Common use of NATURE AND PURPOSES OF THE DATA PROCESSING Clause in Contracts

NATURE AND PURPOSES OF THE DATA PROCESSING. The nature of data processing consists of collecting, sorting, saving, transferring, restricting and deleting Personal Data in the context of Controller’s use of the Talkwalker Platform and Services. The purposes of the data processing concern: A – Controller’s users’ access to the Talkwalker Platform and Services based on such Controller’s users’ personal data provided by Controller to Processor for the purpose of defining Controller’s users’ accesses the Talkwalker Platform (processed data includes identification, authentication, login, access and audit trail data) B – Controller’s brand monitoring results processed on the basis of Controller’s specific searches and, if applicable, the personal data input by the Customer in the Talkwalker Platform for the purposes of Controller’s 360° internet media review, including brand monitoring, social media and web media listening and analytics, customer care and support CATEGORIES OF PERSONAL DATA AND OF DATA SUBJECTS A – Data provided by the Controller to the Processor relating to users appointed by the Controller to access to the Talkwalker Platform Data type Personal Data Purpose of use Non-Personal Data User settings IP address, cookies Keep login session, analytics Talkwalker service settings First and last name, email address, role of employee Politeness, security, authentication, subscription to marketing communications (possible to unsubscribe) Company name, Industry sector, Field of expertise, Access right level, Talkwalker settings (e.g. topics, queries), Time zone OAuth credentials and user IDs/nicknames of external connected services (Google, Twitter, Facebook…). Optional and subject to specific consent (screen). Used in order to fetch the data, or an alternative way to authenticate users into Talkwalker. Hash of Talkwalker login password (no storage of plain text passwords). In case Customer uses an XXXX 2.0 integration, no hashes/passwords need to be stored by Talkwalker Private insights As defined by the customer, typically same as Author Data (next section) Optional Data uploaded by the user through the API or the web interface Talkwalker service Alerts and Reports Recipient email address Necessary to establish communication Talkwalker stores a history of the last alerts/reports sent to Customers Exchange of email communication and support requests Sender email addresses (or telephone numbers) Necessary to establish communication Email server IP addresses Identification elements typically present in email footer/signatures Optional Description of the issue, requests Webserver log files IP address, username Incident investigation (typically abuse), capacity planning Resource accessed, timestamp Talkwalker service billing information First and last name, email address, IP address when subscription was signed as part of signing proof (electronic signature), telephone number, history of bills. Compliance with legal and corporate governance obligations and good practice Detailed information about the Customer (VAT information) service provided (start and end dates, fees, payment dates), complete billing address B – Author data related to the Controller’s monitoring of brands via the publications made in the internet, including social media users. Results provided by the Talkwalker Platform or API to the Controller to match Controller’s Queries in the Talkwalker Platform. Processor only processes information which has been made public by the data subject himself, such as:  Identification data (name, username, user id, geographical area);  Personal characteristics (age, gender, status);  Consumer habits;  Hobbies and interests;  Professional and educational background;  Pictures and videos;  Any other brand monitoring related information published by the data subject on a public Internet website or on a third-party platform that provides the Processor with data. ATTACHMENT 2 TECHNICAL AND ORGANISATIONAL MEASURES (cf. Articles 28 and 32 of the GDPR) A – Confidentiality  Employees o All staff working for Talkwalker are bound by confidentiality obligations pursuant to their employment agreement o Background checks  Physical access control

