Common use of SCCs Clause in Contracts

SCCs. The Customer and Lusha hereby assent to the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“SCCs”, available at ▇▇▇▇▇://▇▇▇-▇▇▇.▇▇▇▇▇▇.▇▇/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN), as follows: In Section II (Obligations of the Parties), Clause 9(a) for MODULE TWO: Transfer controller to processor: The data importer shall specifically inform the data exporter in writing of any intended changes to its list of sub-processors through the addition or replacement of sub-processors at least 10 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). If, in Lusha’s reasonable opinion, such objections are legitimate, Lusha shall either refrain from using such sub-processor in the context of the Processing of Personal Data or shall notify Customer of its intention to continue to use the sub-processor. Where Lusha notifies Customer of its intention to continue to use the sub-processor in these circumstances, Customer may, by providing written notice to Lusha, terminate the Agreement immediately. In Section IV (Final Provisions), Clause 17 for MODULE TWO: Transfer controller to processor: The Parties agree that this shall be the EU member state in which the Customer is established, or, if the Customer is not established in any EU member state, then the law of the Republic of Ireland. In Section IV (Final Provisions), Clause 18(b) for MODULE TWO: Transfer controller to processor: The Parties agree that those shall be the courts of the EU member state’s town in which the Customer is established, or, if the Customer is not established in any EU member state, then ▇▇▇ ▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇▇▇. In Annex I, for MODULE TWO: Transfer controller to processor: Data Exporter: Customer. Activities relevant to the data transferred under these Clauses: an organization using Lusha’s services which involves Lusha Processing Personal Data received from the Customer. Role: Controller. Data Importer: Lusha. Activities relevant to the data transferred under these Clauses: Developer, operator and provider of the Lusha services which involve Lusha Processing Personal Data received from the Customer. Role: Processor.

SCCs. The Customer and Lusha hereby assent to the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“SCCs”, available at ▇▇▇▇▇://▇▇▇-▇▇▇.▇▇▇▇▇▇.▇▇/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN), as follows: : 4.1. In Section II (Obligations of the Parties), Clause 9(a) for MODULE TWO: Transfer controller to processor: The data importer shall specifically inform the data exporter in writing of any intended changes to its list of sub-processors through the addition or replacement of sub-processors at least 10 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). If, in Lusha’s reasonable opinion, such objections are legitimate, Lusha shall either refrain from using such sub-processor in the context of the Processing of Personal Data or shall notify Customer of its intention to continue to use the sub-processor. Where Lusha notifies Customer of its intention to continue to use the sub-processor in these circumstances, Customer may, by providing written notice to Lusha, terminate the Agreement immediately. 4.2. In Section IV (Final Provisions), Clause 17 for MODULE TWO: Transfer controller to processor: The Parties agree that this shall be the EU member state in which the Customer is established, or, if the Customer is not established in any EU member state, then the law of the Republic of Ireland. 4.3. In Section IV (Final Provisions), Clause 18(b) for MODULE TWO: Transfer controller to processor: The Parties agree that those shall be the courts of the EU member state’s town in which the Customer is established, or, if the Customer is not established in any EU member state, then ▇▇▇ ▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇▇▇. 4.4. In Annex I, for MODULE TWO: Transfer controller to processor: : 4.4.1. Data Exporter: Customer. 1 Activities relevant to the data transferred under these Clauses: an organization using Lusha’s services which involves Lusha Processing Personal Data received from the Customer. Role: Controller. Data Importer: Lusha. Activities relevant to the data transferred under these Clauses: Developer, operator and provider of the Lusha services which involve Lusha Processing Personal Data received from the Customer. Role: Processor.