data transfer and further processing: See Main-Agreement. Duration of the processing: Duration of the Main-Agreement. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period The criteria for determining the retention period is resulting from the main contract and statutory retention periods. For processing by or transfer to (sub-) processors, also specify subject matter, nature and duration of the processing Subject matter of (sub-) processing: SEE APPENDIX 6 Nature of (sub-) processing: SEE APPENDIX 6 Duration of (sub-) processing: SEE APPENDIX 6 APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES The technical and organizational security measures mentioned as follows are the minimum required from you, and are also fulfilled by us. If you have not implemented these technical and organizational security measures, please inform us immediately. Furthermore, you shall send us a list of all additional technical and organizational security measures taken by you, if any.