NATURE AND PURPOSES OF THE DATA PROCESSING. The nature of data processing consists of collecting, sorting, saving, transferring, restricting and deleting Personal Data in the context of Controller’s use of the Talkwalker Platform and Services. The purposes of the data processing concern: A – Controller’s users’ access to the Talkwalker Platform and Services based on such Controller’s users’ personal data provided by Controller to Processor for the purpose of defining Controller’s users’ accesses the Talkwalker Platform (processed data includes identification, authentication, login, access and audit trail data) B – Controller’s brand monitoring results processed on the basis of Controller’s specific searches and, if applicable, the personal data input by the Customer in the Talkwalker Platform for the purposes of Controller’s 360° internet media review, including brand monitoring, social media and web media listening and analytics, customer care and support CATEGORIES OF PERSONAL DATA AND OF DATA SUBJECTS A – Data provided by the Controller to the Processor relating to users appointed by the Controller to access to the Talkwalker Platform Data type Personal Data Purpose of use Non-Personal Data User settings IP address, cookies Keep login session, analytics Talkwalker service settings Politeness, security, Company name, Industry authentication, sector, Field of expertise, First and last name, email subscription to Access right level, Talkwalker address, role of employee Politenessmarketing settings (e.g. topics, securitycommunications queries), authentication, subscription to marketing communications Time zone Talkwalker service (possible to unsubscribe) Company name, Industry sector, Field Optional and subject to Hash of expertise, Access right level, Talkwalker login settings (e.g. topics, queries), Time zone OAuth credentials and specific consent password (no storage of user IDs/nicknames of external connected services (Google, Twitter, Facebook…). Optional and subject to specific consent (screen). Used in order plain text passwords). In external connected to fetch the data, or an alternative way to authenticate users into Talkwalker. Hash of Talkwalker login password (no storage of plain text passwords). In case Customer uses an XXXX services (Google, Twitter, alternative way to 2.0 integration, no Facebook…). authenticate users into hashes/passwords need to Talkwalker. be stored by Talkwalker Private insights As defined by the customer, typically same as Author Data (next section) Optional Data uploaded by the user customer, typically same through the API or the web as Author Data (next interface section) Talkwalker service Alerts and Reports Recipient email address Necessary to establish communication Talkwalker stores a history Alerts and of the last alerts/reports communication Reports sent to Customers Exchange of email communication and support requests Sender email addresses (or telephone numbers) Necessary to establish communication Email server IP addresses telephone numbers) communication communication Identification elements typically present in email footer/signatures Optional and support Description of the issue, typically present in email requests requests footer/signatures Webserver log files IP address, username Incident investigation Resource accessed, (typically abuse), files timestamp capacity planning Resource accessed, timestamp Talkwalker service billing information First and last name, email Detailed information about address, IP address when Compliance with legal the Customer (VAT Talkwalker service subscription was signed as and corporate information) service billing part of signing proof governance obligations provided (start and end information (electronic signature), telephone number, history of bills. Compliance with legal and corporate governance obligations and good practice Detailed information about the Customer (VAT information) service provided (start and end dates, fees, payment dates), telephone number, history complete billing address B – Author data related to the Controller’s monitoring of brands via the publications made in the internet, including social media users. Results provided by the Talkwalker Platform or API to the Controller to match Controller’s Queries in the Talkwalker Platform. Processor only processes information which has been made public by the data subject himself, such as:  Identification data (name, username, user id, geographical area);  Personal characteristics (age, gender, status);  Consumer habits;  Hobbies and interests;  Professional and educational background;  Pictures and videos;  Any other brand monitoring related information published by the data subject on a public Internet website or on a third-party platform that provides the Processor with data. ATTACHMENT 2 TECHNICAL AND ORGANISATIONAL MEASURES (cf. Articles 28 and 32 of the GDPR) A – Confidentiality  Employees o All staff working for Talkwalker are bound by confidentiality obligations pursuant to their employment agreement o Background checks  Physical access controlbills.

NATURE AND PURPOSES OF THE DATA PROCESSING. The nature of data processing consists of collecting, sorting, saving, transferring, restricting and deleting Personal Data in the context of Controller’s use of the Talkwalker Platform and Services. The purposes of the data processing concern: A – Controller’s users’ access to the Talkwalker Platform and Services based on such Controller’s users’ personal data provided by Controller to Processor for the purpose of defining Controller’s users’ accesses the Talkwalker Platform (processed data includes identification, authentication, login, access and audit trail data) B – Controller’s brand monitoring results results, including author data, processed on the basis of Controller’s specific searches and, if applicable, the personal data input by the Customer Queries in the Talkwalker Platform for the purposes of Controller’s 360° internet media review, including brand monitoring, social media and web media listening and analytics, customer care and support CATEGORIES OF PERSONAL DATA AND OF DATA SUBJECTS A – Data provided by the Controller to the Processor relating to users appointed by the Controller to access to the Talkwalker Platform Data type Personal Data Purpose of use Non-Personal Data User settings IP address, cookies Keep login session, analytics Talkwalker service settings First and last name, email address, role of employee Politeness, security, authentication, subscription to marketing communications (possible to unsubscribe) Company name, Industry sector, Field of expertise, Access right level, Talkwalker settings (e.g. topics, queries), Time zone OAuth credentials and user IDs/nicknames of external connected services (Google, Twitter, Facebook…). Optional and subject to specific consent (screen). Used in order to fetch the data, or an alternative way to authenticate users into Talkwalker. Hash of Talkwalker login password (no storage of plain text passwords). In case Customer uses an XXXX 2.0 integration, no hashes/passwords need to be stored by Talkwalker Private insights As defined by the customer, typically same as Author Data (next section) Optional Data uploaded by the user through the API or the web interface Talkwalker service Alerts and Reports Recipient email address Necessary to establish communication Talkwalker stores a history of the last alerts/reports sent to Customers Exchange of email communication and support requests Sender email addresses (or telephone numbers) Necessary to establish communication Email server IP addresses Identification elements typically present in email footer/signatures Optional Description of the issue, requests Webserver log files IP address, username Incident investigation (typically abuse), capacity planning Resource accessed, timestamp Talkwalker service billing information First and last name, email address, IP address when subscription was signed as part of signing proof (electronic signature), telephone number, history of bills. Compliance with legal and corporate governance obligations and good practice Detailed information about the Customer (VAT information) service provided (start and end dates, fees, payment dates), complete billing address B – Author data related to the Controller’s monitoring of brands via the publications made in the internet, including social media users. Results provided by the Talkwalker Platform or API to the Controller to match Controller’s Queries in the Talkwalker Platform. Processor only processes information which has been made public by the data subject himself, such as:  Identification data (name, username, user id, geographical area);  Personal characteristics (age, gender, status);  Consumer habits;  Hobbies and interests;  Professional and educational background;  Pictures and videos;  Any other brand monitoring related information published by the data subject on a public Internet website or on a third-party platform that provides the Processor with data. ATTACHMENT 2 TECHNICAL AND ORGANISATIONAL MEASURES (cf. Articles 28 and 32 of the GDPR) A – Confidentiality  Employees o All staff working for Talkwalker are bound by confidentiality obligations pursuant to their employment agreement o Background checks  Physical access control